全部產品
Search

搜尋本產品

    Blockchain as a Service：Hyperledger Fabric RAM鑒權

    文件中心

    Blockchain as a Service：Hyperledger Fabric RAM鑒權

    更新時間：Jul 06, 2024

    在使用RAM帳號調用區塊鏈服務API前，需要主帳號通過建立授權策略對RAM帳號進行授權。在授權策略中，使用資源描述符（Alibaba Cloud Resource Name，ARN）指定授權資源。

    本文提供了在區塊鏈服務中通過存取控制實現團隊或者部門成員鑒權、跨帳號資源授權以及跨雲端服務授權的RAM鑒權規則。在瞭解如何使用存取控制RAM授權和訪問區塊鏈服務之前，確保您已閱讀了RAM產品文檔和RAM API 文檔。

    可授權的Hyperledger Fabric資源類型

    在進行RAM子帳號授權時，Hyperledger Fabric資源的描述方式如下：

    資源類型授權策略中的資源描述方法
    聯盟acs:baas:$regionId:$accountId:consortium/$consortiumId
    組織acs:baas:$regionId:$accountId:organization/$organizationId
    通道acs:baas:*:$accountId:channel/$channelId
    鏈碼acs:baas:*:$accountId:chaincode/$chaincodeId

    其中，$regionId為具體資源所在的region。$accountId為具體資源屬主的阿里雲雲帳號Id。$consortiumId/$organizationId/$channelId/$chaincodeId為具體資源在區塊鏈服務中的資源Id。

    說明 通道和鏈碼屬於全域資源，region必須為“*”。

    可授權的Hyperledger Fabric介面

    下表列舉了Hyperledger Fabric區塊鏈中預設授權的API（子帳號以及STS Token持有人預設擁有許可權）：

    API
    CheckFabricConsortiumDomain
    CheckFabricOrganizationDomain
    DescribeTasks
    DescribeRootDomain
    DescribeFabricConsortiumConfig
    DescribeFabricConsortiumSpecs
    DescribeFabricOrganizationSpecs
    DescribeFabricInviter
    DescribeFabricChaincodeUploadPolicy
    AcceptFabricInvitation

    下表列舉了Hyperledger Fabric中可授權的API及其描述方式：

    API資源描述
    CreateFabricOrganizationacs:baas:$regionId:$accountId:organization/*
    DescribeFabricOrganizationacs:baas:$regionId:$accountId:organization/$organizationId
    DescribeFabricOrganizationDeletableacs:baas:$regionId:$accountId:organization/$organizationId
    DescribeFabricOrganizationsacs:baas:*:$accountId:organization/*
    DescribeFabricCandidateOrganizationsacs:baas:*:$accountId:organization/*
    CreateFabricChannelacs:baas:*:$accountId:channel/*

    acs:baas:$regionId:$accountId:consortium/$consortiumId

    DescribeFabricOrganizationChannelsacs:baas:$regionId:$accountId:organization/$organizationId
    DescribeFabricConsortiumChannelsacs:baas:$regionId:$accountId:consortium/$consortiumId
    CreateFabricChannelMemberacs:baas:*:$accountId:channel/$channelId
    DescribeFabricChannelMembersacs:baas:*:$accountId:channel/$channelId
    JoinFabricChannelacs:baas:*:$accountId:channel/$channelId
    CreateFabricConsortiumacs:baas:$regionId:$accountId:consortium/*
    CreateFabricConsortiumMemberacs:baas:$regionId:$accountId:consortium/$consortiumId
    ConfirmFabricConsortiumMemberacs:baas:$regionId:$accountId:consortium/$consortiumId
    DescribeFabricOrganizationMembersacs:baas:$regionId:$accountId:organization/$organizationId
    DescribeFabricOrganizationPeersacs:baas:$regionId:$accountId:organization/$organizationId
    DescribeFabricConsortiumsacs:baas:*:$accountId:consortium/*
    DescribeFabricConsortiumAdminStatusacs:baas:*:$accountId:consortium/*
    DescribeFabricConsortiumMembersacs:baas:$regionId:$accountId:consortium/$consortiumId
    DescribeFabricConsortiumMemberApprovalacs:baas:$regionId:$accountId:consortium/$consortiumId
    DescribeFabricConsortiumOrderersacs:baas:$regionId:$accountId:consortium/$consortiumId
    DescribeFabricConsortiumDeletableacs:baas:$regionId:$accountId:consortium/$consortiumId
    CreateFabricChaincodeacs:baas:*:$accountId:chaincode/*

    acs:baas:*:$accountId:channel/$channelId

    acs:baas:$regionId:$accountId:consortium/$consortiumId

    acs:baas:$regionId:$accountId:organization/$organizationId

    DescribeFabricOrganizationChaincodesacs:baas:$regionId:$accountId:organization/$organizationId
    DescribeFabricConsortiumChaincodesacs:baas:$regionId:$accountId:consortium/$consortiumId
    DeleteFabricChaincodeacs:baas:*:$accountId:chaincode/$chaincodeId
    InstallFabricChaincodeacs:baas:*:$accountId:chaincode/$chaincodeId

    acs:baas:$regionId:$accountId:organization/$organizationId

    InstantiateFabricChaincodeacs:baas:*:$accountId:chaincode/$chaincodeId

    acs:baas:$regionId:$accountId:organization/$organizationId

    UpgradeFabricChaincodeacs:baas:*:$accountId:chaincode/$chaincodeId

    acs:baas:$regionId:$accountId:organization/$organizationId

    SynchronizeFabricChaincodeacs:baas:*:$accountId:chaincode/$chaincodeId

    acs:baas:$regionId:$accountId:organization/$organizationId

    CreateFabricOrganizationUseracs:baas:$regionId:$accountId:organization/$organizationId
    DescribeFabricOrganizationUsersacs:baas:$regionId:$accountId:organization/$organizationId
    ResetFabricOrganizationUserPasswordacs:baas:$regionId:$accountId:organization/$organizationId
    DownloadFabricOrganizationSDKacs:baas:$regionId:$accountId:organization/$organizationId
    DescribeFabricInvitationCodeacs:baas:$regionId:$accountId:consortium/$consortiumId

    Hyperledger Fabric RAM規則樣本

    例1 ：授權BaaS服務唯讀類操作。這種類型的許可權能夠允許使用者通過控制台或API查看區塊鏈狀態，下載SDK。

    {
   "Statement": [{ 
       "Action": ["baas:Describe*","baas:DownloadFabricOrganizationSDK"],
       "Effect": "Allow",
       "Resource": "acs:baas:*:*:*"
   }],
   "Version": "1"
}
    例2：授權鏈碼管理類操作（上傳、安裝、執行個體化等等）。這種類型的許可權允許使用者通過控制台或API管理所有鏈碼。 
    {
  "Statement": [{
     "Action": "baas:*Chaincode",
     "Effect": "Allow",
     "Resource": ["acs:baas:*:*:chaincode/*","acs:baas:*:*:organization/*", "acs:baas:*:*:consortium/*","acs:baas:*:*:channel/*"]
  }],
  "Version": "1"
}

    例3：更精細化的鏈碼開發人員授權。該許可權通常需要全部的讀類型操作，以及特定組織的鏈碼管理類操作。按照最小許可權原則，需要限制該使用者僅能建立用於指定聯盟、組織、通道的鏈碼，也只能在特定組織上進行鏈碼的安裝、執行個體化等操作。將下面的$consortiumId/$organizationId/$channelId替換為具體資源在區塊鏈服務中的資源Id。

    {
 "Statement": [{
   "Action": ["baas:Describe*","baas:DownloadFabricOrganizationSDK"],
   "Effect": "Allow",
   "Resource": "acs:baas:*:*:*"
 },
 {
   "Action": "baas:*Chaincode",
   "Effect": "Allow",
   "Resource": ["acs:baas:*:*:chaincode/*","acs:baas:*:*:organization/$organizationId","acs:baas:*:*:consortium/$consortiumId","acs:baas:*:*:channel/$channelId"]
 }],
 "Version": "1"
}