RAM authorization - ApsaraDB for MongoDB - Alibaba Cloud ドキュメントセンター

Resource Access Management (RAM) is a service provided by Alibaba Cloud to manage user identities and resource access permissions. Using RAM helps you avoid sharing your Alibaba Cloud account keys with other users and allows you to grant users the least privilege access. RAM uses permission policies to define authorizations. This topic describes the general structure of a RAM policy, and the policy statement elements (Action, Resource, and Condition) defined by ApsaraDB for MongoDB for RAM permission policies. The RAM code (RamCode) for ApsaraDB for MongoDB is dds , and the supported authorization granularity is RESOURCE .

General structure of a policy

Permission policies support JSON format with the following general structure:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

The following list describes the fields in the policy:

Version: Specifies the policy version number. It is fixed at 1.
Statement:
- Effect: Specifies the authorization result. Valid values: Allow and Deny.
- Action: Specifies one or more operations that are allowed or denied.
- Resource: Specifies the specific objects affected by the operations. You can use Alibaba Cloud Resource Names (ARNs) to describe specific resources.
- Condition: Specifies the conditions for the authorization to take effect. This field is optional.
  - Condition operator: Specifies the conditional operators. Different types of conditions support different conditional operators.
  - Condition_key: Specifies the condition keys.
  - Condition_value: Specifies the condition values.

Action

The following table lists the actions defined by ApsaraDB for MongoDB. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that support authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding ARN in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys that are applicable across all RAM-integrated services. For more information, see Common condition keys.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action	API	Access level	Resource type	Condition key	Dependent action
dds:DescribeAuditPolicy	DescribeAuditPolicy	get	*dbinstance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:DescribeDBInstanceSSL	DescribeDBInstanceSSL	get	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:ModifyAuditPolicy	ModifyAuditPolicy	update	*dbinstance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:TransferClusterBackup	TransferClusterBackup	none	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:ModifyNodeSpec	ModifyNodeSpec	update	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:DescribeAvailabilityZones	DescribeAvailabilityZones	list	All Resource ``	None	None
dds:TagResources	TagResources	update	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:ModifyDBInstanceAttribute	ModifyDBInstanceAttribute	update	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:ModifyDBInstanceDescription	ModifyDBInstanceDescription	update	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:UpgradeDBInstanceEngineVersion	UpgradeDBInstanceEngineVersion	update	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:DescribeParameterModificationHistory	DescribeParameterModificationHistory	get	*dbinstance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:DescribeActiveOperationTasks	DescribeActiveOperationTasks	list	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:DescribeShardingNetworkAddress	DescribeShardingNetworkAddress	get	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:MigrateAvailableZone	MigrateAvailableZone	update	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:ModifyGlobalSecurityIPGroupName	ModifyGlobalSecurityIPGroupName	update	All Resource ``	None	None
dds:ModifyParameters	ModifyParameters	update	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:ModifyDBInstanceNetExpireTime	ModifyDBInstanceNetExpireTime	update	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:DescribeBackupTasks	DescribeBackupTasks	none	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:ReleaseNodePrivateNetworkAddress	ReleaseNodePrivateNetworkAddress	update	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbInstanceId}`	None	None
dds:CreateGlobalSecurityIPGroup	CreateGlobalSecurityIPGroup	create	All Resource ``	None	None
dds:CreateAccount	CreateAccount	create	*DBInstance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbInstanceId}`	None	None
dds:DestroyInstance	DestroyInstance	delete	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:DescribeActiveOperationTaskType	DescribeActiveOperationTaskType	get	All Resource ``	None	None
dds:DescribeHistoryTasks	DescribeHistoryTasks	list	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#InstanceId}`	None	None
dds:ModifyBackupPolicy	ModifyBackupPolicy	update	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:ModifyDBInstanceConnectionString	ModifyDBInstanceConnectionString	update	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:DescribeActiveOperationTask	DescribeActiveOperationTask	get	All Resource ``	None	None
dds:DeleteGlobalSecurityIPGroup	DeleteGlobalSecurityIPGroup	delete	All Resource ``	None	None
dds:ModifyDBInstanceTDE	ModifyDBInstanceTDE	update	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:DescribeDBInstanceEncryptionKey	DescribeDBInstanceEncryptionKey	get	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:DescribeRestoreDBInstanceList	DescribeRestoreDBInstanceList	get	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:ModifyDBInstanceSpec	ModifyDBInstanceSpec	update	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:DescribeActiveOperationTaskCount	DescribeActiveOperationTaskCount	get	All Resource ``	None	None
dds:DescribeAvailableEngineVersion	DescribeAvailableEngineVersion	get	*dbinstance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:DescribeBackupDBs	DescribeBackupDBs	get	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:DescribeMongoDBLogConfig	DescribeMongoDBLogConfig	get	*dbinstance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:DescribeActiveOperationTaskRegion	DescribeActiveOperationTaskRegion	list	All Resource ``	None	None
dds:UntagResources	UntagResources	update	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:DescribeInstanceAutoRenewalAttribute	DescribeInstanceAutoRenewalAttribute	get	Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:DescribeDBInstanceTDEInfo	DescribeDBInstanceTDEInfo	get	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:DescribeActiveOperationMaintenanceConfig	DescribeActiveOperationMaintenanceConfig	get	All Resource ``	None	None
dds:DescribeTags	DescribeTags	get	All Resource ``	None	None
dds:UpgradeDBInstanceKernelVersion	UpgradeDBInstanceKernelVersion	update	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:ReleasePublicNetworkAddress	ReleasePublicNetworkAddress	update	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbInstanceId}`	None	None
dds:DescribeRoleZoneInfo	DescribeRoleZoneInfo	get	*dbinstance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:DeleteDBInstance	DeleteDBInstance	delete	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:CreateBackup	CreateBackup	create	*dbinstance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:RenewDBInstance	RenewDBInstance	update	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:AllocateNodePrivateNetworkAddress	AllocateNodePrivateNetworkAddress	update	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:ModifyNodeSpecBatch	ModifyNodeSpecBatch	update	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:RestartNode	RestartNode	update	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:MigrateToOtherZone	MigrateToOtherZone	update	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbInstanceId}`	None	None
dds:DescribeClusterBackups	DescribeClusterBackups	get	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbInstanceId}`	None	None
dds:ModifySecurityGroupConfiguration	ModifySecurityGroupConfiguration	update	*dbinstance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:ModifyAccountDescription	ModifyAccountDescription	update	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:DescribeSlowLogRecords	DescribeSlowLogRecords	get	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:ModifyGlobalSecurityIPGroupRelation	ModifyGlobalSecurityIPGroupRelation	update	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:CheckCloudResourceAuthorized	CheckCloudResourceAuthorized	get	*dbinstance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:CreateNodeBatch	CreateNodeBatch	create	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbInstanceId}`	None	None
dds:DescribeAccounts	DescribeAccounts	get	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:DescribeDBInstanceSwitchLog	DescribeDBInstanceSwitchLog	list	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbInstanceId}`	None	None
dds:DescribeSecurityIps	DescribeSecurityIps	get	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:RestartDBInstance	RestartDBInstance	update	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:ModifyDBInstanceDiskType	ModifyDBInstanceDiskType	update	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:ResetAccountPassword	ResetAccountPassword	update	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:CreateShardingDBInstance	CreateShardingDBInstance	create	Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/`	None	None
dds:ModifyResourceGroup	ModifyResourceGroup	update	*dbinstance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:ModifyDBInstanceSSL	ModifyDBInstanceSSL	update	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:DescribeAuditRecords	DescribeAuditRecords	get	*dbinstance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:DescribeKmsKeys	DescribeKmsKeys	get	All Resource ``	None	None
dds:TransformInstanceChargeType	TransformInstanceChargeType	update	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbInstanceId}`	None	None
dds:DescribeReplicaSetRole	DescribeReplicaSetRole	get	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:DescribeDBInstancesOverview	DescribeDBInstancesOverview	list	Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/`	None	None
dds:ModifyDBInstanceMaintainTime	ModifyDBInstanceMaintainTime	update	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:SwitchDBInstanceHA	SwitchDBInstanceHA	none	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:DescribeRenewalPrice	DescribeRenewalPrice	get	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:DescribeBackups	DescribeBackups	get	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:AllocatePublicNetworkAddress	AllocatePublicNetworkAddress	update	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:CreateNode	CreateNode	create	*dbinstance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:ListTagResources	ListTagResources	get	All Resource ``	None	None
dds:DescribePrice	DescribePrice	get	All Resource ``	None	None
dds:ModifySecurityIps	ModifySecurityIps	update	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:DescribeDBInstanceAttribute	DescribeDBInstanceAttribute	get	*dbinstance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:ModifySrvNetworkAddress	ModifySrvNetworkAddress	update	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:EvaluateResource	EvaluateResource	none	All Resource ``	None	None
dds:DescribeUserEncryptionKeyList	DescribeUserEncryptionKeyList	get	*dbinstance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:ModifyAuditLogFilter	ModifyAuditLogFilter	update	*dbinstance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:DescribeSecurityGroupConfiguration	DescribeSecurityGroupConfiguration	get	*dbinstance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:ModifyDBInstanceMonitor	ModifyDBInstanceMonitor	update	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:DescribeAvailableResource	DescribeAvailableResource	get	All Resource ``	None	None
dds:DescribeDBInstancePerformance	DescribeDBInstancePerformance	get	*dbinstance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	dds:ResourceTag	None
dds:DescribeAuditLogFilter	DescribeAuditLogFilter	get	*dbinstance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:ModifyTaskInfo	ModifyTaskInfo	update	All Resource ``	None	None
dds:AllocateDBInstanceSrvNetworkAddress	AllocateDBInstanceSrvNetworkAddress	update	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:DescribeBackupPolicy	DescribeBackupPolicy	get	*dbinstance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:DescribeErrorLogRecords	DescribeErrorLogRecords	get	*dbinstance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:DescribeRunningLogRecords	DescribeRunningLogRecords	get	*dbinstance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:TransformToPrePaid	TransformToPrePaid	update	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:ModifyGlobalSecurityIPGroup	ModifyGlobalSecurityIPGroup	update	All Resource ``	None	None
dds:DescribeGlobalSecurityIPGroup	DescribeGlobalSecurityIPGroup	list	All Resource ``	None	None
dds:DescribeBackupStorage	DescribeBackupStorage	get	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbInstanceId}`	None	None
dds:ModifyActiveOperationTasks	ModifyActiveOperationTasks	update	All Resource ``	None	None
dds:DescribeDBInstanceSpecInfo	DescribeDBInstanceSpecInfo	get	All Resource ``	None	None
dds:DeleteNode	DeleteNode	delete	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:ModifyInstanceAutoRenewalAttribute	ModifyInstanceAutoRenewalAttribute	update	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:CheckServiceLinkedRole	CheckServiceLinkedRole	get	All Resource ``	None	None
dds:ModifyDBInstanceNetworkType	ModifyDBInstanceNetworkType	update	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:CheckRecoveryCondition	CheckRecoveryCondition	get	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:DescribeClusterRecoverTime	DescribeClusterRecoverTime	get	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:DescribeHistoryTasksStat	DescribeHistoryTasksStat	list	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#InstanceId}`	None	None
dds:DescribeDBInstances	DescribeDBInstances	get	Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/` *Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:CreateDBInstance	CreateDBInstance	create	Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/`	None	None
dds:DescribeInstanceRecoverTime	DescribeInstanceRecoverTime	none	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbInstanceId}`	None	None
dds:DescribeGlobalSecurityIPGroupRelation	DescribeGlobalSecurityIPGroupRelation	get	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:DescribeParameters	DescribeParameters	get	*dbinstance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:ModifyInstanceVpcAuthMode	ModifyInstanceVpcAuthMode	update	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:ModifyDBInstanceConfig	ModifyDBInstanceConfig	update	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
dds:DescribeDBInstanceMonitor	DescribeDBInstanceMonitor	get	*Instance `acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None

Resource

The following table lists the resources defined by ApsaraDB for MongoDB. Specify them in the Resource element of RAM policy statements to grant permissions for specific operations. They are uniquely identified by ARNs. Format: acs:{#ramcode}:{#regionId}:{#accountId}:{#resourceType}:

acs: The initialism of Alibaba Cloud service, which indicates the public cloud of Alibaba Cloud.
{#ramcode}: The code used in RAM to indicate an Alibaba Cloud service.
{#regionId}: The region ID. If the resource covers all regions, set it to an asterisk (*).
{#accountId}: The ID of the Alibaba Cloud account. If the resource covers all Alibaba Cloud accounts, set it to an asterisk (*).
{#resourceType}: The service-defined resource identifier. It supports a hierarchical structure, which is similar to a file path. If the statement covers global resources, set it to an asterisk (*).

Resource type	ARN
dbinstance	acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId} acs:dds:{#regionId}:{#accountId}:dbinstance/*
Instance	acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId} acs:dds:{#regionId}:{#accountId}:dbinstance/* acs:dds:{#regionId}:{#accountId}:dbinstance/{#InstanceId} acs:dds:{#regionId}:{#accountId}:instance/* acs:dds:{#regionId}:{#accountId}:instance/{#InstanceId}
DBInstance	acs:dds:{#regionId}:{#accountId}:dbinstance/{#dbInstanceId} acs:dds:{#regionId}:{#accountId}:dbinstance/*

Condition

The following table lists the product-level condition keys defined by ApsaraDB for MongoDB. You can also use Alibaba Cloud's Common condition keys. Specify these keys in the Condition element of RAM policy statements to define granular authorization rules. In the condition key, specify the condition values in the Condition_value element of the policy.

Each condition key has a specific data type, such as string, number, Boolean, or IP address. The data type determines which conditional operators can be used to compare the request values against policy values. You must specify the conditional operators compatible with the data type of the condition key. Mismatched operators will invalidate the policy. See Condition operator for valid combinations.

Condition key	Description	Data type
acs:ResourceTag	Tag authentication	STRING

How to create custom RAM policies?

You can create custom policies and grant them to RAM users, RAM user groups, or RAM roles. For instructions, see: