ALIYUN::RAM::ManagedPolicy is used to create a Resource Access Management (RAM) policy.
Syntax
{
"Type": "ALIYUN::RAM::ManagedPolicy",
"Properties": {
"PolicyName": String,
"Description": String,
"Roles": List,
"PolicyDocumentUnchecked": Map,
"PolicyDocument": Map,
"Groups": List,
"Users": List,
"IgnoreExisting": Boolean
}
}Properties
Property | Type | Required | Editable | Description | Constraints |
PolicyName | String | Yes | No | The name of the policy. | The name can be up to 128 characters in length. |
Description | String | No | No | The description of the policy. | The description can be up to 1,024 characters in length. |
Groups | List | No | No | The user groups to whom you want to attach the policy. | None. |
IgnoreExisting | Boolean | No | No | Specifies whether to ignore the existing policy that has the same name as the new policy. | Valid values:
|
PolicyDocument | Map | No | Yes | Details of the policy. | For more information, see PolicyDocument properties. |
PolicyDocumentUnchecked | Map | No | Yes | The policy document that describes specific actions performed on specific resources. | If you specify this property, PolicyDocument is ignored. |
Roles | List | No | No | The roles to whom you want to attach the policy. | None. |
Users | List | No | No | The users to whom you want to attach the policy. | None. |
PolicyDocument syntax
"PolicyDocument": {
"Version": String,
"Statement": List
}PolicyDocument properties
Property | Type | Required | Editable | Description | Constraints |
Statement | List | Yes | No | The statements of the policy. | For more information, see Statement properties. |
Version | String | Yes | No | The version of the policy. | None. |
Statement syntax
"Statement": [
{
"Condition": Map,
"Action": List,
"Resource": List,
"Effect": String,
"NotAction": List
}
]Statement properties
Property | Type | Required | Editable | Description | Constraints |
Action | List | No | No | The actions that are performed based on the policy. | None. |
Condition | Map | No | No | The condition that is required for the policy to take effect. | None. |
Effect | String | No | No | The effect of the statement. | Valid values:
|
NotAction | List | No | No | The exception actions that are allowed or denied. | None. |
Resource | List | No | No | The resources to which you want to apply the policy. | None. |
Return values
Fn::GetAtt
PolicyName: the name of the policy.
Examples
Scenario 1: Create an OSS read-only policy and attach it to specified RAM users.
ROSTemplateFormatVersion: '2015-09-01'
Description:
zh-cn: 创建OSS只读权限策略并授权给指定RAM用户。
en: Create an OSS read-only policy and attach it to specified RAM users.
Parameters:
PolicyName:
Type: String
Label:
zh-cn: 策略名称
en: Policy Name
Description:
zh-cn: RAM自定义策略名称，最长128个字符。
en: RAM custom policy name, up to 128 characters.
Default: oss-readonly-policy
OssBucketName:
Type: String
Label:
zh-cn: OSS存储桶名称
en: OSS Bucket Name
Description:
zh-cn: 允许只读访问的OSS存储桶名称。
en: The OSS bucket name to allow read-only access.
UserName:
Type: String
Label:
zh-cn: RAM用户
en: RAM User
Description:
zh-cn: 要授权的RAM用户名称。
en: The RAM user to attach this policy to.
AssociationProperty: ALIYUN::RAM::User
Resources:
ManagedPolicy:
Type: ALIYUN::RAM::ManagedPolicy
Properties:
PolicyName:
Ref: PolicyName
Description:
Fn::Sub: 允许对OSS存储桶${OssBucketName}进行只读访问
PolicyDocument:
Version: '1'
Statement:
- Effect: Allow
Action:
- oss:GetObject
- oss:GetObjectAcl
- oss:ListObjects
- oss:GetBucket
- oss:GetBucketInfo
- oss:ListBuckets
Resource:
- Fn::Sub: acs:oss:*:*:${OssBucketName}
- Fn::Sub: acs:oss:*:*:${OssBucketName}/*
Users:
- Ref: UserName
Outputs:
PolicyName:
Label:
zh-cn: 策略名称
en: Policy Name
Description:
zh-cn: 创建成功的RAM自定义策略名称。
en: The name of the created RAM custom policy.
Value:
Fn::GetAtt:
- ManagedPolicy
- PolicyName{
"ROSTemplateFormatVersion": "2015-09-01",
"Description": {
"zh-cn": "创建OSS只读权限策略并授权给指定RAM用户。",
"en": "Create an OSS read-only policy and attach it to specified RAM users."
},
"Parameters": {
"PolicyName": {
"Type": "String",
"Label": {
"zh-cn": "策略名称",
"en": "Policy Name"
},
"Description": {
"zh-cn": "RAM自定义策略名称，最长128个字符。",
"en": "RAM custom policy name, up to 128 characters."
},
"Default": "oss-readonly-policy"
},
"OssBucketName": {
"Type": "String",
"Label": {
"zh-cn": "OSS存储桶名称",
"en": "OSS Bucket Name"
},
"Description": {
"zh-cn": "允许只读访问的OSS存储桶名称。",
"en": "The OSS bucket name to allow read-only access."
}
},
"UserName": {
"Type": "String",
"Label": {
"zh-cn": "RAM用户",
"en": "RAM User"
},
"Description": {
"zh-cn": "要授权的RAM用户名称。",
"en": "The RAM user to attach this policy to."
},
"AssociationProperty": "ALIYUN::RAM::User"
}
},
"Resources": {
"ManagedPolicy": {
"Type": "ALIYUN::RAM::ManagedPolicy",
"Properties": {
"PolicyName": {
"Ref": "PolicyName"
},
"Description": {
"Fn::Sub": "允许对OSS存储桶${OssBucketName}进行只读访问"
},
"PolicyDocument": {
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"oss:GetObject",
"oss:GetObjectAcl",
"oss:ListObjects",
"oss:GetBucket",
"oss:GetBucketInfo",
"oss:ListBuckets"
],
"Resource": [
{
"Fn::Sub": "acs:oss:*:*:${OssBucketName}"
},
{
"Fn::Sub": "acs:oss:*:*:${OssBucketName}/*"
}
]
}
]
},
"Users": [
{
"Ref": "UserName"
}
]
}
}
},
"Outputs": {
"PolicyName": {
"Label": {
"zh-cn": "策略名称",
"en": "Policy Name"
},
"Description": {
"zh-cn": "创建成功的RAM自定义策略名称。",
"en": "The name of the created RAM custom policy."
},
"Value": {
"Fn::GetAtt": [
"ManagedPolicy",
"PolicyName"
]
}
}
}
}Scenario 2: Create an ECS management policy with an IP condition and attach it to user groups and roles.
ROSTemplateFormatVersion: '2015-09-01'
Description:
zh-cn: 创建ECS管理权限策略并附加IP条件限制，授权给用户组和角色。
en: Create an ECS management policy with IP condition and attach to groups and roles.
Parameters:
PolicyName:
Type: String
Label:
zh-cn: 策略名称
en: Policy Name
Default: ecs-manage-ip-restricted
AllowedCidrBlock:
Type: String
Label:
zh-cn: 允许的源IP网段
en: Allowed Source CIDR
Description:
zh-cn: >-
允许发起请求的源IP网段，
例如10.0.0.0/8或192.168.1.0/24。
en: >-
Allowed source IP CIDR block,
e.g. 10.0.0.0/8 or 192.168.1.0/24.
Default: 10.0.0.0/8
GroupName:
Type: String
Label:
zh-cn: RAM用户组
en: RAM Group
Description:
zh-cn: 要授权的RAM用户组名称。
en: The RAM group to attach this policy to.
AssociationProperty: ALIYUN::RAM::Group
RoleName:
Type: String
Label:
zh-cn: RAM角色
en: RAM Role
Description:
zh-cn: 要授权的RAM角色名称。
en: The RAM role to attach this policy to.
AssociationProperty: ALIYUN::RAM::Role
Resources:
ManagedPolicy:
Type: ALIYUN::RAM::ManagedPolicy
Properties:
PolicyName:
Ref: PolicyName
Description: ECS实例管理权限，限定源IP访问，禁止删除和释放操作
PolicyDocument:
Version: '1'
Statement:
- Effect: Allow
Action:
- ecs:DescribeInstances
- ecs:DescribeInstanceStatus
- ecs:DescribeInstanceAttribute
- ecs:StartInstance
- ecs:StopInstance
- ecs:RebootInstance
Resource:
- '*'
Condition:
IpAddress:
acs:SourceIp:
- Ref: AllowedCidrBlock
- Effect: Deny
Action:
- ecs:DeleteInstance
- ecs:ModifyInstanceAttribute
Resource:
- '*'
Groups:
- Ref: GroupName
Roles:
- Ref: RoleName
Outputs:
PolicyName:
Label:
zh-cn: 策略名称
en: Policy Name
Description:
zh-cn: 创建成功的RAM自定义策略名称。
en: The name of the created RAM custom policy.
Value:
Fn::GetAtt:
- ManagedPolicy
- PolicyName{
"ROSTemplateFormatVersion": "2015-09-01",
"Description": {
"zh-cn": "创建ECS管理权限策略并附加IP条件限制，授权给用户组和角色。",
"en": "Create an ECS management policy with IP condition and attach to groups and roles."
},
"Parameters": {
"PolicyName": {
"Type": "String",
"Label": {
"zh-cn": "策略名称",
"en": "Policy Name"
},
"Default": "ecs-manage-ip-restricted"
},
"AllowedCidrBlock": {
"Type": "String",
"Label": {
"zh-cn": "允许的源IP网段",
"en": "Allowed Source CIDR"
},
"Description": {
"zh-cn": "允许发起请求的源IP网段，例如10.0.0.0/8或192.168.1.0/24。",
"en": "Allowed source IP CIDR block, e.g. 10.0.0.0/8 or 192.168.1.0/24."
},
"Default": "10.0.0.0/8"
},
"GroupName": {
"Type": "String",
"Label": {
"zh-cn": "RAM用户组",
"en": "RAM Group"
},
"Description": {
"zh-cn": "要授权的RAM用户组名称。",
"en": "The RAM group to attach this policy to."
},
"AssociationProperty": "ALIYUN::RAM::Group"
},
"RoleName": {
"Type": "String",
"Label": {
"zh-cn": "RAM角色",
"en": "RAM Role"
},
"Description": {
"zh-cn": "要授权的RAM角色名称。",
"en": "The RAM role to attach this policy to."
},
"AssociationProperty": "ALIYUN::RAM::Role"
}
},
"Resources": {
"ManagedPolicy": {
"Type": "ALIYUN::RAM::ManagedPolicy",
"Properties": {
"PolicyName": {
"Ref": "PolicyName"
},
"Description": "ECS实例管理权限，限定源IP访问，禁止删除和释放操作",
"PolicyDocument": {
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ecs:DescribeInstances",
"ecs:DescribeInstanceStatus",
"ecs:DescribeInstanceAttribute",
"ecs:StartInstance",
"ecs:StopInstance",
"ecs:RebootInstance"
],
"Resource": [
"*"
],
"Condition": {
"IpAddress": {
"acs:SourceIp": [
{
"Ref": "AllowedCidrBlock"
}
]
}
}
},
{
"Effect": "Deny",
"Action": [
"ecs:DeleteInstance",
"ecs:ModifyInstanceAttribute"
],
"Resource": [
"*"
]
}
]
},
"Groups": [
{
"Ref": "GroupName"
}
],
"Roles": [
{
"Ref": "RoleName"
}
]
}
}
},
"Outputs": {
"PolicyName": {
"Label": {
"zh-cn": "策略名称",
"en": "Policy Name"
},
"Description": {
"zh-cn": "创建成功的RAM自定义策略名称。",
"en": "The name of the created RAM custom policy."
},
"Value": {
"Fn::GetAtt": [
"ManagedPolicy",
"PolicyName"
]
}
}
}
}Scenario 3: Create a cross-service access policy and attach it to users, user groups, and roles for comprehensive authorization.
ROSTemplateFormatVersion: '2015-09-01'
Description:
zh-cn: 创建跨服务权限策略并同时授权给用户、用户组和角色，实现全面的权限分发。
en: Create a cross-service policy and attach to users, groups and roles for comprehensive authorization.
Parameters:
PolicyName:
Type: String
Label:
zh-cn: 策略名称
en: Policy Name
Description:
zh-cn: RAM自定义策略名称。
en: RAM custom policy name.
Default: cross-service-devops-policy
UserNames:
Type: Json
Label:
zh-cn: RAM用户列表
en: RAM User List
Description:
zh-cn: 要授权的RAM用户名称列表。
en: List of RAM user names to attach this policy to.
Default: []
AssociationProperty: List[Parameter]
AssociationPropertyMetadata:
Parameter:
Type: String
Required: false
AssociationProperty: ALIYUN::RAM::User
Label:
zh-cn: RAM用户
en: RAM User
GroupNames:
Type: Json
Label:
zh-cn: RAM用户组列表
en: RAM Group List
Description:
zh-cn: 要授权的RAM用户组名称列表。
en: List of RAM group names to attach this policy to.
Default: []
AssociationProperty: List[Parameter]
AssociationPropertyMetadata:
Parameter:
Type: String
Required: false
AssociationProperty: ALIYUN::RAM::Group
Label:
zh-cn: RAM用户组
en: RAM Group
RoleNames:
Type: Json
Label:
zh-cn: RAM角色列表
en: RAM Role List
Description:
zh-cn: 要授权的RAM角色名称列表。
en: List of RAM role names to attach this policy to.
Default: []
AssociationProperty: List[Parameter]
AssociationPropertyMetadata:
Parameter:
Type: String
Required: false
AssociationProperty: ALIYUN::RAM::Role
Label:
zh-cn: RAM角色
en: RAM Role
Resources:
ManagedPolicy:
Type: ALIYUN::RAM::ManagedPolicy
Properties:
PolicyName:
Ref: PolicyName
Description: 跨服务DevOps权限策略，覆盖ECS、RDS、SLB、VPC和CloudMonitor
PolicyDocumentUnchecked:
Version: '1'
Statement:
- Effect: Allow
Action:
- ecs:Describe*
- ecs:StartInstance
- ecs:StopInstance
- ecs:RebootInstance
Resource:
- '*'
- Effect: Allow
Action:
- rds:Describe*
- rds:ModifyDBInstanceSpec
- rds:SwitchDBInstanceHA
Resource:
- '*'
- Effect: Allow
Action:
- slb:Describe*
- slb:SetBackendServers
- slb:AddBackendServers
- slb:RemoveBackendServers
Resource:
- '*'
- Effect: Allow
Action:
- vpc:Describe*
Resource:
- '*'
- Effect: Allow
Action:
- cms:Describe*
- cms:QueryMetric*
Resource:
- '*'
- Effect: Deny
Action:
- ecs:DeleteInstance
- rds:DeleteDBInstance
- slb:DeleteLoadBalancer
Resource:
- '*'
Users:
Ref: UserNames
Groups:
Ref: GroupNames
Roles:
Ref: RoleNames
IgnoreExisting: true
Outputs:
PolicyName:
Label:
zh-cn: 策略名称
en: Policy Name
Description:
zh-cn: 创建成功的RAM自定义策略名称。
en: The name of the created RAM custom policy.
Value:
Fn::GetAtt:
- ManagedPolicy
- PolicyName{
"ROSTemplateFormatVersion": "2015-09-01",
"Description": {
"zh-cn": "创建跨服务权限策略并同时授权给用户、用户组和角色，实现全面的权限分发。",
"en": "Create a cross-service policy and attach to users, groups and roles for comprehensive authorization."
},
"Parameters": {
"PolicyName": {
"Type": "String",
"Label": {
"zh-cn": "策略名称",
"en": "Policy Name"
},
"Description": {
"zh-cn": "RAM自定义策略名称。",
"en": "RAM custom policy name."
},
"Default": "cross-service-devops-policy"
},
"UserNames": {
"Type": "Json",
"Label": {
"zh-cn": "RAM用户列表",
"en": "RAM User List"
},
"Description": {
"zh-cn": "要授权的RAM用户名称列表。",
"en": "List of RAM user names to attach this policy to."
},
"Default": [],
"AssociationProperty": "List[Parameter]",
"AssociationPropertyMetadata": {
"Parameter": {
"Type": "String",
"Required": false,
"AssociationProperty": "ALIYUN::RAM::User",
"Label": {
"zh-cn": "RAM用户",
"en": "RAM User"
}
}
}
},
"GroupNames": {
"Type": "Json",
"Label": {
"zh-cn": "RAM用户组列表",
"en": "RAM Group List"
},
"Description": {
"zh-cn": "要授权的RAM用户组名称列表。",
"en": "List of RAM group names to attach this policy to."
},
"Default": [],
"AssociationProperty": "List[Parameter]",
"AssociationPropertyMetadata": {
"Parameter": {
"Type": "String",
"Required": false,
"AssociationProperty": "ALIYUN::RAM::Group",
"Label": {
"zh-cn": "RAM用户组",
"en": "RAM Group"
}
}
}
},
"RoleNames": {
"Type": "Json",
"Label": {
"zh-cn": "RAM角色列表",
"en": "RAM Role List"
},
"Description": {
"zh-cn": "要授权的RAM角色名称列表。",
"en": "List of RAM role names to attach this policy to."
},
"Default": [],
"AssociationProperty": "List[Parameter]",
"AssociationPropertyMetadata": {
"Parameter": {
"Type": "String",
"Required": false,
"AssociationProperty": "ALIYUN::RAM::Role",
"Label": {
"zh-cn": "RAM角色",
"en": "RAM Role"
}
}
}
}
},
"Resources": {
"ManagedPolicy": {
"Type": "ALIYUN::RAM::ManagedPolicy",
"Properties": {
"PolicyName": {
"Ref": "PolicyName"
},
"Description": "跨服务DevOps权限策略，覆盖ECS、RDS、SLB、VPC和CloudMonitor",
"PolicyDocumentUnchecked": {
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ecs:Describe*",
"ecs:StartInstance",
"ecs:StopInstance",
"ecs:RebootInstance"
],
"Resource": [
"*"
]
},
{
"Effect": "Allow",
"Action": [
"rds:Describe*",
"rds:ModifyDBInstanceSpec",
"rds:SwitchDBInstanceHA"
],
"Resource": [
"*"
]
},
{
"Effect": "Allow",
"Action": [
"slb:Describe*",
"slb:SetBackendServers",
"slb:AddBackendServers",
"slb:RemoveBackendServers"
],
"Resource": [
"*"
]
},
{
"Effect": "Allow",
"Action": [
"vpc:Describe*"
],
"Resource": [
"*"
]
},
{
"Effect": "Allow",
"Action": [
"cms:Describe*",
"cms:QueryMetric*"
],
"Resource": [
"*"
]
},
{
"Effect": "Deny",
"Action": [
"ecs:DeleteInstance",
"rds:DeleteDBInstance",
"slb:DeleteLoadBalancer"
],
"Resource": [
"*"
]
}
]
},
"Users": {
"Ref": "UserNames"
},
"Groups": {
"Ref": "GroupNames"
},
"Roles": {
"Ref": "RoleNames"
},
"IgnoreExisting": true
}
}
},
"Outputs": {
"PolicyName": {
"Label": {
"zh-cn": "策略名称",
"en": "Policy Name"
},
"Description": {
"zh-cn": "创建成功的RAM自定义策略名称。",
"en": "The name of the created RAM custom policy."
},
"Value": {
"Fn::GetAtt": [
"ManagedPolicy",
"PolicyName"
]
}
}
}
}