すべてのプロダクト
Search

このプロダクト

    Resource Management:RAM 認可

    ドキュメントセンター

    Resource Management:RAM 認可

    最終更新日:Sep 09, 2026

    RAM ユーザーを使用して Resource Management の API を呼び出し、Alibaba Cloud アカウントに属するリソースにアクセスするには、Alibaba Cloud アカウントを使用して、必要なポリシーを作成し、そのポリシーを RAM ユーザーにアタッチする必要があります。ポリシーでは、Action 要素で認可する API 操作を、Resource 要素で認可するリソースを指定できます。各リソースは Alibaba Cloud リソース名 (ARN) で示されます。

    ポリシーの Resource 要素で使用される変数を次に示します。変数を実際の値に置き換えてください。

    • <account_id>：Alibaba Cloud アカウントの ID。

    • <resourcegroup_id>：リソースグループの ID。

    • <policy_name>：ポリシーの名前。

    • <role_name>：RAM ロールの名前。

    • <resource_type>：リソースタイプ。

    • <resource_id>：リソースの ID。

    • <region_id>：リージョン ID。

    • <product>：クラウドサービスのプロダクトコード。

    • <handshake_id>：招待の ID。

    • <policy_id>：アクセス制御ポリシーの ID。

    • <resource_directory_path>：フォルダーまたはメンバーの RDPath。Resource Directory 内でのフォルダーまたはメンバーの場所を表します。

    • <contact_id>：連絡先の ID。

    必須のリソースタイプは太字で表示されます。

    リソースグループの認可リスト

    次の表に、Action 要素で指定できるリソースグループの API と、Resource 要素で使用される ARN 形式を示します。

    アクション

    リソース

    ram:CreateResourceGroup

    acs:ram:*:<account_id>:resourcegroup/*

    ram:DeleteResourceGroup

    acs:ram:*:<account_id>:resourcegroup/<resourcegroup_id>

    ram:UpdateResourceGroup

    acs:ram:*:<account_id>:resourcegroup/<resourcegroup_id>

    ram:CreatePolicy

    acs:ram:*:<account_id>:policy/*

    ram:DeletePolicy

    acs:ram:*:<account_id>:policy/<policy_name>

    ram:ListPolicies

    acs:ram:*:<account_id>:policy/*

    ram:GetPolicy

    acs:ram:*:<account_id>:policy/<policy_name>

    ram:CreatePolicyVersion

    acs:ram:*:<account_id>:policy/<policy_name>

    ram:DeletePolicyVersion

    acs:ram:*:<account_id>:policy/<policy_name>

    ram:ListPolicyVersions

    acs:ram:*:<account_id>:policy/<policy_name>

    ram:GetPolicyVersion

    acs:ram:*:<account_id>:policy/<policy_name>

    ram:SetDefaultPolicyVersion

    acs:ram:*:<account_id>:policy/<policy_name>

    ram:AttachPolicy

    • ポリシー：

      acs:ram:*:system:policy/<policy_name> or acs:ram:*:<account_id>:policy/<policy_name>

    • RAM ユーザー：

      acs:ims:*:<account_id>:user/*

    • IMS グループ：

      acs:ims:*:<account_id>:group/*

    • RAM ロール：

      acs:ram:*:<account_id>:role/*

    ram:DetachPolicy

    • ポリシー：

      acs:ram:*:system:policy/<policy_name> or acs:ram:*:<account_id>:policy/<policy_name>

    • RAM ユーザー：

      acs:ims:*:<account_id>:user/*

    • IMS グループ：

      acs:ims:*:<account_id>:group/*

    • RAM ロール：

      acs:ram:*:<account_id>:role/*

    ram:ListPolicyAttachments

    acs:ram:*:<account_id>:*

    ram:CreateRole

    acs:ram:*:<account_id>:role/*

    ram:GetRole

    acs:ram:*:<account_id>:role/<role_name>

    ram:ListRoles

    acs:ram:*:<account_id>:role/*

    ram:UpdateRole

    acs:ram:*:<account_id>:role/<role_name>

    ram:DeleteRole

    acs:ram:*:<account_id>:role/<role_name>

    ram:CreateServiceLinkedRole

    acs:ram:*:<account_id>:role/*

    ram:DeleteServiceLinkedRole

    acs:ram:*:<account_id>:role/<role_name>

    ram:GetServiceLinkedRoleDeletionStatus

    acs:ram:*:<account_id>:role/<role_name>

    Resource Directory の認可リスト

    次の表に、Action 要素で指定できる Resource Directory の API と、Resource 要素で使用される ARN 形式を示します。

    アクション

    リソース

    resourcemanager:AcceptHandshake

    acs:resourcemanager:*:<account_id>:handshake/<handshake_id>

    resourcemanager:AttachControlPolicy

    • コントロールポリシー：

      acs:resourcemanager:*:<account_id>:policy/controlpolicy/<policy_id>

    • アカウント：

      acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    • フォルダー：

      acs:resourcemanager:*:<account_id>:folder/<resource_directory_path>

    resourcemanager:BindSecureMobilePhone

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    resourcemanager:CancelHandshake

    acs:resourcemanager:*:<account_id>:handshake/<handshake_id>

    resourcemanager:CheckAccountDelete

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    resourcemanager:CreateCloudAccount

    acs:resourcemanager:*:<account_id>:*

    resourcemanager:CreateControlPolicy

    acs:resourcemanager:*:<account_id>:policy/controlpolicy/*

    resourcemanager:CreateFolder

    acs:resourcemanager:*:<account_id>:folder/<resource_directory_path>

    resourcemanager:CreateResourceAccount

    acs:resourcemanager:*:<account_id>:folder/<resource_directory_path>

    resourcemanager:DeclineHandshake

    acs:resourcemanager:*:<account_id>:handshake/<handshake_id>

    resourcemanager:DeleteAccount

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    resourcemanager:DeleteControlPolicy

    acs:resourcemanager:*:<account_id>:policy/controlpolicy/<policy_id>

    resourcemanager:DeleteFolder

    acs:resourcemanager:*:<account_id>:folder/<resource_directory_path>

    resourcemanager:DeregisterDelegatedAdministrator

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    resourcemanager:DestroyResourceDirectory

    acs:resourcemanager:*:<account_id>:*

    resourcemanager:DetachControlPolicy

    • コントロールポリシー：

      acs:resourcemanager:*:<account_id>:policy/controlpolicy/<policy_id>

    • アカウント：

      acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    • フォルダー：

      acs:resourcemanager:*:<account_id>:folder/<resource_directory_path>

    resourcemanager:DisableControlPolicy

    acs:resourcemanager:*:<account_id>:policy/controlpolicy/*

    resourcemanager:EnableControlPolicy

    acs:resourcemanager:*:<account_id>:policy/controlpolicy/*

    resourcemanager:EnableResourceDirectory

    acs:resourcemanager:*:<account_id>:*

    resourcemanager:GetAccount

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    resourcemanager:GetAccountDeletionCheckResult

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    resourcemanager:GetAccountDeletionStatus

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    resourcemanager:GetControlPolicy

    acs:resourcemanager:*:<account_id>:policy/controlpolicy/<policy_id>

    resourcemanager:GetControlPolicyEnablementStatus

    acs:resourcemanager:*:<account_id>:policy/controlpolicy/*

    resourcemanager:GetFolder

    acs:resourcemanager:*:<account_id>:folder/<resource_directory_path>

    resourcemanager:GetHandshake

    acs:resourcemanager:*:<account_id>:handshake/<handshake_id>

    resourcemanager:GetPayerForAccount

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    resourcemanager:GetResourceDirectory

    acs:resourcemanager:*:<account_id>:*

    resourcemanager:InviteAccountToResourceDirectory

    • ハンドシェイク：

      acs:resourcemanager:*:<account_id>:handshake/*

    • フォルダー：

      acs:resourcemanager:*:<account_id>:folder/<resource_directory_path>

    resourcemanager:ListAccounts

    acs:resourcemanager:*:<account_id>:account/*

    resourcemanager:ListAccountsForParent

    acs:resourcemanager:*:<account_id>:folder/<resource_directory_path>

    resourcemanager:ListAncestors

    acs:resourcemanager:*:<account_id>:folder/*

    resourcemanager:ListControlPolicies

    acs:resourcemanager:*:<account_id>:policy/controlpolicy/*

    resourcemanager:ListControlPolicyAttachmentsForTarget

    • コントロールポリシー：

      acs:resourcemanager:*:<account_id>:policy/controlpolicy/<policy_id>

    • アカウント：

      acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    • フォルダー：

      acs:resourcemanager:*:<account_id>:folder/<resource_directory_path>

    resourcemanager:ListDelegatedAdministrators

    acs:resourcemanager:*:<account_id>:account/*

    resourcemanager:ListDelegatedServicesForAccount

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    resourcemanager:ListFoldersForParent

    acs:resourcemanager:*:<account_id>:folder/<resource_directory_path>

    resourcemanager:ListHandshakesForAccount

    acs:resourcemanager:*:<account_id>:handshake/*

    resourcemanager:ListHandshakesForResourceDirectory

    acs:resourcemanager:*:<account_id>:handshake/*

    resourcemanager:ListTagKeys

    acs:resourcemanager:*:<account_id>:*

    resourcemanager:ListTagResources

    acs:resourcemanager:*:<account_id>:*

    resourcemanager:ListTagValues

    acs:resourcemanager:*:<account_id>:*

    resourcemanager:ListTargetAttachmentsForControlPolicy

    acs:resourcemanager:*:<account_id>:policy/controlpolicy/<policy_id>

    resourcemanager:ListTrustedServiceStatus

    acs:resourcemanager:*:<account_id>:*

    resourcemanager:MoveAccount

    • アカウント：

      acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    • フォルダー：

      acs:resourcemanager:*:<account_id>:folder/<resource_directory_path>

    resourcemanager:PromoteResourceAccount

    acs:resourcemanager:*:<account_id>:*

    resourcemanager:RegisterDelegatedAdministrator

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    resourcemanager:RemoveCloudAccount

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    resourcemanager:SendVerificationCodeForBindSecureMobilePhone

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    resourcemanager:SendVerificationCodeForEnableRD

    acs:resourcemanager:*:<account_id>:*

    resourcemanager:TagResources

    acs:resourcemanager:*:<account_id>:*

    resourcemanager:UntagResources

    acs:resourcemanager:*:<account_id>:*

    resourcemanager:UpdateAccount

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    resourcemanager:UpdateControlPolicy

    acs:resourcemanager:*:<account_id>:policy/controlpolicy/<policy_id>

    resourcemanager:UpdateFolder

    acs:resourcemanager:*:<account_id>:folder/<resource_directory_path>

    resourcemanager:AddMessageContact

    acs:resourcemanager:*:<account_id>:messagecontact/*

    resourcemanager:CancelMessageContactUpdate

    acs:resourcemanager:*:<account_id>:messagecontact/<contact_id>

    resourcemanager:DeleteMessageContact

    acs:resourcemanager:*:<account_id>:messagecontact/<contact_id>

    resourcemanager:GetMessageContact

    acs:resourcemanager:*:<account_id>:messagecontact/<contact_id>

    resourcemanager:GetMessageContactDeletionStatus

    acs:resourcemanager:*:<account_id>:messagecontact/<contact_id>

    resourcemanager:ListMessageContacts

    acs:resourcemanager:*:<account_id>:messagecontact/*

    resourcemanager:ListMessageContactVerifications

    acs:resourcemanager:*:<account_id>:messagecontact/<contact_id>

    resourcemanager:SendEmailVerificationForMessageContact

    acs:resourcemanager:*:<account_id>:messagecontact/<contact_id>

    resourcemanager:SendPhoneVerificationForMessageContact

    acs:resourcemanager:*:<account_id>:messagecontact/<contact_id>

    resourcemanager:UpdateMessageContact

    acs:resourcemanager:*:<account_id>:messagecontact/<contact_id>

    resourcemanager:AssociateMembers

    • フォルダー：

      acs:resourcemanager:*:<account_id>:folder/<resource_directory_path>

    • アカウント：

      acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    • メッセージ連絡先：

      acs:resourcemanager:*:<account_id>:messagecontact/<contact_id>

    resourcemanager:DisassociateMembers

    • フォルダー：

      acs:resourcemanager:*:<account_id>:folder/<resource_directory_path>

    • アカウント：

      acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    • メッセージ連絡先：

      acs:resourcemanager:*:<account_id>:messagecontact/<contact_id>

    resourcemanager:CancelChangeAccountEmail

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    resourcemanager:ChangeAccountEmail

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    resourcemanager:RetryChangeAccountEmail

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    resourcemanager:PrecheckForConsolidatedBillingAccount

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    リソース共有の認可リスト

    次の表に、Action 要素で指定できるリソース共有の API と、Resource 要素で使用される ARN 形式を示します。

    アクション

    リソース

    resourcesharing:EnableSharingWithResourceDirectory

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:CreateResourceShare

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:UpdateResourceShare

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:DeleteResourceShare

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:ListResourceShares

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:AssociateResourceShare

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:DisassociateResourceShare

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:ListResourceShareAssociations

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:ListSharedResources

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:ListSharedTargets

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:DescribeRegions

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:ListResourceShareInvitations

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:AcceptResourceShareInvitation

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:RejectResourceShareInvitation

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:AssociateResourceSharePermission

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:DisassociateResourceSharePermission

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:ListResourceSharePermissions

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:GetPermission

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:ListPermissionVersions

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:ListPermissions

    acs:resourcesharing:<region_id>:<account_id>:*

    タグベースの認可リスト

    次の表に、Action 要素で指定できるタグの API と、Resource 要素で使用される ARN 形式を示します。

    アクション

    リソース

    tag:ListTagResources

    acs:tag:<region_id>:<account_id>:<resource_type>/<resource_id>

    tag:TagResources

    • acs:tag:<region_id>:<account_id>:<resource_type>/<resource_id>

    • acs:<product>:<region_id>:<account_id>:<resource_type>/<resource_id>

    tag:UntagResources

    • acs:tag:<region_id>:<account_id>:<resource_type>/<resource_id>

    • acs:<product>:<region_id>:<account_id>:<resource_type>/<resource_id>

    tag:ListTagKeys

    acs:tag:<region_id>:<account_id>:*/*

    tag:ListTagValues

    acs:tag:<region_id>:<account_id>:*/*

    tag:CreateTags

    acs:tag:<region_id>:<account_id>:*/*

    tag:DeleteTag

    acs:tag:<region_id>:<account_id>:*/*