Cloud Architect Design Tools：使用資源群組進行精細化資源控制-最新

資源群組授權的工作原理

您可以使用資源群組（Resource Group）對阿里雲帳號內的資源進行分組管理。例如，為不同的專案建立對應的資源群組，並將資源轉移到對應的組中，以便集中管理各專案的資源。更多資訊，請參見什麼是資源群組。

在完成資源分組後，您可以為不同的RAM授權主體（RAM使用者、RAM使用者組或RAM角色）授予指定資源群組範圍的許可權，從而限定這個授權主體只能管理該資源群組內的資源。更多資訊，請參見資源分組和授權。

這種授權方式的優點有：

• 許可權精細化：確保每個身份能獲得最準確的資源存取權限，避免帳號下的多重專案的資源混合管理。

• 良好的擴充性：後續新增資源時，只需將其加入該資源群組，RAM身份便會自動獲得新資源的相應許可權，無需再次授權。

為RAM使用者授予資源群組層級的許可權

下面以RAM使用者為例，介紹授予指定資源群組內雲速搭CADT資源許可權的操作步驟。

支援資源群組的資源類型

雲速搭CADT支援資源群組的資源類型如下表所示：

不支援資源群組層級授權的操作

雲速搭CADT中不支援資源群組層級授權的操作（Action）如下：

對於不支援資源群組授權的操作，授權時資源範圍選取資源群組層級將無效。如果仍需要RAM使用者有上述操作許可權，您需要建立自訂權限原則，授權時資源範圍選取帳號層級。

以下是兩個自訂權限原則樣本，您可以根據實際需要調整策略內容。

• 允許不支援資源群組層級授權的全部唯讀操作：Action中列舉不支援資源群組層級授權的所有隻讀操作。

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "bpstudio:AddResource2FoPlan",
          "bpstudio:AddTemplateVariable",
          "bpstudio:AddUserPreferenceData",
          "bpstudio:ApplyPortalTemplateDeploy",
          "bpstudio:AttachActivity",
          "bpstudio:AttachCoupon",
          "bpstudio:AutoAddApplication",
          "bpstudio:CancelMonitorApp",
          "bpstudio:ChangeTemplate",
          "bpstudio:CheckOneClickOrder",
          "bpstudio:CloneTemplate",
          "bpstudio:CopyTemplateVariables",
          "bpstudio:CreateExploreJob",
          "bpstudio:CreateExploreTopology",
          "bpstudio:CreateMonitorNS",
          "bpstudio:CreateOneClickOrder",
          "bpstudio:CreateProbeOneClick",
          "bpstudio:DeleteAlertContact",
          "bpstudio:DeleteAlertRule",
          "bpstudio:DeleteAlertTemplate",
          "bpstudio:DeleteMonitorAppHistory",
          "bpstudio:DeleteResourceInFoPlan",
          "bpstudio:DeleteTemplateVariable",
          "bpstudio:DescribeResourceInFoPlan",
          "bpstudio:DetectApp",
          "bpstudio:ExportFile",
          "bpstudio:GetAiUsageStats",
          "bpstudio:GetAlertTaskStatus",
          "bpstudio:GetAlertTemplate",
          "bpstudio:GetAppAlarmList",
          "bpstudio:GetAppInputParams",
          "bpstudio:GetApplicationDetail",
          "bpstudio:GetApplicationVariables",
          "bpstudio:GetApplicationVariables4Fail",
          "bpstudio:GetDetectResult",
          "bpstudio:GetDrService",
          "bpstudio:GetEditorType",
          "bpstudio:GetExploreCIofTypes",
          "bpstudio:GetExploreJobStatus",
          "bpstudio:GetExploreReport",
          "bpstudio:GetExploreResourceSummary",
          "bpstudio:GetExploreTopologyResult",
          "bpstudio:GetExportReportResult",
          "bpstudio:GetFlowInputParams",
          "bpstudio:GetFoAppStatus",
          "bpstudio:GetFoTaskStatus",
          "bpstudio:GetGeneratedAppInfo",
          "bpstudio:GetGroupMonitorData",
          "bpstudio:GetInitFoImages",
          "bpstudio:GetLatestResourceInformation",
          "bpstudio:GetLinkageAttributesTemplate",
          "bpstudio:GetMonitorAppHistory",
          "bpstudio:GetMonitorApps",
          "bpstudio:GetMonitorDataById",
          "bpstudio:GetMonitorDataList",
          "bpstudio:GetMonitorInstanceLogInfo",
          "bpstudio:GetMonitorMetrics",
          "bpstudio:GetMonitorNS",
          "bpstudio:GetMonitorParentApp",
          "bpstudio:GetMonitorServiceMetrics",
          "bpstudio:GetMonitorSubApps",
          "bpstudio:GetMonitorSubResource",
          "bpstudio:GetOrderAttributes",
          "bpstudio:GetParentApp",
          "bpstudio:GetPolicyInPlan",
          "bpstudio:GetPortalApiReportASync",
          "bpstudio:GetPortalTemplateDeploy",
          "bpstudio:GetPotentialFailZones",
          "bpstudio:GetProbeOneClick",
          "bpstudio:GetProcessApps",
          "bpstudio:GetProcessInOutParams",
          "bpstudio:GetProcessInputParams",
          "bpstudio:GetProcessOutputParams",
          "bpstudio:GetProcessShareUsers",
          "bpstudio:GetResource",
          "bpstudio:GetResource4ModifyRecord",
          "bpstudio:GetResult4QueryInstancePrice4Modify",
          "bpstudio:GetSaeSpec",
          "bpstudio:GetSaeTaskData",
          "bpstudio:GetServerMessage",
          "bpstudio:GetServerlessAttribute",
          "bpstudio:GetSingleAzResources",
          "bpstudio:GetSubAppStatus",
          "bpstudio:GetSubApps",
          "bpstudio:GetTask",
          "bpstudio:GetTaskInputParams",
          "bpstudio:GetTaskNodeStatus",
          "bpstudio:GetTemplateInputParams",
          "bpstudio:GetToolsTask",
          "bpstudio:GetUserPreferenceData",
          "bpstudio:GrantGroup",
          "bpstudio:HasMonitorData",
          "bpstudio:InitFailOver",
          "bpstudio:ListActivity",
          "bpstudio:ListAlertContactGroup",
          "bpstudio:ListAlertRules",
          "bpstudio:ListAllOperations",
          "bpstudio:ListAllProcess",
          "bpstudio:ListAppBindingProcess",
          "bpstudio:ListAuthorization",
          "bpstudio:ListBindingRefIds",
          "bpstudio:ListBpmApps",
          "bpstudio:ListBpmInstances",
          "bpstudio:ListCloudClient",
          "bpstudio:ListCloudProviderRegions",
          "bpstudio:ListCloudProviders",
          "bpstudio:ListExploreProjects",
          "bpstudio:ListExploreRegions",
          "bpstudio:ListExploreTypes",
          "bpstudio:ListExportTags",
          "bpstudio:ListFoCreatedApps",
          "bpstudio:ListFoPlanResources",
          "bpstudio:ListFoPlans",
          "bpstudio:ListFoRunningApps",
          "bpstudio:ListMessage",
          "bpstudio:ListMonitorRunningApps",
          "bpstudio:ListOperations",
          "bpstudio:ListOperationsDetails",
          "bpstudio:ListPortalApplication",
          "bpstudio:ListPortalResources",
          "bpstudio:ListPortalTemplate",
          "bpstudio:ListPortalTemplateVariables",
          "bpstudio:ListProcessResources",
          "bpstudio:ListProcessVariables",
          "bpstudio:ListProcesses",
          "bpstudio:ListPublicProcesses",
          "bpstudio:ListResourceGroups",
          "bpstudio:ListResources",
          "bpstudio:ListSession",
          "bpstudio:ListTagResources",
          "bpstudio:ListTasks",
          "bpstudio:ListTasksByAppId",
          "bpstudio:ListTemplateBindingProcess",
          "bpstudio:ListTemplateConfig",
          "bpstudio:ListTemplateProcessResources",
          "bpstudio:ListTemplateVariables",
          "bpstudio:PasswordOperation",
          "bpstudio:PlanFailBack",
          "bpstudio:PlanFailOver",
          "bpstudio:PrepareFoPlanResources",
          "bpstudio:PrepareMonitorApp",
          "bpstudio:QueryInstancePrice4Modify",
          "bpstudio:QueryInstanceSpec4Modify",
          "bpstudio:QueryMonitorScreen",
          "bpstudio:QueryTemplateNodeInfo",
          "bpstudio:RefreshResourcesInFoPlan",
          "bpstudio:RegisterCloudClient",
          "bpstudio:RemoveFoPlanResources",
          "bpstudio:StartAlertApp",
          "bpstudio:SyncTemplateVariable",
          "bpstudio:UpdateMessage",
          "bpstudio:UpdatePolicyInPlan",
          "bpstudio:UpdateSeqInFoPlan"
        ],
        "Resource": "*"
      }
    ]
  }
  

• 允許不支援資源群組層級授權的全部操作：Action中列舉不支援資源群組層級授權的全部操作。

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "bpstudio:AddAlertContact",
          "bpstudio:AddCompositeAlertRule",
          "bpstudio:AddEditorType",
          "bpstudio:AddProcessVariable",
          "bpstudio:AddResource2FoPlan",
          "bpstudio:AddResourceGroup",
          "bpstudio:AddSnapshotDescription",
          "bpstudio:AddTemplateVariable",
          "bpstudio:AddUserPreferenceData",
          "bpstudio:AppBindingInputParams",
          "bpstudio:AppBindingProcess",
          "bpstudio:AppChangeBindingResources",
          "bpstudio:AppFailBack",
          "bpstudio:AppFailOver",
          "bpstudio:AppUnbindingProcess",
          "bpstudio:ApplyPortalTemplateDeploy",
          "bpstudio:AttachActivity",
          "bpstudio:AttachCoupon",
          "bpstudio:AutoAddApplication",
          "bpstudio:CancelMonitorApp",
          "bpstudio:ChangeResourceGroup",
          "bpstudio:ChangeTemplate",
          "bpstudio:CheckOneClickOrder",
          "bpstudio:CloneApp",
          "bpstudio:ClonePrivateProcess",
          "bpstudio:CloneTemplate",
          "bpstudio:CloneTemplateVariables",
          "bpstudio:CopyTemplateVariables",
          "bpstudio:CreateExploreJob",
          "bpstudio:CreateExploreTopology",
          "bpstudio:CreateMigrateJob",
          "bpstudio:CreateMonitorNS",
          "bpstudio:CreateOneClickOrder",
          "bpstudio:CreateProbeOneClick",
          "bpstudio:CreateProbeTopology",
          "bpstudio:CreateTask",
          "bpstudio:DeleteAlertContact",
          "bpstudio:DeleteAlertContactGroup",
          "bpstudio:DeleteAlertRule",
          "bpstudio:DeleteAlertTemplate",
          "bpstudio:DeleteFoPlan",
          "bpstudio:DeleteMigrateJob",
          "bpstudio:DeleteMonitorAppHistory",
          "bpstudio:DeleteMonitorNS",
          "bpstudio:DeleteProcess",
          "bpstudio:DeleteProcessVariable",
          "bpstudio:DeleteResourceGroup",
          "bpstudio:DeleteResourceInFoPlan",
          "bpstudio:DeleteTemplateVariable",
          "bpstudio:DeployOneClickOrder",
          "bpstudio:DescribeResourceInFoPlan",
          "bpstudio:DetectApp",
          "bpstudio:DetectAppStatus",
          "bpstudio:ExecuteProcess",
          "bpstudio:ExecuteTask",
          "bpstudio:ExportFile",
          "bpstudio:ExportYml",
          "bpstudio:GenerateAppFromScript",
          "bpstudio:GenerateProbeAnalysisReport",
          "bpstudio:GenerateSubTopo",
          "bpstudio:GetAiUsageStats",
          "bpstudio:GetAlertTaskStatus",
          "bpstudio:GetAlertTemplate",
          "bpstudio:GetAppAlarmList",
          "bpstudio:GetAppInputParams",
          "bpstudio:GetApplicationDetail",
          "bpstudio:GetApplicationVariables",
          "bpstudio:GetApplicationVariables4Fail",
          "bpstudio:GetDesignPptTemplate",
          "bpstudio:GetDetectResult",
          "bpstudio:GetDrService",
          "bpstudio:GetEditorType",
          "bpstudio:GetExploreCIofTypes",
          "bpstudio:GetExploreJobStatus",
          "bpstudio:GetExploreReport",
          "bpstudio:GetExploreResourceSummary",
          "bpstudio:GetExploreTopologyResult",
          "bpstudio:GetExportReportResult",
          "bpstudio:GetFlowInputParams",
          "bpstudio:GetFoAppStatus",
          "bpstudio:GetFoTaskStatus",
          "bpstudio:GetGeneratedAppInfo",
          "bpstudio:GetGroupMonitorData",
          "bpstudio:GetInitFoImages",
          "bpstudio:GetLastProbeTime",
          "bpstudio:GetLatestResourceInformation",
          "bpstudio:GetLinkageAttributesTemplate",
          "bpstudio:GetMigrateJob",
          "bpstudio:GetMigrateNetwork",
          "bpstudio:GetMigrateResourceTypes",
          "bpstudio:GetMigrateResources",
          "bpstudio:GetMonitorAppHistory",
          "bpstudio:GetMonitorApps",
          "bpstudio:GetMonitorDataById",
          "bpstudio:GetMonitorDataList",
          "bpstudio:GetMonitorInstanceLogInfo",
          "bpstudio:GetMonitorMetrics",
          "bpstudio:GetMonitorNS",
          "bpstudio:GetMonitorParentApp",
          "bpstudio:GetMonitorServiceMetrics",
          "bpstudio:GetMonitorSubApps",
          "bpstudio:GetMonitorSubResource",
          "bpstudio:GetOrderAttributes",
          "bpstudio:GetParentApp",
          "bpstudio:GetPolicyInPlan",
          "bpstudio:GetPortalApiReportASync",
          "bpstudio:GetPortalTemplateDeploy",
          "bpstudio:GetPotentialFailZones",
          "bpstudio:GetProbeAllTopology",
          "bpstudio:GetProbeCiDetails",
          "bpstudio:GetProbeCiInRegion",
          "bpstudio:GetProbeCiInVpc",
          "bpstudio:GetProbeCiInZone",
          "bpstudio:GetProbeCiOfTypes",
          "bpstudio:GetProbeCiRegions",
          "bpstudio:GetProbeCiTypes",
          "bpstudio:GetProbeCiTypesInRegion",
          "bpstudio:GetProbeCiTypesInVpc",
          "bpstudio:GetProbeCiTypesInZone",
          "bpstudio:GetProbeGlobalCI",
          "bpstudio:GetProbeGlobalCITypes",
          "bpstudio:GetProbeJobStatus",
          "bpstudio:GetProbeOneClick",
          "bpstudio:GetProbeRegions",
          "bpstudio:GetProbeResourceSummary",
          "bpstudio:GetProbeTagKeys",
          "bpstudio:GetProbeTagValues",
          "bpstudio:GetProbeTopologyParameters",
          "bpstudio:GetProbeTopologyResult",
          "bpstudio:GetProbeVpcInRegion",
          "bpstudio:GetProbeZoneInVpc",
          "bpstudio:GetProcessApps",
          "bpstudio:GetProcessInOutParams",
          "bpstudio:GetProcessInputParams",
          "bpstudio:GetProcessOutputParams",
          "bpstudio:GetProcessShareUsers",
          "bpstudio:GetResource",
          "bpstudio:GetResource4ModifyRecord",
          "bpstudio:GetResourceMigratePolicy",
          "bpstudio:GetResult4QueryInstancePrice4Modify",
          "bpstudio:GetSaeSpec",
          "bpstudio:GetSaeTaskData",
          "bpstudio:GetServerMessage",
          "bpstudio:GetServerlessAttribute",
          "bpstudio:GetSingleAzResources",
          "bpstudio:GetSubAppStatus",
          "bpstudio:GetSubApps",
          "bpstudio:GetTask",
          "bpstudio:GetTaskInputParams",
          "bpstudio:GetTaskNodeStatus",
          "bpstudio:GetTemplateInputParams",
          "bpstudio:GetToolsTask",
          "bpstudio:GetUserPreferenceData",
          "bpstudio:GrantGroup",
          "bpstudio:HasMonitorData",
          "bpstudio:InitAppFailOver",
          "bpstudio:InitFailOver",
          "bpstudio:IsMigrateApplicationOK",
          "bpstudio:IsMigrateConfigurationOK",
          "bpstudio:IsMigrateNetworkOK",
          "bpstudio:IsMigratePrepareOK",
          "bpstudio:IsMigrateResourceOK",
          "bpstudio:ListActivity",
          "bpstudio:ListAlertContactGroup",
          "bpstudio:ListAlertRules",
          "bpstudio:ListAllOperations",
          "bpstudio:ListAllProcess",
          "bpstudio:ListAppBindingProcess",
          "bpstudio:ListAuthorization",
          "bpstudio:ListBindingRefIds",
          "bpstudio:ListBpmApps",
          "bpstudio:ListBpmInstances",
          "bpstudio:ListCloudClient",
          "bpstudio:ListCloudProviderRegions",
          "bpstudio:ListCloudProviders",
          "bpstudio:ListCrossMigrateJobs",
          "bpstudio:ListExploreProjects",
          "bpstudio:ListExploreRegions",
          "bpstudio:ListExploreTypes",
          "bpstudio:ListExportMigrateJobs",
          "bpstudio:ListExportTags",
          "bpstudio:ListFoCreatedApps",
          "bpstudio:ListFoPlanResources",
          "bpstudio:ListFoPlans",
          "bpstudio:ListFoRunningApps",
          "bpstudio:ListMessage",
          "bpstudio:ListMigrateConfigurationTasks",
          "bpstudio:ListMigrateJobs",
          "bpstudio:ListMonitorRunningApps",
          "bpstudio:ListOperations",
          "bpstudio:ListOperationsDetails",
          "bpstudio:ListPortalApplication",
          "bpstudio:ListPortalResources",
          "bpstudio:ListPortalTemplate",
          "bpstudio:ListPortalTemplateVariables",
          "bpstudio:ListPrepareMigrateTasks",
          "bpstudio:ListProbeReports",
          "bpstudio:ListProcessResources",
          "bpstudio:ListProcessVariables",
          "bpstudio:ListProcesses",
          "bpstudio:ListPublicProcesses",
          "bpstudio:ListReplicateJobs",
          "bpstudio:ListResourceGroups",
          "bpstudio:ListResources",
          "bpstudio:ListSession",
          "bpstudio:ListTagResources",
          "bpstudio:ListTasks",
          "bpstudio:ListTasksByAppId",
          "bpstudio:ListTemplateBindingProcess",
          "bpstudio:ListTemplateConfig",
          "bpstudio:ListTemplateProcessResources",
          "bpstudio:ListTemplateVariables",
          "bpstudio:ModifyApplicationSpec",
          "bpstudio:ModifyMonitorNS",
          "bpstudio:PasswordOperation",
          "bpstudio:PlanFailBack",
          "bpstudio:PlanFailOver",
          "bpstudio:PrepareFoPlanResources",
          "bpstudio:PrepareMigrateJob",
          "bpstudio:PrepareMonitorApp",
          "bpstudio:QueryInstancePrice4Modify",
          "bpstudio:QueryInstanceSpec4Modify",
          "bpstudio:QueryMonitorScreen",
          "bpstudio:QueryTemplateNodeInfo",
          "bpstudio:ReConfigApplication",
          "bpstudio:RefreshResourcesInFoPlan",
          "bpstudio:RefreshSubApp",
          "bpstudio:RegisterCloudClient",
          "bpstudio:RemoveFoPlanResources",
          "bpstudio:RepliateMigrateJob",
          "bpstudio:ResetMigratePlan",
          "bpstudio:RevokeGroup",
          "bpstudio:Save2PrivateTemplate",
          "bpstudio:SaveProcessInputParams",
          "bpstudio:SaveTaskInputParams",
          "bpstudio:ShareProcess",
          "bpstudio:StartAlertApp",
          "bpstudio:StartMigrateConfiguration",
          "bpstudio:StartProbeJob",
          "bpstudio:StartSubTopo",
          "bpstudio:StreamingChat",
          "bpstudio:SyncTemplateVariable",
          "bpstudio:TagResources",
          "bpstudio:TemplateBindingInputParams",
          "bpstudio:TemplateBindingProcess",
          "bpstudio:TemplateUnbindingProcess",
          "bpstudio:TranslateMigrateApplication",
          "bpstudio:UnregisterCloudClient",
          "bpstudio:UnshareProcess",
          "bpstudio:UntagResources",
          "bpstudio:UpdateAlertTemplate",
          "bpstudio:UpdateAlertTemplateStatus",
          "bpstudio:UpdateAppBindingProcessSeq",
          "bpstudio:UpdateAppProducts",
          "bpstudio:UpdateMessage",
          "bpstudio:UpdateMonitor",
          "bpstudio:UpdateMonitorAppHistory",
          "bpstudio:UpdatePolicyInPlan",
          "bpstudio:UpdateProbeTableFormat",
          "bpstudio:UpdateSeqInFoPlan",
          "bpstudio:UpdateTemplateConfig",
          "bpstudio:UploadResourceMigratePolicy",
          "bpstudio:ValidateTask",
          "bpstudio:null"
        ],
        "Resource": "*"
      }
    ]
  }
  

常見問題