CDN:リソースグループによるきめ細かなアクセス制御

仕組み

リソースグループは、プロジェクトや環境ごとにリソースを整理します。リソースをグループ化したら、そのグループにのみ権限を限定する RAM ポリシーをアイデンティティ (RAM ユーザー、ユーザーグループ、ロールなど) にアタッチできます。詳細については、「リソースのグループ化と権限付与」をご参照ください。

このアプローチには、主に 2 つのメリットがあります。

• きめ細かなアクセス制御：アカウント全体の権限を付与する代わりに、アイデンティティのアクセスを特定のグループ内のリソースのみに制限できます。これにより、プロジェクト固有のワークロードを分離し、意図しないアクセスのリスクを軽減できます。

• 管理の簡素化：新しいリソースがリソースグループに追加されると、そのグループに限定された権限を持つ RAM アイデンティティは自動的にアクセスできます。新しいリソースが作成されるたびに RAM ポリシーを更新する必要はありません。

RAM ユーザーへのリソースグループレベルの権限付与

このセクションでは、特定のリソースグループ内のAlibaba Cloud CDN (CDN)リソースにのみアクセス権限を RAM ユーザーに付与する方法について説明します。

サポート対象リソース

以下のAlibaba Cloud CDN (CDN)リソースは、リソースグループレベルの権限付与をサポートしています。

サポート対象外アクション

以下のAlibaba Cloud CDN (CDN)アクションは、リソースグループレベルの権限付与をサポートしていません。

上記のアクションについては、 [Resource Scope] を [Account] に設定し、カスタムポリシーを作成する必要があります。

以下のポリシー例は、必要に応じてカスタマイズ可能です。

• 読み取り専用アクセスの許可

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "cdn:BatchDescribeCdnIpInfo",
          "cdn:BatchDescribeDomainBackupCname",
          "cdn:BatchDescribeDomainMd5Info",
          "cdn:DescribeActiveConfigGroupVersion",
          "cdn:DescribeBlockedRegions",
          "cdn:DescribeCdnCcSignatureArgList",
          "cdn:DescribeCdnCcSignatureObjectList",
          "cdn:DescribeCdnCertificateDetail",
          "cdn:DescribeCdnCertificateDetailById",
          "cdn:DescribeCdnComputeUserDomain",
          "cdn:DescribeCdnConditionIPBInfo",
          "cdn:DescribeCdnDeletedDomains",
          "cdn:DescribeCdnDeliverList",
          "cdn:DescribeCdnDiagnoseReport",
          "cdn:DescribeCdnDomainByCertificate",
          "cdn:DescribeCdnFullDomainsBlockIPConfig",
          "cdn:DescribeCdnFullDomainsBlockIPHistory",
          "cdn:DescribeCdnHttpsDomainList",
          "cdn:DescribeCdnIpCidr",
          "cdn:DescribeCdnMonitorData",
          "cdn:DescribeCdnOrderCommodityCode",
          "cdn:DescribeCdnRegionAndIsp",
          "cdn:DescribeCdnReportList",
          "cdn:DescribeCdnSMCertificateDetail",
          "cdn:DescribeCdnSecFuncInfo",
          "cdn:DescribeCdnService",
          "cdn:DescribeCdnSubList",
          "cdn:DescribeCdnTypes",
          "cdn:DescribeCdnUserAppSecDrop",
          "cdn:DescribeCdnUserBillHistory",
          "cdn:DescribeCdnUserBillPrediction",
          "cdn:DescribeCdnUserBillType",
          "cdn:DescribeCdnUserConfigs",
          "cdn:DescribeCdnUserQuota",
          "cdn:DescribeCdnUserResourcePackage",
          "cdn:DescribeCdnUserSecDrop",
          "cdn:DescribeCertificateInfoByID",
          "cdn:DescribeConfigGroupDetail",
          "cdn:DescribeConfigGroupVersion",
          "cdn:DescribeCustomDomainSampleRate",
          "cdn:DescribeCustomLogConfig",
          "cdn:DescribeDomainConfigs",
          "cdn:DescribeDomainISPLocationDetailData",
          "cdn:DescribeDomainMd5Info",
          "cdn:DescribeDomainSrcFlowData",
          "cdn:DescribeDomainVerifyData",
          "cdn:DescribeDomainsBySource",
          "cdn:DescribeEsExceptionData",
          "cdn:DescribeEsExecuteData",
          "cdn:DescribeFCTrigger",
          "cdn:DescribeGifshowView",
          "cdn:DescribeIpInfo",
          "cdn:DescribeIpStatus",
          "cdn:DescribeLiveStreamOnlineUserNum",
          "cdn:DescribeLiveStreamPushData",
          "cdn:DescribeLiveStreamRecordIndexFile",
          "cdn:DescribeLiveStreamRecordIndexFiles",
          "cdn:DescribeLiveStreamSnapshotInfo",
          "cdn:DescribeLiveStreamTranscodeStreamNum",
          "cdn:DescribeLiveStreamsFrameRateAndBitRateData",
          "cdn:DescribeLiveStreamsOnlineList",
          "cdn:DescribePreloadDetailById",
          "cdn:DescribeRealtimeDeliveryAcc",
          "cdn:DescribeRealtimeLogAuthorized",
          "cdn:DescribeRefreshQuota",
          "cdn:DescribeRefreshTaskById",
          "cdn:DescribeRefreshTasks1",
          "cdn:DescribeSinaUidsBlockData",
          "cdn:DescribeSnMultiLive",
          "cdn:DescribeStagingIp",
          "cdn:DescribeTopDomainsByFlow",
          "cdn:DescribeUserCdnStatus",
          "cdn:DescribeUserCdncomputeStatus",
          "cdn:DescribeUserCertificateExpireCount",
          "cdn:DescribeUserConfigs",
          "cdn:DescribeUserTags",
          "cdn:DescribeUserUsageDataExportTask",
          "cdn:DescribeUserUsageDetailDataExportTask",
          "cdn:DescribeVerifyContent",
          "cdn:DescribeVersionConfig",
          "cdn:DescribeVersionConfigForDiff",
          "cdn:DescribeViewUsedTraf",
          "cdn:GetCancelPreloadTask",
          "cdn:ListConfigGroupActivateRecords",
          "cdn:ListConfigGroupVersionDomains",
          "cdn:ListConfigGroupVersions",
          "cdn:ListConfigGroups",
          "cdn:ListDomainsByLogConfigId",
          "cdn:ListEsTemplateInfo",
          "cdn:ListFCTrigger",
          "cdn:ListRealtimeLogDelivery",
          "cdn:ListRealtimeLogDeliveryDomains",
          "cdn:ListRealtimeLogDeliveryInfos",
          "cdn:ListUserCustomLogConfig"
        ],
        "Resource": "*"
      }
    ]
  }
  

• フルアクセスの許可

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "cdn:ActivateConfigGroupVersion",
          "cdn:AddConfigGroup",
          "cdn:AddFCTrigger",
          "cdn:AddLivePullStreamInfo",
          "cdn:AdvancePurgeObjectCache",
          "cdn:BatchDescribeCdnIpInfo",
          "cdn:BatchDescribeDomainBackupCname",
          "cdn:BatchDescribeDomainMd5Info",
          "cdn:CdnMigrateRegister",
          "cdn:ChangeCdnDomainToDcdn",
          "cdn:CheckDomainBeiAnExpiration",
          "cdn:CloneConfigGroupVersion",
          "cdn:CreateCdnCertificateSigningRequest",
          "cdn:CreateCdnComputeDomain",
          "cdn:CreateCdnbag",
          "cdn:CreateLiveStreamRecordIndexFiles",
          "cdn:CreateUserUsageDataExportTask",
          "cdn:DeactivateConfigGroupVersion",
          "cdn:DeleteCdnDeliverTask",
          "cdn:DeleteCdnSubTask",
          "cdn:DeleteConfigGroup",
          "cdn:DeleteConfigGroupVersion",
          "cdn:DeleteFCTrigger",
          "cdn:DeleteLivePullStreamInfo",
          "cdn:DeleteRealTimeLogLogstore",
          "cdn:DeleteUsageDetailDataExportTask",
          "cdn:DeleteUserUsageDataExportTask",
          "cdn:DeleteVersionConfig",
          "cdn:DescribeActiveConfigGroupVersion",
          "cdn:DescribeBlockedRegions",
          "cdn:DescribeCdnCcSignatureArgList",
          "cdn:DescribeCdnCcSignatureObjectList",
          "cdn:DescribeCdnCertificateDetail",
          "cdn:DescribeCdnCertificateDetailById",
          "cdn:DescribeCdnComputeUserDomain",
          "cdn:DescribeCdnConditionIPBInfo",
          "cdn:DescribeCdnDeletedDomains",
          "cdn:DescribeCdnDeliverList",
          "cdn:DescribeCdnDiagnoseReport",
          "cdn:DescribeCdnDomainByCertificate",
          "cdn:DescribeCdnFullDomainsBlockIPConfig",
          "cdn:DescribeCdnFullDomainsBlockIPHistory",
          "cdn:DescribeCdnHttpsDomainList",
          "cdn:DescribeCdnIpCidr",
          "cdn:DescribeCdnMonitorData",
          "cdn:DescribeCdnOrderCommodityCode",
          "cdn:DescribeCdnRegionAndIsp",
          "cdn:DescribeCdnReportList",
          "cdn:DescribeCdnSMCertificateDetail",
          "cdn:DescribeCdnSecFuncInfo",
          "cdn:DescribeCdnService",
          "cdn:DescribeCdnSubList",
          "cdn:DescribeCdnTypes",
          "cdn:DescribeCdnUserAppSecDrop",
          "cdn:DescribeCdnUserBillHistory",
          "cdn:DescribeCdnUserBillPrediction",
          "cdn:DescribeCdnUserBillType",
          "cdn:DescribeCdnUserConfigs",
          "cdn:DescribeCdnUserQuota",
          "cdn:DescribeCdnUserResourcePackage",
          "cdn:DescribeCdnUserSecDrop",
          "cdn:DescribeCertificateInfoByID",
          "cdn:DescribeConfigGroupDetail",
          "cdn:DescribeConfigGroupVersion",
          "cdn:DescribeCustomDomainSampleRate",
          "cdn:DescribeCustomLogConfig",
          "cdn:DescribeDomainConfigs",
          "cdn:DescribeDomainISPLocationDetailData",
          "cdn:DescribeDomainMd5Info",
          "cdn:DescribeDomainSrcFlowData",
          "cdn:DescribeDomainVerifyData",
          "cdn:DescribeDomainsBySource",
          "cdn:DescribeEsExceptionData",
          "cdn:DescribeEsExecuteData",
          "cdn:DescribeFCTrigger",
          "cdn:DescribeGifshowView",
          "cdn:DescribeIpInfo",
          "cdn:DescribeIpStatus",
          "cdn:DescribeLiveStreamOnlineUserNum",
          "cdn:DescribeLiveStreamPushData",
          "cdn:DescribeLiveStreamRecordIndexFile",
          "cdn:DescribeLiveStreamRecordIndexFiles",
          "cdn:DescribeLiveStreamSnapshotInfo",
          "cdn:DescribeLiveStreamTranscodeStreamNum",
          "cdn:DescribeLiveStreamsFrameRateAndBitRateData",
          "cdn:DescribeLiveStreamsOnlineList",
          "cdn:DescribePreloadDetailById",
          "cdn:DescribeRealtimeDeliveryAcc",
          "cdn:DescribeRealtimeLogAuthorized",
          "cdn:DescribeRefreshQuota",
          "cdn:DescribeRefreshTaskById",
          "cdn:DescribeRefreshTasks1",
          "cdn:DescribeSinaUidsBlockData",
          "cdn:DescribeSnMultiLive",
          "cdn:DescribeStagingIp",
          "cdn:DescribeTopDomainsByFlow",
          "cdn:DescribeUserCdnStatus",
          "cdn:DescribeUserCdncomputeStatus",
          "cdn:DescribeUserCertificateExpireCount",
          "cdn:DescribeUserConfigs",
          "cdn:DescribeUserTags",
          "cdn:DescribeUserUsageDataExportTask",
          "cdn:DescribeUserUsageDetailDataExportTask",
          "cdn:DescribeVerifyContent",
          "cdn:DescribeVersionConfig",
          "cdn:DescribeVersionConfigForDiff",
          "cdn:DescribeViewUsedTraf",
          "cdn:ForbidLiveStream",
          "cdn:GenerateCdnDiagnose",
          "cdn:GetCancelPreloadTask",
          "cdn:HttpRequestStagingTest",
          "cdn:HttpRequestTestTool",
          "cdn:ListConfigGroupActivateRecords",
          "cdn:ListConfigGroupVersionDomains",
          "cdn:ListConfigGroupVersions",
          "cdn:ListConfigGroups",
          "cdn:ListDomainsByLogConfigId",
          "cdn:ListEsTemplateInfo",
          "cdn:ListFCTrigger",
          "cdn:ListRealtimeLogDelivery",
          "cdn:ListRealtimeLogDeliveryDomains",
          "cdn:ListRealtimeLogDeliveryInfos",
          "cdn:ListUserCustomLogConfig",
          "cdn:ModifyBlockSinaUids",
          "cdn:ModifyByteUrlBlockData",
          "cdn:ModifyCdnDomainOwner",
          "cdn:ModifyCdnService",
          "cdn:ModifyConfigGroup",
          "cdn:ModifyConfigGroupVersion",
          "cdn:ModifyCustomDomainSampleRate",
          "cdn:ModifyRefererBlockData",
          "cdn:NotifyDomainBeiAnExpiration",
          "cdn:OpenCdnService",
          "cdn:PenaliseDomainBeiAnExpiration",
          "cdn:RefreshObjectCacheByCacheTag",
          "cdn:ResumeLiveStream",
          "cdn:SetCdnDomainSMCertificate",
          "cdn:SetCdnFullDomainsBlockIP",
          "cdn:SetCdnUserConfig",
          "cdn:SetForceRedirectConfig",
          "cdn:SetHttpHeaderConfig",
          "cdn:SetHttpsOptionConfig",
          "cdn:SetIgnoreQueryStringConfig",
          "cdn:SetIpAllowListConfig",
          "cdn:SetIpBlackListConfig",
          "cdn:SetOptimizeConfig",
          "cdn:SetPageCompressConfig",
          "cdn:SetPathCacheExpiredConfig",
          "cdn:SetRemoteReqAuthConfig",
          "cdn:SetReqAuthConfig",
          "cdn:SetReqHeaderConfig",
          "cdn:SetSnMultiLive",
          "cdn:SetSnMultiLiveDomainConf",
          "cdn:SetSourceHostConfig",
          "cdn:SetVersionConfig",
          "cdn:SetWaitingRoomConfig",
          "cdn:StopPreload",
          "cdn:UpdateCdnDeliverTask",
          "cdn:UpdateFCTrigger",
          "cdn:VerifyDomainOwner",
          "cdn:describeRefreshTasks",
          "cdn:describeUserDomains",
          "cdn:describeVerifyContent",
          "cdn:describedomainsrcqpsdata",
          "cdn:verifyDomainOwner"
        ],
        "Resource": "*"
      }
    ]
  }
  

よくある質問