Otorisasi RAM - Web Application Firewall - Alibaba Cloud Documentation Center

Resource Access Management (RAM) adalah layanan Alibaba Cloud yang dirancang untuk manajemen identitas pengguna dan kontrol izin akses resource. Melalui RAM, Anda dapat menerapkan prinsip least privilege tanpa perlu membagikan kunci akun Alibaba Cloud Anda kepada pengguna lain. RAM menggunakan kebijakan izin untuk menentukan otorisasi. Topik ini menjelaskan struktur umum kebijakan RAM, serta elemen pernyataan kebijakan (Action, Resource, dan Condition) yang didefinisikan oleh Web Application Firewall untuk kebijakan izin RAM. Kode RAM (RamCode) untuk Web Application Firewall adalah yundun-waf , dan granularitas otorisasi yang didukung adalah Resource-level .

Struktur umum kebijakan

Kebijakan izin menggunakan format JSON dengan struktur umum berikut:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

Berikut adalah penjelasan untuk setiap field dalam kebijakan

Version: Menentukan nomor versi kebijakan. Nilainya tetap 1.
Statement:
- Effect: Menentukan hasil otorisasi. Nilai yang valid: Allow dan Deny.
- Action: Menentukan satu atau beberapa operasi yang diizinkan atau ditolak.
- Resource: Menentukan objek spesifik yang terpengaruh oleh operasi tersebut. Anda dapat menggunakan Alibaba Cloud Resource Names (ARNs) untuk mengidentifikasi resource tertentu.
- Condition: Menentukan kondisi agar otorisasi berlaku. Field ini bersifat opsional.
  - Condition operator: Menentukan operator kondisional. Setiap jenis kondisi mendukung operator kondisional yang berbeda.
  - Condition_key: Menentukan condition key.
  - Condition_value: Menentukan nilai kondisi.

Action

Tabel berikut mencantumkan action yang didefinisikan oleh Web Application Firewall. Setiap kolom dalam tabel dijelaskan sebagai berikut:

Action: Dapat digunakan dalam elemen Action pada pernyataan kebijakan RAM untuk memberikan izin guna melakukan operasi tersebut.
API: API yang dipanggil untuk melakukan action tersebut.
Access level: Tingkat akses yang telah ditentukan untuk setiap API. Nilai yang valid: create, list, get, update, dan delete.
Resource type: Jenis resource yang mendukung otorisasi untuk melakukan action tersebut. Ini menunjukkan apakah action tersebut mendukung izin tingkat resource. Resource yang ditentukan harus kompatibel dengan action tersebut; jika tidak, kebijakan tidak akan berlaku.
- Untuk API dengan izin tingkat resource, jenis resource yang diperlukan ditandai dengan tanda bintang (*). Tentukan ARN yang sesuai dalam elemen Resource pada kebijakan.
- Untuk API tanpa izin tingkat resource, ini ditampilkan sebagai All Resources. Gunakan tanda bintang (*) dalam elemen Resource kebijakan.
Condition key: Ditentukan oleh layanan. Kunci ini memungkinkan kontrol yang lebih terperinci, yang berlaku baik untuk action saja maupun untuk action yang terkait dengan resource tertentu. Selain condition key spesifik layanan, Alibaba Cloud menyediakan serangkaian condition key umum yang berlaku di seluruh layanan yang terintegrasi dengan RAM. Untuk informasi lebih lanjut, lihat Common condition keys.
Dependent action: Action dependen yang diperlukan untuk menjalankan action tersebut. Agar action dapat dieksekusi dengan sukses, RAM user atau RAM role harus memiliki izin atas semua action dependen tersebut.

Action	API	Level akses	Tipe resource	Condition key	Action dependen
yundun-waf:DescribeApisecAbnormalDomainStatistic	DescribeApisecAbnormalDomainStatistic	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeRuleHitsTopClientIp	DescribeRuleHitsTopClientIp	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:ModifyHybridCloudCluster	ModifyHybridCloudCluster	update	All Resources ``	acs:ResourceGroupId	None
yundun-waf:CreateCerts	CreateCerts	create	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribePauseProtectionStatus	DescribePauseProtectionStatus	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeDefenseResourceGroup	DescribeDefenseResourceGroup	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeSensitiveRequestLog	DescribeSensitiveRequestLog	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DeleteCloudResource	DeleteCloudResource	delete	DefenseResource `acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/{#Resource}` DefenseResource `acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/{#ResourceInstanceId}-{#Port}-{#Product}`	None	None
yundun-waf:ModifyHybridCloudGroup	ModifyHybridCloudGroup	update	All Resources ``	acs:ResourceGroupId	None
yundun-waf:ModifyApisecStatus	ModifyApisecStatus	update	All Resources ``	acs:ResourceGroupId	None
yundun-waf:ModifyApisecAbnormals	ModifyApisecAbnormals	update	All Resources ``	acs:ResourceGroupId	None
yundun-waf:ModifyTemplateResources	ModifyTemplateResources	update	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeApisecSlsProjects	DescribeApisecSlsProjects	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:CreateDefenseRule	CreateDefenseRule	create	All Resources ``	acs:ResourceGroupId	None
yundun-waf:CreateHybridCloudGroup	CreateHybridCloudGroup	create	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeApisecEventDomainStatistic	DescribeApisecEventDomainStatistic	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeApisecMatchedHosts	DescribeApisecMatchedHosts	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:CreateMemberAccounts	CreateMemberAccounts	create	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeDefenseResourceOwnerUid	DescribeDefenseResourceOwnerUid	list	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DeleteAddress	DeleteAddress	delete	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DeleteCloudResourceExtensionCert	DeleteCloudResourceExtensionCert	delete	All Resources ``	None	None
yundun-waf:DescribeVisitTopIp	DescribeVisitTopIp	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeCommonLogFields	DescribeCommonLogFields	list	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeDefenseResourceTemplates	DescribeDefenseResourceTemplates	list	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeHybridCloudUser	DescribeHybridCloudUser	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeApisecStatistics	DescribeApisecStatistics	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeRuleHitsTopResource	DescribeRuleHitsTopResource	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeDefenseSceneConfig	DescribeDefenseSceneConfig	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DeleteDefenseRule	DeleteDefenseRule	delete	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribePeakTrend	DescribePeakTrend	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeDefenseRule	DescribeDefenseRule	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeThreatEventTopMetric	DescribeThreatEventTopMetric	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:ModifyDefenseTemplateStatus	ModifyDefenseTemplateStatus	update	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeDomainDetail	DescribeDomainDetail	get	DefenseResource `acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/{#Resource}` DefenseResource `acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/{#Resource}-waf`	None	None
yundun-waf:DescribeSecurityEventTopNMetric	DescribeSecurityEventTopNMetric	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:ModifyDomainCert	ModifyDomainCert	none	All Resources ``	None	None
yundun-waf:DescribeDefenseTemplateValidGroups	DescribeDefenseTemplateValidGroups	list	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DeleteLogDeliveryConfig	DeleteLogDeliveryConfig	delete	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeNetworkFlowTimeSeriesMetric	DescribeNetworkFlowTimeSeriesMetric	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeUserSlsLogRegions	DescribeUserSlsLogRegions	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeVisitUas	DescribeVisitUas	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeRuleHitsTopUrl	DescribeRuleHitsTopUrl	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:CreateCloudResourceExtensionCert	CreateCloudResourceExtensionCert	update	All Resources ``	None	None
yundun-waf:DescribeHybridCloudServerRegions	DescribeHybridCloudServerRegions	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:ModifyApisecModuleStatus	ModifyApisecModuleStatus	update	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeFlowChart	DescribeFlowChart	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:ModifyDefenseSceneConfig	ModifyDefenseSceneConfig	update	All Resources ``	acs:ResourceGroupId	None
yundun-waf:ModifyDefenseRuleStatus	ModifyDefenseRuleStatus	update	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeApisecLogDeliveries	DescribeApisecLogDeliveries	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeLogDeliveryConfig	DescribeLogDeliveryConfig	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeBaseSystemRules	DescribeBaseSystemRules	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeResourceSupportRegions	DescribeResourceSupportRegions	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:TagResources	TagResources	create	*DefenseResource `acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/{#Resource}`	None	None
yundun-waf:CreateDefenseTemplate	CreateDefenseTemplate	create	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeApisecEventDetail	DescribeApisecEventDetail	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:CreateSM2Cert	CreateSM2Cert	create	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeBaseRuleChangeLog	DescribeBaseRuleChangeLog	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeCustomBaseRuleCompileResult	DescribeCustomBaseRuleCompileResult	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeUserEventType	DescribeUserEventType	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:CreateCloudResource	CreateCloudResource	create	DefenseResource `acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/`	None	None
yundun-waf:DescribeDefenseResourceGroups	DescribeDefenseResourceGroups	list	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DeleteApisecEvents	DeleteApisecEvents	delete	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeApisecRules	DescribeApisecRules	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:ModifyUserWafLogStatus	ModifyUserWafLogStatus	update	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeUserAbnormalTrend	DescribeUserAbnormalTrend	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DeleteApisecAbnormals	DeleteApisecAbnormals	delete	All Resources ``	acs:ResourceGroupId	None
yundun-waf:ModifyHybridCloudSdkPullinStatus	ModifyHybridCloudSdkPullinStatus	update	All Resources ``	acs:ResourceGroupId	None
yundun-waf:ListTagResources	ListTagResources	get	*DefenseResource `acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/{#Resource}`	None	None
yundun-waf:DescribeApiExports	DescribeApiExports	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:ModifyApisecEvents	ModifyApisecEvents	update	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeApisecApiResources	DescribeApisecApiResources	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeAlarmBanner	DescribeAlarmBanner	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeSensitiveRequests	DescribeSensitiveRequests	list	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeUserEventTrend	DescribeUserEventTrend	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribePocFunctions	DescribePocFunctions	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeHybridCloudSupportRegions	DescribeHybridCloudSupportRegions	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeTemplateResources	DescribeTemplateResources	list	All Resources ``	acs:ResourceGroupId	None
yundun-waf:ReleaseInstance	ReleaseInstance	delete	All Resources ``	acs:ResourceGroupId	None
yundun-waf:ListTagKeys	ListTagKeys	list	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeAccountDelegatedStatus	DescribeAccountDelegatedStatus	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:ModifyLogDeliveryConfig	ModifyLogDeliveryConfig	create	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeCloudResources	DescribeCloudResources	list	All Resources ``	acs:ResourceGroupId	None
yundun-waf:ModifyDefenseTemplate	ModifyDefenseTemplate	update	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeMajorProtectionBlackIps	DescribeMajorProtectionBlackIps	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeApisecSensitiveDomainStatistic	DescribeApisecSensitiveDomainStatistic	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeVerifyContent	DescribeVerifyContent	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeSensitiveOutboundTrend	DescribeSensitiveOutboundTrend	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:ModifyCloudResourceCert	ModifyCloudResourceCert	none	All Resources ``	None	None
yundun-waf:ModifyUserLogFieldConfig	ModifyUserLogFieldConfig	update	All Resources ``	acs:ResourceGroupId	None
yundun-waf:ModifyHybridCloudClusterBypassStatus	ModifyHybridCloudClusterBypassStatus	update	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeNetworkFlowTopNMetric	DescribeNetworkFlowTopNMetric	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:ModifyDefenseRule	ModifyDefenseRule	update	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeTemplateResourceCount	DescribeTemplateResourceCount	list	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeApisecProtectionGroups	DescribeApisecProtectionGroups	list	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeDefaultHttps	DescribeDefaultHttps	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeDefenseResources	DescribeDefenseResources	list	DefenseResource `acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/`	None	None
yundun-waf:DescribeCloudResourceList	DescribeCloudResourceList	list	*DefenseResource `acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/{#Resource}`	None	yundun-waf:DescribeCloudResourceList
yundun-waf:DescribeLogDeliveryConfigs	DescribeLogDeliveryConfigs	list	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeSecurityEventTimeSeriesMetric	DescribeSecurityEventTimeSeriesMetric	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeHybridCloudProcessMonitor	DescribeHybridCloudProcessMonitor	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeSecurityEventLogs	DescribeSecurityEventLogs	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:CreateApiExport	CreateApiExport	create	All Resources ``	acs:ResourceGroupId	None
yundun-waf:ModifyMemberAccount	ModifyMemberAccount	update	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeRelatedDefenseRules	DescribeRelatedDefenseRules	list	All Resources ``	acs:ResourceGroupId	None
yundun-waf:ModifyCloudResource	ModifyCloudResource	update	DefenseResource `acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/{#Resource}` DefenseResource `acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/{#ResourceInstanceId}-{#Port}-{#Product}`	None	None
yundun-waf:DescribeSlsLogStore	DescribeSlsLogStore	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:CreateLogDeliveryConfig	CreateLogDeliveryConfig	create	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeFreeUserEventCount	DescribeFreeUserEventCount	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeResourceLogStatus	DescribeResourceLogStatus	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:UntagResources	UntagResources	delete	*DefenseResource `acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/{#Resource}`	None	None
yundun-waf:DescribeApisecAssetTrend	DescribeApisecAssetTrend	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:CopyDefenseTemplate	CopyDefenseTemplate	create	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeDefenseRules	DescribeDefenseRules	list	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeBotRuleLabels	DescribeBotRuleLabels	list	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeCloudResourceAccessPortDetails	DescribeCloudResourceAccessPortDetails	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:VerifyDomainOwner	VerifyDomainOwner	update	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeUserAbnormalType	DescribeUserAbnormalType	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:CreateMajorProtectionBlackIp	CreateMajorProtectionBlackIp	create	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeChargeModule	DescribeChargeModule	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:ModifyDomain	ModifyDomain	update	DefenseResource `acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/{#Resource}` DefenseResource `acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/{#Domain}-waf`	None	None
yundun-waf:DescribeFreeUserEventTypes	DescribeFreeUserEventTypes	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeFreeUserEvents	DescribeFreeUserEvents	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:ModifyHybridCloudGroupShrinkServer	ModifyHybridCloudGroupShrinkServer	update	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeResourceLogDeliveryStatus	DescribeResourceLogDeliveryStatus	list	All Resources ``	acs:ResourceGroupId	None
yundun-waf:CreateDefenseResource	CreateDefenseResource	create	DefenseResource `acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/`	None	None
yundun-waf:DescribeHybridCloudUnsupportPorts	DescribeHybridCloudUnsupportPorts	list	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeApisecAbnormals	DescribeApisecAbnormals	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeResourceInstanceCerts	DescribeResourceInstanceCerts	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribePostpayBills	DescribePostpayBills	list	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeChargeResult	DescribeChargeResult	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeSensitiveStatistic	DescribeSensitiveStatistic	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeApisecSuggestions	DescribeApisecSuggestions	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:CreateDomain	CreateDomain	create	DefenseResource `acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/`	None	None
yundun-waf:DescribeCerts	DescribeCerts	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DeleteMajorProtectionBlackIp	DeleteMajorProtectionBlackIp	delete	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeInstance	DescribeInstance	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeDefenseRuleStatistics	DescribeDefenseRuleStatistics	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeBotAppKey	DescribeBotAppKey	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeUserTraffic	DescribeUserTraffic	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:ListTagValues	ListTagValues	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeAbnormalCloudResources	DescribeAbnormalCloudResources	none	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeElasticBills	DescribeElasticBills	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:ModifyApisecLogDelivery	ModifyApisecLogDelivery	update	All Resources ``	acs:ResourceGroupId	None
yundun-waf:ChangeResourceGroup	ChangeResourceGroup	update	*DefenseResource `acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/{#Resource}`	None	yundun-waf:ChangeResourceGroup
yundun-waf:DescribePunishedDomains	DescribePunishedDomains	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeApisecEvents	DescribeApisecEvents	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeCnameCount	DescribeCnameCount	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeRuleHitsTopRuleId	DescribeRuleHitsTopRuleId	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:ModifyResourceLogFieldConfig	ModifyResourceLogFieldConfig	update	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeDefenseTemplates	DescribeDefenseTemplates	list	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeUserLogFieldConfig	DescribeUserLogFieldConfig	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeRuleHitsTopUa	DescribeRuleHitsTopUa	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DeleteHybridCloudGroup	DeleteHybridCloudGroup	delete	All Resources ``	acs:ResourceGroupId	None
yundun-waf:CreateHybridCloudCluster	CreateHybridCloudCluster	create	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeSensitiveDetectionResult	DescribeSensitiveDetectionResult	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeCloudResourceAccessedPorts	DescribeCloudResourceAccessedPorts	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeAddresses	DescribeAddresses	list	All Resources ``	acs:ResourceGroupId	None
yundun-waf:ModifyDefaultHttps	ModifyDefaultHttps	update	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DeleteDefenseResource	DeleteDefenseResource	delete	*DefenseResource `acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/{#Resource}`	None	None
yundun-waf:DescribeThreatEvent	DescribeThreatEvent	list	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeDomains	DescribeDomains	get	*DefenseResource `acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/{#Resource}`	None	yundun-waf:DescribeDomains
yundun-waf:DescribeHybridCloudClusterServers	DescribeHybridCloudClusterServers	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:ModifyDefenseRuleCache	ModifyDefenseRuleCache	update	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeUserApiRequest	DescribeUserApiRequest	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeApisecUserOperations	DescribeApisecUserOperations	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:CreateDefenseResourceGroup	CreateDefenseResourceGroup	create	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeSlsLogStoreStatus	DescribeSlsLogStoreStatus	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeHybridCloudProtectableCount	DescribeHybridCloudProtectableCount	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeMemberAccounts	DescribeMemberAccounts	list	All Resources ``	acs:ResourceGroupId	None
yundun-waf:CreatePostpaidInstance	CreatePostpaidInstance	create	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeDefenseResource	DescribeDefenseResource	get	*DefenseResource `acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/{#Resource}`	None	None
yundun-waf:DeleteDefenseTemplate	DeleteDefenseTemplate	delete	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeHybridCloudResourceDetail	DescribeHybridCloudResourceDetail	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DeleteDomain	DeleteDomain	delete	DefenseResource `acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/{#Resource}` DefenseResource `acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/{#Domain}-waf`	None	None
yundun-waf:ClearAddress	ClearAddress	delete	All Resources ``	acs:ResourceGroupId	None
yundun-waf:ModifyDefenseResourceGroup	ModifyDefenseResourceGroup	update	All Resources ``	acs:ResourceGroupId	None
yundun-waf:ModifyResourceLogStatus	ModifyResourceLogStatus	update	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeWafSourceIpSegment	DescribeWafSourceIpSegment	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeRuleHitsTopTuleType	DescribeRuleHitsTopTuleType	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:ModifyHybridCloudClusterRule	ModifyHybridCloudClusterRule	update	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeHybridCloudBasicMonitor	DescribeHybridCloudBasicMonitor	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DeleteMemberAccount	DeleteMemberAccount	delete	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeDDoSStatus	DescribeDDoSStatus	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:ModifyApisecLogDeliveryStatus	ModifyApisecLogDeliveryStatus	update	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeHybridCloudUnassignedMachines	DescribeHybridCloudUnassignedMachines	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeDefenseTemplate	DescribeDefenseTemplate	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeThreatEventDetail	DescribeThreatEventDetail	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:ModifyHybridCloudServer	ModifyHybridCloudServer	update	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeFreeUserAssetCount	DescribeFreeUserAssetCount	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:SyncProductInstance	SyncProductInstance	create	All Resources ``	acs:ResourceGroupId	None
yundun-waf:ModifyDefenseResourceXff	ModifyDefenseResourceXff	update	*DefenseResource `acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/{#Resource}`	None	None
yundun-waf:DescribeDomainUsedPorts	DescribeDomainUsedPorts	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeUserAsset	DescribeUserAsset	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeApisecProtectionResources	DescribeApisecProtectionResources	list	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeApisecSlsLogStores	DescribeApisecSlsLogStores	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeDefenseResourceGroupNames	DescribeDefenseResourceGroupNames	list	All Resources ``	acs:ResourceGroupId	None
yundun-waf:ModifyHybridCloudGroupExpansionServer	ModifyHybridCloudGroupExpansionServer	update	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeHybridCloudClusterRule	DescribeHybridCloudClusterRule	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeSensitiveOutboundStatistic	DescribeSensitiveOutboundStatistic	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:CreateHybridCloudClusterRule	CreateHybridCloudClusterRule	create	All Resources ``	acs:ResourceGroupId	None
yundun-waf:ClearMajorProtectionBlackIp	ClearMajorProtectionBlackIp	delete	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DeleteHybridCloudClusterRule	DeleteHybridCloudClusterRule	delete	All Resources ``	acs:ResourceGroupId	None
yundun-waf:InitializeWafOperationRole	InitializeWafOperationRole	create	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeHybridCloudSdkServers	DescribeHybridCloudSdkServers	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeSensitiveApiStatistic	DescribeSensitiveApiStatistic	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:ModifyApisecApiResource	ModifyApisecApiResource	update	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeProductInstances	DescribeProductInstances	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeResponseCodeTrendGraph	DescribeResponseCodeTrendGraph	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeHybridCloudClusterRules	DescribeHybridCloudClusterRules	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeHybridCloudResources	DescribeHybridCloudResources	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeRuleGroups	DescribeRuleGroups	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeUserWafLogStatus	DescribeUserWafLogStatus	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeResourceRegionId	DescribeResourceRegionId	list	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeApisecExamples	DescribeApisecExamples	list	All Resources ``	acs:ResourceGroupId	None
yundun-waf:CreatePocFunction	CreatePocFunction	create	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeRoleAuthStatus	DescribeRoleAuthStatus	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeResourcePort	DescribeResourcePort	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:ModifyCloudResourceDefaultCert	ModifyCloudResourceDefaultCert	update	All Resources ``	None	None
yundun-waf:DescribeDomainDNSRecord	DescribeDomainDNSRecord	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:ReCreateCloudResource	ReCreateCloudResource	none	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeDefenseTemplateValidResources	DescribeDefenseTemplateValidResources	list	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribePrepayDailyBills	DescribePrepayDailyBills	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeHybridCloudClusters	DescribeHybridCloudClusters	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeFlowTopUrl	DescribeFlowTopUrl	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:AddAddress	AddAddress	update	All Resources ``	acs:ResourceGroupId	None
yundun-waf:ModifyPauseProtectionStatus	ModifyPauseProtectionStatus	update	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DeleteDefenseRuleBlockIp	DeleteDefenseRuleBlockIp	delete	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeIpAbroadCountryInfos	DescribeIpAbroadCountryInfos	list	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeAlarmList	DescribeAlarmList	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:ModifyDomainPunishStatus	ModifyDomainPunishStatus	update	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeSensitiveOutboundDistribution	DescribeSensitiveOutboundDistribution	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeDefenseGroupValidResources	DescribeDefenseGroupValidResources	list	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeFlowTopResource	DescribeFlowTopResource	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:ModifyResourceLogDeliveryStatus	ModifyResourceLogDeliveryStatus	update	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeResourceLogFieldConfig	DescribeResourceLogFieldConfig	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeHybridCloudGroups	DescribeHybridCloudGroups	list	All Resources ``	acs:ResourceGroupId	None
yundun-waf:ModifyMajorProtectionBlackIp	ModifyMajorProtectionBlackIp	update	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeCertDetail	DescribeCertDetail	get	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DeleteDefenseResourceGroup	DeleteDefenseResourceGroup	delete	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeDefenseResourceNames	DescribeDefenseResourceNames	list	All Resources ``	acs:ResourceGroupId	None
yundun-waf:DescribeSlsAuthStatus	DescribeSlsAuthStatus	get	All Resources ``	acs:ResourceGroupId	None

Resource

Tabel berikut mencantumkan resource yang ditentukan oleh Web Application Firewall. Tentukan resource tersebut dalam elemen Resource pada pernyataan kebijakan RAM untuk memberikan izin terhadap operasi tertentu. Resource tersebut diidentifikasi secara unik menggunakan ARN dengan format: acs:{#ramcode}:{#regionId}:{#accountId}:{#resourceType}:

acs: Singkatan dari Alibaba Cloud service, yang menunjukkan cloud publik Alibaba Cloud.
{#ramcode}: Kode yang digunakan dalam RAM untuk menunjukkan layanan Alibaba Cloud.
{#regionId}: region ID. Jika resource mencakup semua wilayah, atur nilainya menjadi tanda bintang (*).
{#accountId}: ID akun Alibaba Cloud. Jika resource mencakup semua akun Alibaba Cloud, atur nilainya menjadi tanda bintang (*).
{#resourceType}: Identifier resource yang ditentukan oleh layanan. Mendukung struktur hierarkis, mirip dengan path file. Jika pernyataan mencakup resource global, atur nilainya menjadi tanda bintang (*).

Tipe resource	ARN
DefenseResource	acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/{#Resource} acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/{#ResourceInstanceId}-{#Port}-{#Product} acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/{#Resource}-waf acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/* acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/{#Domain}-waf

Condition

Tabel berikut mencantumkan condition key tingkat produk yang didefinisikan oleh Web Application Firewall. Anda juga dapat menggunakan Common condition keys dari Alibaba Cloud. Tentukan kunci-kunci ini dalam elemen Condition pada pernyataan kebijakan RAM untuk menetapkan aturan otorisasi yang lebih terperinci. Dalam condition key, tentukan nilai kondisi dalam elemen Condition_value pada kebijakan.

Setiap condition key memiliki tipe data tertentu, seperti string, number, Boolean, atau alamat IP. Tipe data tersebut menentukan operator kondisional mana yang dapat digunakan untuk membandingkan nilai permintaan dengan nilai kebijakan. Anda harus menentukan operator kondisional yang kompatibel dengan tipe data condition key tersebut. Operator yang tidak sesuai akan membuat kebijakan tidak berlaku. Lihat Condition operator untuk kombinasi yang valid.

Condition key	Deskripsi	Tipe data
acs:ResourceGroupId	ID kelompok sumber daya.	String

Cara membuat kebijakan RAM kustom?

Anda dapat membuat kebijakan kustom dan memberikannya kepada RAM user, RAM user group, atau RAM role. Untuk caranya, lihat: