Todos os produtos
Search

Este produto

    Resource Management:Autorização do RAM

    Central de documentação

    Resource Management:Autorização do RAM

    Última atualização: Jun 27, 2026

    Antes de usar um usuário do RAM para chamar as operações de API do Resource Management e acessar recursos pertencentes a uma conta Alibaba Cloud, utilize essa conta Alibaba Cloud para criar e anexar a política adequada ao usuário do RAM. Na política, especifique as operações de API autorizadas no elemento Action e os recursos autorizados no elemento Resource. Cada recurso é identificado pelo seu Alibaba Cloud Resource Name (ARN).

    A lista a seguir descreve as variáveis utilizadas no elemento Resource de uma política. Substitua essas variáveis pelos valores reais.

    • <account_id>: o ID de uma conta Alibaba Cloud.

    • <resourcegroup_id>: o ID de um grupo de recursos.

    • <policy_name>: o nome de uma política.

    • <role_name>: o nome de uma função do RAM.

    • <resource_type>: o tipo de um recurso.

    • <resource_id>: o ID de um recurso.

    • <region_id>: o ID da região.

    • <product>: o código de um serviço.

    • <handshake_id>: o ID de um convite.

    • <policy_id>: o ID de uma política de controle de acesso.

    • <resource_directory_path>: o RDPath de uma pasta ou membro, indicando a localização em um diretório de recursos.

    • <contact_id>: o ID de um contato.

    Os tipos de recurso obrigatórios são exibidos em negrito.

    Grupo de Recursos

    A tabela a seguir lista as operações de API do Grupo de Recursos que você pode especificar no elemento Action e os formatos de ARN utilizados no elemento Resource.

    Action

    Resource

    ram:CreateResourceGroup

    acs:ram::<account_id>:resourcegroup/

    ram:DeleteResourceGroup

    acs:ram:*:<account_id>:resourcegroup/<resourcegroup_id>

    ram:UpdateResourceGroup

    acs:ram:*:<account_id>:resourcegroup/<resourcegroup_id>

    ram:CreatePolicy

    acs:ram::<account_id>:policy/

    ram:DeletePolicy

    acs:ram:*:<account_id>:policy/<policy_name>

    ram:ListPolicies

    acs:ram::<account_id>:policy/

    ram:GetPolicy

    acs:ram:*:<account_id>:policy/<policy_name>

    ram:CreatePolicyVersion

    acs:ram:*:<account_id>:policy/<policy_name>

    ram:DeletePolicyVersion

    acs:ram:*:<account_id>:policy/<policy_name>

    ram:ListPolicyVersions

    acs:ram:*:<account_id>:policy/<policy_name>

    ram:GetPolicyVersion

    acs:ram:*:<account_id>:policy/<policy_name>

    ram:SetDefaultPolicyVersion

    acs:ram:*:<account_id>:policy/<policy_name>

    ram:AttachPolicy

    • Política:

      acs:ram::system:policy/<policy_name> ou acs:ram::<account_id>:policy/<policy_name>

    • Usuário do RAM:

      acs:ims::<account_id>:user/

    • Grupo de usuários do RAM:

      acs:ims::<account_id>:group/

    • Função do RAM:

      acs:ram::<account_id>:role/

    ram:DetachPolicy

    • Política:

      acs:ram::system:policy/<policy_name> ou acs:ram::<account_id>:policy/<policy_name>

    • Usuário do RAM:

      acs:ims::<account_id>:user/

    • Grupo de usuários do RAM:

      acs:ims::<account_id>:group/

    • Função do RAM:

      acs:ram::<account_id>:role/

    ram:ListPolicyAttachments

    acs:ram::<account_id>:

    ram:CreateRole

    acs:ram::<account_id>:role/

    ram:GetRole

    acs:ram:*:<account_id>:role/<role_name>

    ram:ListRoles

    acs:ram::<account_id>:role/

    ram:UpdateRole

    acs:ram:*:<account_id>:role/<role_name>

    ram:DeleteRole

    acs:ram:*:<account_id>:role/<role_name>

    ram:CreateServiceLinkedRole

    acs:ram::<account_id>:role/

    ram:DeleteServiceLinkedRole

    acs:ram:*:<account_id>:role/<role_name>

    ram:GetServiceLinkedRoleDeletionStatus

    acs:ram:*:<account_id>:role/<role_name>

    Diretório de Recursos

    A tabela a seguir lista as operações de API do Diretório de Recursos que você pode especificar no elemento Action e os formatos de ARN utilizados no elemento Resource.

    Action

    Resource

    resourcemanager:AcceptHandshake

    acs:resourcemanager:*:<account_id>:handshake/<handshake_id>

    resourcemanager:AttachControlPolicy

    • Política de controle de acesso:

      acs:resourcemanager:*:<account_id>:policy/controlpolicy/<policy_id>

    • Membro:

      acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    • Pasta:

      acs:resourcemanager:*:<account_id>:folder/<resource_directory_path>

    resourcemanager:BindSecureMobilePhone

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    resourcemanager:CancelHandshake

    acs:resourcemanager:*:<account_id>:handshake/<handshake_id>

    resourcemanager:CheckAccountDelete

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    resourcemanager:CreateCloudAccount

    acs:resourcemanager::<account_id>:

    resourcemanager:CreateControlPolicy

    acs:resourcemanager::<account_id>:policy/controlpolicy/

    resourcemanager:CreateFolder

    acs:resourcemanager:*:<account_id>:folder/<resource_directory_path>

    resourcemanager:CreateResourceAccount

    acs:resourcemanager:*:<account_id>:folder/<resource_directory_path>

    resourcemanager:DeclineHandshake

    acs:resourcemanager:*:<account_id>:handshake/<handshake_id>

    resourcemanager:DeleteAccount

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    resourcemanager:DeleteControlPolicy

    acs:resourcemanager:*:<account_id>:policy/controlpolicy/<policy_id>

    resourcemanager:DeleteFolder

    acs:resourcemanager:*:<account_id>:folder/<resource_directory_path>

    resourcemanager:DeregisterDelegatedAdministrator

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    resourcemanager:DestroyResourceDirectory

    acs:resourcemanager::<account_id>:

    resourcemanager:DetachControlPolicy

    • Política de controle de acesso:

      acs:resourcemanager:*:<account_id>:policy/controlpolicy/<policy_id>

    • Membro:

      acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    • Pasta:

      acs:resourcemanager:*:<account_id>:folder/<resource_directory_path>

    resourcemanager:DisableControlPolicy

    acs:resourcemanager::<account_id>:policy/controlpolicy/

    resourcemanager:EnableControlPolicy

    acs:resourcemanager::<account_id>:policy/controlpolicy/

    resourcemanager:EnableResourceDirectory

    acs:resourcemanager::<account_id>:

    resourcemanager:GetAccount

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    resourcemanager:GetAccountDeletionCheckResult

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    resourcemanager:GetAccountDeletionStatus

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    resourcemanager:GetControlPolicy

    acs:resourcemanager:*:<account_id>:policy/controlpolicy/<policy_id>

    resourcemanager:GetControlPolicyEnablementStatus

    acs:resourcemanager::<account_id>:policy/controlpolicy/

    resourcemanager:GetFolder

    acs:resourcemanager:*:<account_id>:folder/<resource_directory_path>

    resourcemanager:GetHandshake

    acs:resourcemanager:*:<account_id>:handshake/<handshake_id>

    resourcemanager:GetPayerForAccount

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    resourcemanager:GetResourceDirectory

    acs:resourcemanager::<account_id>:

    resourcemanager:InviteAccountToResourceDirectory

    • Convite:

      acs:resourcemanager::<account_id>:handshake/

    • Pasta:

      acs:resourcemanager:*:<account_id>:folder/<resource_directory_path>

    resourcemanager:ListAccounts

    acs:resourcemanager::<account_id>:account/

    resourcemanager:ListAccountsForParent

    acs:resourcemanager:*:<account_id>:folder/<resource_directory_path>

    resourcemanager:ListAncestors

    acs:resourcemanager::<account_id>:folder/

    resourcemanager:ListControlPolicies

    acs:resourcemanager::<account_id>:policy/controlpolicy/

    resourcemanager:ListControlPolicyAttachmentsForTarget

    • Política de controle de acesso:

      acs:resourcemanager:*:<account_id>:policy/controlpolicy/<policy_id>

    • Membro:

      acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    • Pasta:

      acs:resourcemanager:*:<account_id>:folder/<resource_directory_path>

    resourcemanager:ListDelegatedAdministrators

    acs:resourcemanager::<account_id>:account/

    resourcemanager:ListDelegatedServicesForAccount

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    resourcemanager:ListFoldersForParent

    acs:resourcemanager:*:<account_id>:folder/<resource_directory_path>

    resourcemanager:ListHandshakesForAccount

    acs:resourcemanager::<account_id>:handshake/

    resourcemanager:ListHandshakesForResourceDirectory

    acs:resourcemanager::<account_id>:handshake/

    resourcemanager:ListTagKeys

    acs:resourcemanager::<account_id>:

    resourcemanager:ListTagResources

    acs:resourcemanager::<account_id>:

    resourcemanager:ListTagValues

    acs:resourcemanager::<account_id>:

    resourcemanager:ListTargetAttachmentsForControlPolicy

    acs:resourcemanager:*:<account_id>:policy/controlpolicy/<policy_id>

    resourcemanager:ListTrustedServiceStatus

    acs:resourcemanager::<account_id>:

    resourcemanager:MoveAccount

    • Membro:

      acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    • Pasta:

      acs:resourcemanager:*:<account_id>:folder/<resource_directory_path>

    resourcemanager:PromoteResourceAccount

    acs:resourcemanager::<account_id>:

    resourcemanager:RegisterDelegatedAdministrator

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    resourcemanager:RemoveCloudAccount

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    resourcemanager:SendVerificationCodeForBindSecureMobilePhone

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    resourcemanager:SendVerificationCodeForEnableRD

    acs:resourcemanager::<account_id>:

    resourcemanager:TagResources

    acs:resourcemanager::<account_id>:

    resourcemanager:UntagResources

    acs:resourcemanager::<account_id>:

    resourcemanager:UpdateAccount

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    resourcemanager:UpdateControlPolicy

    acs:resourcemanager:*:<account_id>:policy/controlpolicy/<policy_id>

    resourcemanager:UpdateFolder

    acs:resourcemanager:*:<account_id>:folder/<resource_directory_path>

    resourcemanager:AddMessageContact

    acs:resourcemanager::<account_id>:messagecontact/

    resourcemanager:CancelMessageContactUpdate

    acs:resourcemanager:*:<account_id>:messagecontact/<contact_id>

    resourcemanager:DeleteMessageContact

    acs:resourcemanager:*:<account_id>:messagecontact/<contact_id>

    resourcemanager:GetMessageContact

    acs:resourcemanager:*:<account_id>:messagecontact/<contact_id>

    resourcemanager:GetMessageContactDeletionStatus

    acs:resourcemanager:*:<account_id>:messagecontact/<contact_id>

    resourcemanager:ListMessageContacts

    acs:resourcemanager::<account_id>:messagecontact/

    resourcemanager:ListMessageContactVerifications

    acs:resourcemanager:*:<account_id>:messagecontact/<contact_id>

    resourcemanager:SendEmailVerificationForMessageContact

    acs:resourcemanager:*:<account_id>:messagecontact/<contact_id>

    resourcemanager:SendPhoneVerificationForMessageContact

    acs:resourcemanager:*:<account_id>:messagecontact/<contact_id>

    resourcemanager:UpdateMessageContact

    acs:resourcemanager:*:<account_id>:messagecontact/<contact_id>

    resourcemanager:AssociateMembers

    • Pasta:

      acs:resourcemanager:*:<account_id>:folder/<resource_directory_path>

    • Membro:

      acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    • Contato:

      acs:resourcemanager:*:<account_id>:messagecontact/<contact_id>

    resourcemanager:DisassociateMembers

    • Pasta:

      acs:resourcemanager:*:<account_id>:folder/<resource_directory_path>

    • Membro:

      acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    • Contato:

      acs:resourcemanager:*:<account_id>:messagecontact/<contact_id>

    resourcemanager:CancelChangeAccountEmail

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    resourcemanager:ChangeAccountEmail

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    resourcemanager:RetryChangeAccountEmail

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    resourcemanager:PrecheckForConsolidatedBillingAccount

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    Compartilhamento de Recursos

    A tabela a seguir lista as operações de API do Compartilhamento de Recursos que você pode especificar no elemento Action e os formatos de ARN utilizados no elemento Resource.

    Action

    Resource

    resourcesharing:EnableSharingWithResourceDirectory

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:CreateResourceShare

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:UpdateResourceShare

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:DeleteResourceShare

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:ListResourceShares

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:AssociateResourceShare

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:DisassociateResourceShare

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:ListResourceShareAssociations

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:ListSharedResources

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:ListSharedTargets

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:DescribeRegions

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:ListResourceShareInvitations

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:AcceptResourceShareInvitation

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:RejectResourceShareInvitation

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:AssociateResourceSharePermission

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:DisassociateResourceSharePermission

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:ListResourceSharePermissions

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:GetPermission

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:ListPermissionVersions

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:ListPermissions

    acs:resourcesharing:<region_id>:<account_id>:*

    Tag

    A tabela a seguir lista as operações de API de Tag que você pode especificar no elemento Action e os formatos de ARN utilizados no elemento Resource.

    Action

    Resource

    tag:ListTagResources

    acs:tag:<region_id>:<account_id>:<resource_type>/<resource_id>

    tag:TagResources

    • acs:tag:<region_id>:<account_id>:<resource_type>/<resource_id>

    • acs:<product>:<region_id>:<account_id>:<resource_type>/<resource_id>

    tag:UntagResources

    • acs:tag:<region_id>:<account_id>:<resource_type>/<resource_id>

    • acs:<product>:<region_id>:<account_id>:<resource_type>/<resource_id>

    tag:ListTagKeys

    acs:tag:<region_id>:<account_id>:/

    tag:ListTagValues

    acs:tag:<region_id>:<account_id>:/

    tag:CreateTags

    acs:tag:<region_id>:<account_id>:/

    tag:DeleteTag

    acs:tag:<region_id>:<account_id>:/