Todos os produtos
Search

Este produto

    Web Application Firewall:Autorização RAM

    Central de documentação

    Web Application Firewall:Autorização RAM

    Última atualização: Sep 24, 2026

    O Resource Access Management (RAM) é um serviço fornecido pela Alibaba Cloud para gerenciar identidades de usuários e permissões de acesso a recursos. O uso do RAM ajuda a evitar o compartilhamento das chaves da sua conta da Alibaba Cloud com outros usuários e permite conceder aos usuários o acesso com privilégio mínimo. O RAM usa políticas de permissão para definir autorizações. Este tópico descreve a estrutura geral de uma política RAM e os elementos de instrução de política (Action, Resource e Condition) definidos por Web Application Firewall para políticas de permissão RAM. O código RAM (RamCode) para Web Application Firewall é yundun-waf , e a granularidade de autorização suportada é RESOURCE .

    Estrutura geral de uma política

    As políticas de permissão suportam o formato JSON com a seguinte estrutura geral:

    {
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

    A lista a seguir descreve os campos da política:

    • Version: Especifica o número da versão da política. É fixo em 1.

    • Statement:

      • Effect: Especifica o resultado da autorização. Valores válidos: Allow e Deny.

      • Action: Especifica uma ou mais operações que são permitidas ou negadas.

      • Resource: Especifica os objetos específicos afetados pelas operações. Você pode usar os Alibaba Cloud Resource Names (ARNs) para descrever recursos específicos.

      • Condition: Especifica as condições para que a autorização entre em vigor. Este campo é opcional.

        • Operador de condição: Especifica os operadores condicionais. Diferentes tipos de condições suportam diferentes operadores condicionais.

        • Condition_key: Especifica as chaves de condição.

        • Condition_value: Especifica os valores de condição.

    Action

    A tabela a seguir lista as ações definidas por Web Application Firewall. As colunas da tabela são descritas a seguir:

    • Action: As ações podem ser usadas no elemento Action das instruções de política de permissão RAM para conceder permissões para realizar a operação.

    • API: A API que você pode chamar para realizar a ação.

    • Nível de acesso: O nível de acesso predefinido concedido para cada API. Valores válidos: create, list, get, update e delete.

    • Tipo de recurso: O tipo de recurso que suporta autorização para realizar a ação. Indica se a ação suporta permissão em nível de recurso. O recurso especificado deve ser compatível com a ação. Caso contrário, a política será ineficaz.

      • Para APIs com permissões em nível de recurso, os tipos de recursos obrigatórios são marcados com um asterisco (*). Especifique o ARN correspondente no elemento Resource da política.

      • Para APIs sem permissões em nível de recurso, é exibido como Todos os Recursos. Use um asterisco (*) no elemento Resource da política.

    • Chave de condição: As chaves de condição definidas pelo serviço. A chave permite controle granular, aplicando-se apenas a ações ou a ações associadas a recursos específicos. Além das chaves de condição específicas do serviço, a Alibaba Cloud fornece um conjunto de chaves de condição comuns aplicáveis a todos os serviços integrados ao RAM. Para mais informações, consulte Chaves de condição comuns.

    • Ação dependente: As ações dependentes necessárias para executar a ação. Para concluir a ação, o usuário RAM ou a função RAM deve ter permissões para realizar todas as ações dependentes.

    Action

    API

    Nível de acesso

    Tipo de recurso

    Chave de condição

    Ação dependente
    yundun-waf:DescribeIpAbroadCountryInfos DescribeIpAbroadCountryInfos list

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeCloudResourceAccessedPorts DescribeCloudResourceAccessedPorts get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:ModifyCloudResourceDefaultCert ModifyCloudResourceDefaultCert update

    *All Resource

    *

    		 Nenhum Nenhum
    yundun-waf:DescribeCommonLogFields DescribeCommonLogFields list

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:ModifyApisecLogDeliveryStatus ModifyApisecLogDeliveryStatus update

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeNetworkFlowTopNMetric DescribeNetworkFlowTopNMetric get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeElasticBills DescribeElasticBills get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DeleteDefenseResourceGroup DeleteDefenseResourceGroup delete

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeDomainUsedPorts DescribeDomainUsedPorts get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeResourceLogDeliveryStatus DescribeResourceLogDeliveryStatus list

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeRuleHitsTopClientIp DescribeRuleHitsTopClientIp get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:ModifyDomainPunishStatus ModifyDomainPunishStatus update

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeDefenseResourceNames DescribeDefenseResourceNames list

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DeleteHybridCloudGroup DeleteHybridCloudGroup delete

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:ReCreateCloudResource ReCreateCloudResource none

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeResourceRegionId DescribeResourceRegionId list

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:ModifyLogDeliveryConfig ModifyLogDeliveryConfig create

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeFlowTopResource DescribeFlowTopResource get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeDefenseRule DescribeDefenseRule get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DeleteMemberAccount DeleteMemberAccount delete

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:ClearMajorProtectionBlackIp ClearMajorProtectionBlackIp delete

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeRoleAuthStatus DescribeRoleAuthStatus get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:ModifyApisecModuleStatus ModifyApisecModuleStatus update

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeThreatEventTopMetric DescribeThreatEventTopMetric get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeHybridCloudUnsupportPorts DescribeHybridCloudUnsupportPorts list

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeHybridCloudClusterServers DescribeHybridCloudClusterServers get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeApiExports DescribeApiExports get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:CreateLogDeliveryConfig CreateLogDeliveryConfig create

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DeleteDomain DeleteDomain delete

    DefenseResource

    acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/{#Resource}

    DefenseResource

    acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/{#Domain}-waf

    		 Nenhum Nenhum
    yundun-waf:DescribeHybridCloudClusterRules DescribeHybridCloudClusterRules get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeApisecAbnormals DescribeApisecAbnormals get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:ReleaseInstance ReleaseInstance delete

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeRuleHitsTopUa DescribeRuleHitsTopUa get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeCerts DescribeCerts get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeVisitTopIp DescribeVisitTopIp get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeApisecEventDetail DescribeApisecEventDetail get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeCloudResourceAccessPortDetails DescribeCloudResourceAccessPortDetails get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeApisecProtectionGroups DescribeApisecProtectionGroups list

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeCustomBaseRuleCompileResult DescribeCustomBaseRuleCompileResult get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:CreatePostpaidInstance CreatePostpaidInstance create

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:ModifyHybridCloudGroupExpansionServer ModifyHybridCloudGroupExpansionServer update

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeHybridCloudUnassignedMachines DescribeHybridCloudUnassignedMachines get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeApisecMatchedHosts DescribeApisecMatchedHosts get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeApisecExamples DescribeApisecExamples list

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeThreatEvent DescribeThreatEvent list

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:ModifyDefenseTemplateStatus ModifyDefenseTemplateStatus update

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:ModifyHybridCloudCluster ModifyHybridCloudCluster update

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeSecurityEventTopNMetric DescribeSecurityEventTopNMetric get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeDefenseTemplateValidResources DescribeDefenseTemplateValidResources list

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeDefenseResourceOwnerUid DescribeDefenseResourceOwnerUid list

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:ModifyDefenseRule ModifyDefenseRule update

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeUserAbnormalType DescribeUserAbnormalType get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeApisecAssetTrend DescribeApisecAssetTrend get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeHybridCloudGroups DescribeHybridCloudGroups list

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeUserEventTrend DescribeUserEventTrend get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeDefenseGroupValidResources DescribeDefenseGroupValidResources list

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeUserTraffic DescribeUserTraffic get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:ModifyHybridCloudClusterBypassStatus ModifyHybridCloudClusterBypassStatus update

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:CreatePocFunction CreatePocFunction create

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeUserLogFieldConfig DescribeUserLogFieldConfig get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeApisecEvents DescribeApisecEvents get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:ModifyApisecStatus ModifyApisecStatus update

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:CreateDefenseTemplate CreateDefenseTemplate create

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:ModifyDefenseTemplate ModifyDefenseTemplate update

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DeleteMajorProtectionBlackIp DeleteMajorProtectionBlackIp delete

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:ModifyMemberAccount ModifyMemberAccount update

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeResourcePort DescribeResourcePort get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeSlsLogStoreStatus DescribeSlsLogStoreStatus get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:VerifyDomainOwner VerifyDomainOwner update

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeSecurityEventTimeSeriesMetric DescribeSecurityEventTimeSeriesMetric get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeSensitiveOutboundDistribution DescribeSensitiveOutboundDistribution get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:ModifyDefenseResourceGroup ModifyDefenseResourceGroup update

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:ModifyDefenseResourceXff ModifyDefenseResourceXff update

    *DefenseResource

    acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/{#Resource}

    		 Nenhum Nenhum
    yundun-waf:DescribeDefaultHttps DescribeDefaultHttps get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeResponseCodeTrendGraph DescribeResponseCodeTrendGraph get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeSensitiveDetectionResult DescribeSensitiveDetectionResult get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeAlarmList DescribeAlarmList get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:UntagResources UntagResources delete

    *DefenseResource

    acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/{#Resource}

    		 Nenhum Nenhum
    yundun-waf:DescribeHybridCloudClusterRule DescribeHybridCloudClusterRule get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DeleteDefenseResource DeleteDefenseResource delete

    *DefenseResource

    acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/{#Resource}

    		 Nenhum Nenhum
    yundun-waf:ListTagKeys ListTagKeys list

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeUserSlsLogRegions DescribeUserSlsLogRegions get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeFreeUserEvents DescribeFreeUserEvents get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DeleteHybridCloudClusterRule DeleteHybridCloudClusterRule delete

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:CreateDomain CreateDomain create

    *DefenseResource

    acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/*

    		 Nenhum Nenhum
    yundun-waf:DescribeUserWafLogStatus DescribeUserWafLogStatus get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:ListTagValues ListTagValues get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeUserEventType DescribeUserEventType get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeRuleHitsTopUrl DescribeRuleHitsTopUrl get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeUserAbnormalTrend DescribeUserAbnormalTrend get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeUserAsset DescribeUserAsset get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeDefenseResources DescribeDefenseResources list

    *DefenseResource

    acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/*

    		 Nenhum Nenhum
    yundun-waf:CreateMemberAccounts CreateMemberAccounts create

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:ModifyResourceLogFieldConfig ModifyResourceLogFieldConfig update

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeHybridCloudProcessMonitor DescribeHybridCloudProcessMonitor get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeTemplateResources DescribeTemplateResources list

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeApisecRules DescribeApisecRules get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:ModifyCloudResourceCert ModifyCloudResourceCert none

    *All Resource

    *

    		 Nenhum Nenhum
    yundun-waf:ModifyApisecAbnormals ModifyApisecAbnormals update

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:ModifyCloudResource ModifyCloudResource update

    DefenseResource

    acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/{#Resource}

    DefenseResource

    acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/{#ResourceInstanceId}-{#Port}-{#Product}

    		 Nenhum Nenhum
    yundun-waf:DescribeCnameCount DescribeCnameCount get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:ModifyUserLogFieldConfig ModifyUserLogFieldConfig update

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeHybridCloudSdkServers DescribeHybridCloudSdkServers get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DeleteDefenseTemplate DeleteDefenseTemplate delete

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:ModifyPauseProtectionStatus ModifyPauseProtectionStatus update

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:ModifyDefaultHttps ModifyDefaultHttps update

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeProductInstances DescribeProductInstances get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:ModifyHybridCloudServer ModifyHybridCloudServer update

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeFreeUserAssetCount DescribeFreeUserAssetCount get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribePostpayBills DescribePostpayBills list

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribePunishedDomains DescribePunishedDomains get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeResourceLogFieldConfig DescribeResourceLogFieldConfig get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribePrepayDailyBills DescribePrepayDailyBills get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeBotRuleLabels DescribeBotRuleLabels list

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:ModifyMajorProtectionBlackIp ModifyMajorProtectionBlackIp update

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeDefenseTemplates DescribeDefenseTemplates list

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeDefenseSceneConfig DescribeDefenseSceneConfig get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeDefenseResourceGroups DescribeDefenseResourceGroups list

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeBaseSystemRules DescribeBaseSystemRules get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:ModifyHybridCloudSdkPullinStatus ModifyHybridCloudSdkPullinStatus update

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeInstance DescribeInstance get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:ModifyDomainCert ModifyDomainCert none

    *All Resource

    *

    		 Nenhum Nenhum
    yundun-waf:DescribeHybridCloudClusters DescribeHybridCloudClusters get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:InitializeWafOperationRole InitializeWafOperationRole create

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeFreeUserEventTypes DescribeFreeUserEventTypes get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeResourceLogStatus DescribeResourceLogStatus get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:ModifyHybridCloudGroup ModifyHybridCloudGroup update

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeFlowTopUrl DescribeFlowTopUrl get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeResourceSupportRegions DescribeResourceSupportRegions get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DeleteApisecEvents DeleteApisecEvents delete

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:CreateHybridCloudCluster CreateHybridCloudCluster create

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeNetworkFlowTimeSeriesMetric DescribeNetworkFlowTimeSeriesMetric get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeThreatEventDetail DescribeThreatEventDetail get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeSecurityEventLogs DescribeSecurityEventLogs get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeHybridCloudServerRegions DescribeHybridCloudServerRegions get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:CreateDefenseResource CreateDefenseResource create

    *DefenseResource

    acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/*

    		 Nenhum Nenhum
    yundun-waf:DescribeApisecSuggestions DescribeApisecSuggestions get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:ModifyHybridCloudClusterRule ModifyHybridCloudClusterRule update

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:ChangeResourceGroup ChangeResourceGroup update

    *DefenseResource

    acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/{#Resource}

    		 Nenhum

    yundun-waf:ChangeResourceGroup
    yundun-waf:CreateHybridCloudClusterRule CreateHybridCloudClusterRule create

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:TagResources TagResources create

    *DefenseResource

    acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/{#Resource}

    		 Nenhum Nenhum
    yundun-waf:DescribeApisecSlsLogStores DescribeApisecSlsLogStores get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:ModifyApisecApiResource ModifyApisecApiResource update

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:CreateDefenseResourceGroup CreateDefenseResourceGroup create

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeApisecSlsProjects DescribeApisecSlsProjects get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeDDoSStatus DescribeDDoSStatus get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeApisecUserOperations DescribeApisecUserOperations get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:ModifyDomain ModifyDomain update

    DefenseResource

    acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/{#Resource}

    DefenseResource

    acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/{#Domain}-waf

    		 Nenhum Nenhum
    yundun-waf:DescribeHybridCloudSupportRegions DescribeHybridCloudSupportRegions get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:AddAddress AddAddress update

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeTemplateResourceCount DescribeTemplateResourceCount list

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeApisecStatistics DescribeApisecStatistics get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:CreateHybridCloudGroup CreateHybridCloudGroup create

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:ClearAddress ClearAddress delete

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribePocFunctions DescribePocFunctions get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeApisecAbnormalDomainStatistic DescribeApisecAbnormalDomainStatistic get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeFreeUserEventCount DescribeFreeUserEventCount get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeSensitiveApiStatistic DescribeSensitiveApiStatistic get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DeleteApisecAbnormals DeleteApisecAbnormals delete

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeLogDeliveryConfigs DescribeLogDeliveryConfigs list

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeFlowChart DescribeFlowChart get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeHybridCloudBasicMonitor DescribeHybridCloudBasicMonitor get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeAbnormalCloudResources DescribeAbnormalCloudResources none

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeDefenseTemplate DescribeDefenseTemplate get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:ModifyUserWafLogStatus ModifyUserWafLogStatus update

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:CreateCloudResource CreateCloudResource create

    *DefenseResource

    acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/*

    		 Nenhum Nenhum
    yundun-waf:CreateMajorProtectionBlackIp CreateMajorProtectionBlackIp create

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeHybridCloudResourceDetail DescribeHybridCloudResourceDetail get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeDefenseResourceTemplates DescribeDefenseResourceTemplates list

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeChargeModule DescribeChargeModule get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DeleteDefenseRuleBlockIp DeleteDefenseRuleBlockIp delete

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeBaseRuleChangeLog DescribeBaseRuleChangeLog get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeApisecLogDeliveries DescribeApisecLogDeliveries get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:ModifyDefenseRuleCache ModifyDefenseRuleCache update

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeRuleHitsTopTuleType DescribeRuleHitsTopTuleType get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeDefenseResourceGroup DescribeDefenseResourceGroup get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:ModifyDefenseRuleStatus ModifyDefenseRuleStatus update

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:CreateDefenseRule CreateDefenseRule create

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeSlsAuthStatus DescribeSlsAuthStatus get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeDefenseTemplateValidGroups DescribeDefenseTemplateValidGroups list

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeApisecApiResources DescribeApisecApiResources get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:ModifyResourceLogStatus ModifyResourceLogStatus update

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeSensitiveOutboundTrend DescribeSensitiveOutboundTrend get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeRuleHitsTopRuleId DescribeRuleHitsTopRuleId get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribePauseProtectionStatus DescribePauseProtectionStatus get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:ModifyHybridCloudGroupShrinkServer ModifyHybridCloudGroupShrinkServer update

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:ListTagResources ListTagResources get

    *DefenseResource

    acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/{#Resource}

    		 Nenhum Nenhum
    yundun-waf:CreateApiExport CreateApiExport create

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeLogDeliveryConfig DescribeLogDeliveryConfig get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeWafSourceIpSegment DescribeWafSourceIpSegment get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeAddresses DescribeAddresses list

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeSensitiveRequestLog DescribeSensitiveRequestLog get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeMemberAccounts DescribeMemberAccounts list

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DeleteCloudResource DeleteCloudResource delete

    DefenseResource

    acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/{#Resource}

    DefenseResource

    acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/{#ResourceInstanceId}-{#Port}-{#Product}

    		 Nenhum Nenhum
    yundun-waf:DeleteCloudResourceExtensionCert DeleteCloudResourceExtensionCert delete

    *All Resource

    *

    		 Nenhum Nenhum
    yundun-waf:CreateCerts CreateCerts create

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeDefenseRules DescribeDefenseRules list

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeDomainDNSRecord DescribeDomainDNSRecord get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeDomainDetail DescribeDomainDetail get

    DefenseResource

    acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/{#Resource}

    DefenseResource

    acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/{#Resource}-waf

    		 Nenhum Nenhum
    yundun-waf:DescribeSensitiveStatistic DescribeSensitiveStatistic get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribePeakTrend DescribePeakTrend get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeCloudResourceList DescribeCloudResourceList list

    *DefenseResource

    acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/{#Resource}

    		 Nenhum

    yundun-waf:DescribeCloudResourceList
    yundun-waf:DescribeChargeResult DescribeChargeResult get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:ModifyApisecEvents ModifyApisecEvents update

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeHybridCloudUser DescribeHybridCloudUser get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeHybridCloudProtectableCount DescribeHybridCloudProtectableCount get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeDomains DescribeDomains get

    *DefenseResource

    acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/{#Resource}

    		 Nenhum

    yundun-waf:DescribeDomains
    yundun-waf:DescribeRelatedDefenseRules DescribeRelatedDefenseRules list

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:ModifyResourceLogDeliveryStatus ModifyResourceLogDeliveryStatus update

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeCertDetail DescribeCertDetail get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeSensitiveOutboundStatistic DescribeSensitiveOutboundStatistic get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeRuleHitsTopResource DescribeRuleHitsTopResource get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:CreateCloudResourceExtensionCert CreateCloudResourceExtensionCert update

    *All Resource

    *

    		 Nenhum Nenhum
    yundun-waf:DescribeVerifyContent DescribeVerifyContent get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeSensitiveRequests DescribeSensitiveRequests list

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeDefenseRuleStatistics DescribeDefenseRuleStatistics get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:ModifyTemplateResources ModifyTemplateResources update

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:SyncProductInstance SyncProductInstance create

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DeleteLogDeliveryConfig DeleteLogDeliveryConfig delete

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DeleteAddress DeleteAddress delete

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeBotAppKey DescribeBotAppKey get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeUserApiRequest DescribeUserApiRequest get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeVisitUas DescribeVisitUas get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:ModifyApisecLogDelivery ModifyApisecLogDelivery update

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:CreateSM2Cert CreateSM2Cert create

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeDefenseResourceGroupNames DescribeDefenseResourceGroupNames list

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeAccountDelegatedStatus DescribeAccountDelegatedStatus get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeAlarmBanner DescribeAlarmBanner get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeResourceInstanceCerts DescribeResourceInstanceCerts get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeDefenseResource DescribeDefenseResource get

    *DefenseResource

    acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/{#Resource}

    		 Nenhum Nenhum
    yundun-waf:DescribeCloudResources DescribeCloudResources list

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeApisecProtectionResources DescribeApisecProtectionResources list

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeMajorProtectionBlackIps DescribeMajorProtectionBlackIps get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeHybridCloudResources DescribeHybridCloudResources get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeApisecEventDomainStatistic DescribeApisecEventDomainStatistic get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeRuleGroups DescribeRuleGroups get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DeleteDefenseRule DeleteDefenseRule delete

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeApisecSensitiveDomainStatistic DescribeApisecSensitiveDomainStatistic get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:DescribeSlsLogStore DescribeSlsLogStore get

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:ModifyDefenseSceneConfig ModifyDefenseSceneConfig update

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum
    yundun-waf:CopyDefenseTemplate CopyDefenseTemplate create

    *All Resource

    *

    acs:ResourceGroupId

    		 Nenhum

    Resource

    A tabela a seguir lista os recursos definidos por Web Application Firewall. Especifique-os no elemento Resource das instruções de política RAM para conceder permissões para operações específicas. Eles são identificados de forma exclusiva por ARNs. Formato: acs:{#ramcode}:{#regionId}:{#accountId}:{#resourceType}:

    • acs: A sigla do serviço da Alibaba Cloud, que indica a nuvem pública da Alibaba Cloud.

    • {#ramcode}: O código usado no RAM para indicar um serviço da Alibaba Cloud.

    • {#regionId}: O ID da região. Se o recurso abrange todas as regiões, defina-o como um asterisco (*).

    • {#accountId}: O ID da conta da Alibaba Cloud. Se o recurso abrange todas as contas da Alibaba Cloud, defina-o como um asterisco (*).

    • {#resourceType}: O identificador de recurso definido pelo serviço. Suporta uma estrutura hierárquica, semelhante a um caminho de arquivo. Se a instrução abrange recursos globais, defina-o como um asterisco (*).

    Tipo de recurso

    ARN
    DefenseResource
    • acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/{#Resource}
    • acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/{#Domain}-waf
    • acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/*
    • acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/{#ResourceInstanceId}-{#Port}-{#Product}
    • acs:yundun-waf:{#regionId}:{#accountId}:defenseresource/{#Resource}-waf

    Condition

    A tabela a seguir lista as chaves de condição em nível de produto definidas por Web Application Firewall. Você também pode usar as Chaves de condição comuns da Alibaba Cloud. Especifique essas chaves no elemento Condition das instruções de política RAM para definir regras de autorização granulares. Na chave de condição, especifique os valores de condição no elemento Condition_value da política.

    Cada chave de condição possui um tipo de dado específico, como string, número, booleano ou endereço IP. O tipo de dado determina quais operadores condicionais podem ser usados para comparar os valores da solicitação com os valores da política. Você deve especificar os operadores condicionais compatíveis com o tipo de dado da chave de condição. Operadores incompatíveis tornarão a política inválida. Consulte Operador de condição para combinações válidas.

    Chave de condição

    Descrição

    Tipo de dado
    acs:ResourceGroupId O ID do grupo de recursos. String

    Como criar políticas RAM personalizadas?

    Você pode criar políticas personalizadas e concedê-las a usuários RAM, grupos de usuários RAM ou funções RAM. Para instruções, consulte: