ApsaraMQ for RabbitMQ：雲訊息佇列 RabbitMQ 版自訂權限原則參考

什麼是自訂權限原則

在基於RAM的存取控制體系中，自訂權限原則是指在系統權限原則之外，您可以自主建立、更新和刪除的權限原則。自訂權限原則的版本更新需由您來維護。

• 建立自訂權限原則後，需為RAM使用者、使用者組或RAM角色綁定權限原則，這些RAM身份才能獲得權限原則中指定的存取權限。

• 已建立的權限原則支援刪除，但刪除前需確保該策略未被引用。如果該權限原則已被引用，您需要在該權限原則的引用記錄中移除授權。

• 自訂權限原則支援版本控制，您可以按照RAM規定的版本管理機制來管理您建立的自訂權限原則版本。

操作文檔

• 建立自訂權限原則

• 修改自訂權限原則內容和備忘

• 刪除自訂權限原則

• 系統管理權限策略授權

• 管理自訂權限原則版本

自訂授權策略

雲訊息佇列 RabbitMQ 版支援以下自訂權限原則。

自訂權限原則樣本

• 樣本一：自訂某個Vhost訊息收發許可權

  {
      "Version":"1",
      "Statement":[
          {
              "Action":[
                  "amqp:GetInstance",
                  "amqp:ListVhost",
                  "amqp:GetVhost"
              ],
              "Resource":[
                  "acs:amqp:*:*:/instances/$instanceId",
                  "acs:amqp:*:*:/instances/$instanceId/vhosts/$vhostName",
                  "acs:amqp:*:*:/instances/$instanceId/vhosts/*"
              ],
              "Effect":"Allow"
          },
          {
              "Action":[
                  "amqp:ListExchange",
                  "amqp:CreateExchange",
                  "amqp:DeleteExchange",
                  "amqp:ListQueue",
                  "amqp:DeleteQueue",
                  "amqp:CreateQueue",
                  "amqp:BasicRecover",
                  "amqp:BasicCancel",
                  "amqp:BasicPublish",
                  "amqp:BasicConsume",
                  "amqp:BasicAck",
                  "amqp:BasicNack",
                  "amqp:BasicReject",
                  "amqp:QueuePurge",
                  "amqp:BasicGet",
                  "amqp:GetExchange",
                  "amqp:GetQueue"
              ],
              "Resource":"acs:amqp:*:*:/instances/$instanceId/vhosts/$vhostName/*",
              "Effect":"Allow"
          },
          {
              "Action":[
                  "amqp:ListStaticAccounts",
                  "amqp:FetchStaticAccount",
                  "amqp:DeleteStaticAccount"
              ],
              "Resource":"acs:amqp:*:*:/instances/$instanceId/staticAccount/*",
              "Effect":"Allow"
          }
      ]
  }

• 樣本二：自訂發布訊息授權策略

  {
      "Version": "1",
      "Statement": [
          {
              "Action": [
                  "amqp:GetInstance"
              ],
              "Resource": [
                  "acs:amqp:*:*:/instances/$instanceId",
                  "acs:amqp:*:*:/instances/$instanceId/vhosts/$vhostName"
              ],
              "Effect": "Allow"
          },
          {
              "Action": [
                  "amqp:CreateExchange",
                  "amqp:CreateQueue",
                  "amqp:BasicRecover",
                  "amqp:BasicPublish",
                  "amqp:BasicAck",
                  "amqp:BasicNack",
                  "amqp:GetExchange",
                  "amqp:GetQueue"
              ],
              "Resource": "acs:amqp:*:*:/instances/$instanceId/vhosts/$vhostName/*",
              "Effect": "Allow"
          }
      ]
  }

• 樣本三：自訂訂閱訊息授權策略

  {
      "Version": "1",
      "Statement": [
          {
              "Action": [
                  "amqp:GetInstance",
                  "amqp:GetVhost"
              ],
              "Resource": [
                  "acs:amqp:*:*:/instances/$instanceId",
                  "acs:amqp:*:*:/instances/$instanceId/vhosts/$vhostName"
              ],
              "Effect": "Allow"
          },
          {
              "Action": [
                  "amqp:CreateExchange",
                  "amqp:CreateQueue",
                  "amqp:BasicRecover",
                  "amqp:BasicCancel",
                  "amqp:BasicConsume",
                  "amqp:BasicAck",
                  "amqp:BasicNack",
                  "amqp:BasicReject",
                  "amqp:QueuePurge",
                  "amqp:BasicGet",
                  "amqp:GetExchange",
                  "amqp:GetQueue"
              ],
              "Resource": "acs:amqp:*:*:/instances/$instanceId/vhosts/$vhostName/*",
              "Effect": "Allow"
          }
      ]
  }

• 樣本四：自訂發布和訂閱訊息授權策略

  {
      "Version": "1",
      "Statement": [
          {
              "Action": [
                  "amqp:GetInstance",
                  "amqp:GetVhost"
              ],
              "Resource": [
                  "acs:amqp:*:*:/instances/$instanceId",
                  "acs:amqp:*:*:/instances/$instanceId/vhosts/$vhostName"
              ],
              "Effect": "Allow"
          },
          {
              "Action": [
                  "amqp:ListExchange",
                  "amqp:CreateExchange",
                  "amqp:DeleteExchange",
                  "amqp:ListQueue",
                  "amqp:DeleteQueue",
                  "amqp:CreateQueue",
                  "amqp:BasicRecover",
                  "amqp:BasicCancel",
                  "amqp:BasicPublish",
                  "amqp:BasicConsume",
                  "amqp:BasicAck",
                  "amqp:BasicNack",
                  "amqp:BasicReject",
                  "amqp:QueuePurge",
                  "amqp:BasicGet",
                  "amqp:GetExchange",
                  "amqp:GetQueue"
              ],
              "Resource": "acs:amqp:*:*:/instances/$instanceId/vhosts/$vhostName/*",
              "Effect": "Allow"
          }
      ]
  }

• 樣本五：自訂使用者名稱密碼許可權

  {
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "amqp:ListStaticAccounts",
                  "amqp:FetchStaticAccount",
                  "amqp:DeleteStaticAccount"
              ],
              "Resource": "acs:amqp:*:*:/instances/$instanceId/staticAccount/*"
          },
          {
              "Effect": "Allow",
              "Action": "amqp:GetInstance",
              "Resource": "acs:amqp:*:*:/instances/$instanceId"
          }
      ],
      "Version": "1"
  }

• 樣本六：自訂授予某個RAM使用者建立執行個體的許可權

  {
      "Version": "1",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": "amqp:CreateInstance",
              "Resource": "acs:amqp:*:$accountid:/instances/*",
          }
      ]
  }

• 樣本七：自訂授予某個RAM使用者，僅能建立鉑金版執行個體且不支援開啟公網的許可權

  {
      "Version": "1",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": "amqp:CreateInstance",
              "Resource": "acs:amqp:*:$accountid:/instances/*",
              "Condition": {
                  "StringEquals": {
                      "amqp:InstanceType": [
                          "vip"
                      ],
                      "amqp:SupportEIP": [
                          "false"
                      ]
                  }
              }
          }
      ]
  }

• 樣本八：自訂某個RAM使用者對單個執行個體的所有操作許可權

  {
      "Version": "1",
      "Statement": [
          {
              "Action": "amqp:ListInstance",
              "Resource": "acs:amqp:*:*:/instances/*",
              "Effect": "Allow"
          },
          {
              "Action": "amqp:*",
              "Resource": [
                  "acs:amqp:*:*:/instances/$instanceId",
                  "acs:amqp:*:*:/instances/$instanceId/vhosts/*"
              ],
              "Effect": "Allow"
          },
          {
              "Action": [
                  "amqp:ListStaticAccounts",
                  "amqp:FetchStaticAccount",
                  "amqp:DeleteStaticAccount"
              ],
              "Resource": "acs:amqp:*:*:/instances/$instanceId/staticAccount/*",
              "Effect": "Allow"
          }
      ]
  }