API Gateway：使用資源群組進行精細化資源控制-最新

資源群組授權的工作原理

您可以使用資源群組（Resource Group）對阿里雲帳號內的資源進行分組管理。例如，為不同的專案建立對應的資源群組，並將資源轉移到對應的組中，以便集中管理各專案的資源。更多資訊，請參見什麼是資源群組。

在完成資源分組後，您可以為不同的RAM授權主體（RAM使用者、RAM使用者組或RAM角色）授予指定資源群組範圍的許可權，從而限定這個授權主體只能管理該資源群組內的資源。更多資訊，請參見資源分組和授權。

這種授權方式的優點有：

• 許可權精細化：確保每個身份能獲得最準確的資源存取權限，避免帳號下的多重專案的資源混合管理。

• 良好的擴充性：後續新增資源時，只需將其加入該資源群組，RAM身份便會自動獲得新資源的相應許可權，無需再次授權。

為RAM使用者授予資源群組層級的許可權

下面以RAM使用者為例，介紹授予指定資源群組內雲原生API Gateway資源許可權的操作步驟。

支援資源群組的資源類型

雲原生API Gateway支援資源群組的資源類型如下表所示：

不支援資源群組層級授權的操作

雲原生API Gateway中不支援資源群組層級授權的操作（Action）如下：

對於不支援資源群組授權的操作，授權時資源範圍選取資源群組層級將無效。如果仍需要RAM使用者有上述操作許可權，您需要建立自訂權限原則，授權時資源範圍選取帳號層級。

以下是兩個自訂權限原則樣本，您可以根據實際需要調整策略內容。

• 允許不支援資源群組層級授權的全部唯讀操作：Action中列舉不支援資源群組層級授權的所有隻讀操作。

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "apig:CheckCommodityStatus",
          "apig:CheckRegularExpressions",
          "apig:ExportCodeFile",
          "apig:ExportWasmFile",
          "apig:GetAiGenerateTaskStatus",
          "apig:GetHttpApiAttachment",
          "apig:GetHttpApiInstanceByEnvId",
          "apig:GetHttpApiRoute",
          "apig:GetMcpServer",
          "apig:GetMigrationNamespacedServices",
          "apig:GetMigrationTask",
          "apig:GetPluginAttachment",
          "apig:GetPluginClass",
          "apig:GetPluginWorkspace",
          "apig:GetPolicy",
          "apig:GetPolicyAttachment",
          "apig:GetResourceOverview",
          "apig:GetSecret",
          "apig:GetSecretValue",
          "apig:InvokeAIAgent",
          "apig:ListConsumers",
          "apig:ListEvents",
          "apig:ListGatewayErrorAccessLogs",
          "apig:ListGatewayUpgradableVersions",
          "apig:ListGlobalPolicies",
          "apig:ListLocations",
          "apig:ListMcpServers",
          "apig:ListMigrationTasks",
          "apig:ListPluginClasses",
          "apig:ListPluginRepositories",
          "apig:ListPluginWorkspace",
          "apig:ListPolicies",
          "apig:ListSecretReferences",
          "apig:ListSecrets",
          "apig:ListSslCerts",
          "apig:ListSyncMCPServer",
          "apig:ListSyncedMCPServer",
          "apig:ListZones",
          "apig:MCPMessaging",
          "apig:MCPSSETransport"
        ],
        "Resource": "*"
      }
    ]
  }
  

• 允許不支援資源群組層級授權的全部操作：Action中列舉不支援資源群組層級授權的全部操作。

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "apig:BatchDeleteConsumerAuthorizationRule",
          "apig:CancelAiGenerateTask",
          "apig:CheckCommodityStatus",
          "apig:CheckRegularExpressions",
          "apig:CreateAiGenerateWebIde",
          "apig:CreateAndAttachPolicy",
          "apig:CreateConsumer",
          "apig:CreateConsumerAuthorizationRule",
          "apig:CreateConsumerAuthorizationRules",
          "apig:CreateMcpServer",
          "apig:CreateMigrationTask",
          "apig:CreatePluginAttachment",
          "apig:CreatePluginClass",
          "apig:CreatePluginRepository",
          "apig:CreatePluginWorkspace",
          "apig:CreatePolicy",
          "apig:CreatePolicyAttachment",
          "apig:CreateSecret",
          "apig:CreateWebIde",
          "apig:DeleteConsumer",
          "apig:DeleteConsumerAuthorizationRule",
          "apig:DeleteHttpApiRoute",
          "apig:DeleteMcpServer",
          "apig:DeleteMigrationTask",
          "apig:DeletePluginAttachment",
          "apig:DeletePluginClass",
          "apig:DeletePolicy",
          "apig:DeletePolicyAttachment",
          "apig:DeleteSecret",
          "apig:DeployDomain",
          "apig:DeployMcpServer",
          "apig:DetachAndDeletePolicy",
          "apig:ExportCodeFile",
          "apig:ExportWasmFile",
          "apig:GetAiGenerateTaskStatus",
          "apig:GetConsumer",
          "apig:GetConsumerAuthorizationRule",
          "apig:GetHttpApiAttachment",
          "apig:GetHttpApiInstanceByEnvId",
          "apig:GetHttpApiRoute",
          "apig:GetMcpServer",
          "apig:GetMigrationNamespacedServices",
          "apig:GetMigrationTask",
          "apig:GetPluginAttachment",
          "apig:GetPluginClass",
          "apig:GetPluginWorkspace",
          "apig:GetPolicy",
          "apig:GetPolicyAttachment",
          "apig:GetResourceOverview",
          "apig:GetSecret",
          "apig:GetSecretValue",
          "apig:InstallPlugin",
          "apig:InvokeAIAgent",
          "apig:ListConsumerAuthorizationRules",
          "apig:ListConsumers",
          "apig:ListEvents",
          "apig:ListGatewayErrorAccessLogs",
          "apig:ListGatewayUpgradableVersions",
          "apig:ListGlobalPolicies",
          "apig:ListInstallableGateways",
          "apig:ListLocations",
          "apig:ListMcpServers",
          "apig:ListMigrationTasks",
          "apig:ListPluginAttachments",
          "apig:ListPluginClasses",
          "apig:ListPluginRepositories",
          "apig:ListPluginWorkspace",
          "apig:ListPlugins",
          "apig:ListPolicies",
          "apig:ListPolicyClasses",
          "apig:ListSecretReferences",
          "apig:ListSecrets",
          "apig:ListServiceQuotas",
          "apig:ListSslCerts",
          "apig:ListSyncMCPServer",
          "apig:ListSyncedMCPServer",
          "apig:ListZones",
          "apig:MCPMessaging",
          "apig:MCPSSETransport",
          "apig:ModifyQuotaLimitValue",
          "apig:ModifyServiceQuota",
          "apig:QueryConsumerAuthorizationRules",
          "apig:QueryTestClusterData",
          "apig:QueryTestDBData",
          "apig:RefreshPluginOAuthCode",
          "apig:RemoveConsumerAuthorizationRule",
          "apig:RetryCreateGateway",
          "apig:RunPluginPipeline",
          "apig:SyncMCPServer",
          "apig:SyncMCPServers",
          "apig:UnDeployMcpServer",
          "apig:UninstallPlugin",
          "apig:UpdateAndAttachPolicy",
          "apig:UpdateAuthorizationRule",
          "apig:UpdateConsumer",
          "apig:UpdateConsumerAuthorizationRule",
          "apig:UpdateEnvironment",
          "apig:UpdateHttpApiRoute",
          "apig:UpdateMcpServer",
          "apig:UpdateMigrationTask",
          "apig:UpdatePluginAttachment",
          "apig:UpdatePolicy",
          "apig:UpdateSecret",
          "apig:UpdateServiceVersion",
          "apig:UploadCodeFile",
          "apig:VerifyMigrationTask",
          "apig:test"
        ],
        "Resource": "*"
      }
    ]
  }
  

常見問題