CDN：使用資源群組進行精細化資源控制-最新

資源群組授權的工作原理

您可以使用資源群組（Resource Group）對阿里雲帳號內的資源進行分組管理。例如，為不同的專案建立對應的資源群組，並將資源轉移到對應的組中，以便集中管理各專案的資源。更多資訊，請參見什麼是資源群組。

在完成資源分組後，您可以為不同的RAM授權主體（RAM使用者、RAM使用者組或RAM角色）授予指定資源群組範圍的許可權，從而限定這個授權主體只能管理該資源群組內的資源。更多資訊，請參見資源分組和授權。

這種授權方式的優點有：

• 許可權精細化：確保每個身份能獲得最準確的資源存取權限，避免帳號下的多重專案的資源混合管理。

• 良好的擴充性：後續新增資源時，只需將其加入該資源群組，RAM身份便會自動獲得新資源的相應許可權，無需再次授權。

為RAM使用者授予資源群組層級的許可權

下面以RAM使用者為例，介紹授予指定資源群組內CDN資源許可權的操作步驟。

支援資源群組的資源類型

CDN支援資源群組的資源類型如下表所示：

不支援資源群組層級授權的操作

CDN中不支援資源群組層級授權的操作（Action）如下：

對於不支援資源群組授權的操作，授權時資源範圍選取資源群組層級將無效。如果仍需要RAM使用者有上述操作許可權，您需要建立自訂權限原則，授權時資源範圍選取帳號層級。

以下是兩個自訂權限原則樣本，您可以根據實際需要調整策略內容。

• 允許不支援資源群組層級授權的全部唯讀操作：Action中列舉不支援資源群組層級授權的所有隻讀操作。

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "cdn:BatchDescribeCdnIpInfo",
          "cdn:BatchDescribeDomainMd5Info",
          "cdn:CheckDomainBeiAnExpiration",
          "cdn:CreateCdnComputeDomain",
          "cdn:DeleteRealTimeLogLogstore",
          "cdn:DescribeActiveConfigGroupVersion",
          "cdn:DescribeBlockedRegions",
          "cdn:DescribeCdnCcSignatureArgList",
          "cdn:DescribeCdnCcSignatureObjectList",
          "cdn:DescribeCdnCertificateDetail",
          "cdn:DescribeCdnCertificateDetailById",
          "cdn:DescribeCdnComputeUserDomain",
          "cdn:DescribeCdnConditionIPBInfo",
          "cdn:DescribeCdnDeletedDomains",
          "cdn:DescribeCdnDeliverList",
          "cdn:DescribeCdnDiagnoseReport",
          "cdn:DescribeCdnDomainByCertificate",
          "cdn:DescribeCdnFullDomainsBlockIPConfig",
          "cdn:DescribeCdnFullDomainsBlockIPHistory",
          "cdn:DescribeCdnHttpsDomainList",
          "cdn:DescribeCdnIpCidr",
          "cdn:DescribeCdnMonitorData",
          "cdn:DescribeCdnOrderCommodityCode",
          "cdn:DescribeCdnRegionAndIsp",
          "cdn:DescribeCdnReportList",
          "cdn:DescribeCdnSMCertificateDetail",
          "cdn:DescribeCdnSecFuncInfo",
          "cdn:DescribeCdnService",
          "cdn:DescribeCdnSubList",
          "cdn:DescribeCdnTypes",
          "cdn:DescribeCdnUserAppSecDrop",
          "cdn:DescribeCdnUserBillHistory",
          "cdn:DescribeCdnUserBillPrediction",
          "cdn:DescribeCdnUserBillType",
          "cdn:DescribeCdnUserConfigs",
          "cdn:DescribeCdnUserQuota",
          "cdn:DescribeCdnUserResourcePackage",
          "cdn:DescribeCdnUserSecDrop",
          "cdn:DescribeCertificateInfoByID",
          "cdn:DescribeConfigGroupDetail",
          "cdn:DescribeConfigGroupVersion",
          "cdn:DescribeCustomLogConfig",
          "cdn:DescribeDomainConfigs",
          "cdn:DescribeDomainMd5Info",
          "cdn:DescribeDomainSrcFlowData",
          "cdn:DescribeDomainVerifyData",
          "cdn:DescribeDomainsBySource",
          "cdn:DescribeEsExceptionData",
          "cdn:DescribeEsExecuteData",
          "cdn:DescribeFCTrigger",
          "cdn:DescribeGifshowView",
          "cdn:DescribeIpInfo",
          "cdn:DescribeIpStatus",
          "cdn:DescribeLiveStreamOnlineUserNum",
          "cdn:DescribeLiveStreamPushData",
          "cdn:DescribeLiveStreamRecordIndexFile",
          "cdn:DescribeLiveStreamRecordIndexFiles",
          "cdn:DescribeLiveStreamSnapshotInfo",
          "cdn:DescribeLiveStreamTranscodeStreamNum",
          "cdn:DescribeLiveStreamsFrameRateAndBitRateData",
          "cdn:DescribeLiveStreamsOnlineList",
          "cdn:DescribePreloadDetailById",
          "cdn:DescribeRealtimeDeliveryAcc",
          "cdn:DescribeRealtimeLogAuthorized",
          "cdn:DescribeRefreshQuota",
          "cdn:DescribeRefreshTaskById",
          "cdn:DescribeSinaUidsBlockData",
          "cdn:DescribeSnMultiLive",
          "cdn:DescribeStagingIp",
          "cdn:DescribeTopDomainsByFlow",
          "cdn:DescribeUserCdnStatus",
          "cdn:DescribeUserCdncomputeStatus",
          "cdn:DescribeUserCertificateExpireCount",
          "cdn:DescribeUserConfigs",
          "cdn:DescribeUserTags",
          "cdn:DescribeUserUsageDataExportTask",
          "cdn:DescribeUserUsageDetailDataExportTask",
          "cdn:DescribeVerifyContent",
          "cdn:DescribeVersionConfig",
          "cdn:DescribeVersionConfigForDiff",
          "cdn:DescribeViewUsedTraf",
          "cdn:GenerateCdnDiagnose",
          "cdn:HttpRequestStagingTest",
          "cdn:HttpRequestTestTool",
          "cdn:ListConfigGroupActivateRecords",
          "cdn:ListConfigGroupVersionDomains",
          "cdn:ListConfigGroupVersions",
          "cdn:ListConfigGroups",
          "cdn:ListDomainsByLogConfigId",
          "cdn:ListEsTemplateInfo",
          "cdn:ListFCTrigger",
          "cdn:ListRealtimeLogDelivery",
          "cdn:ListRealtimeLogDeliveryInfos",
          "cdn:ListUserCustomLogConfig",
          "cdn:ModifyBlockSinaUids",
          "cdn:ModifyRefererBlockData",
          "cdn:NotifyDomainBeiAnExpiration",
          "cdn:PenaliseDomainBeiAnExpiration",
          "cdn:VerifyDomainOwner"
        ],
        "Resource": "*"
      }
    ]
  }
  

• 允許不支援資源群組層級授權的全部操作：Action中列舉不支援資源群組層級授權的全部操作。

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "cdn:ActivateConfigGroupVersion",
          "cdn:AddConfigGroup",
          "cdn:AddFCTrigger",
          "cdn:AddLivePullStreamInfo",
          "cdn:AdvancePurgeObjectCache",
          "cdn:BatchDescribeCdnIpInfo",
          "cdn:BatchDescribeDomainMd5Info",
          "cdn:CdnMigrateRegister",
          "cdn:ChangeCdnDomainToDcdn",
          "cdn:CheckDomainBeiAnExpiration",
          "cdn:CloneConfigGroupVersion",
          "cdn:CreateCdnCertificateSigningRequest",
          "cdn:CreateCdnComputeDomain",
          "cdn:CreateCdnbag",
          "cdn:CreateLiveStreamRecordIndexFiles",
          "cdn:CreateUserUsageDataExportTask",
          "cdn:DeactivateConfigGroupVersion",
          "cdn:DeleteCdnDeliverTask",
          "cdn:DeleteCdnSubTask",
          "cdn:DeleteConfigGroup",
          "cdn:DeleteConfigGroupVersion",
          "cdn:DeleteFCTrigger",
          "cdn:DeleteLivePullStreamInfo",
          "cdn:DeleteRealTimeLogLogstore",
          "cdn:DeleteUsageDetailDataExportTask",
          "cdn:DeleteUserUsageDataExportTask",
          "cdn:DeleteVersionConfig",
          "cdn:DescribeActiveConfigGroupVersion",
          "cdn:DescribeBlockedRegions",
          "cdn:DescribeCdnCcSignatureArgList",
          "cdn:DescribeCdnCcSignatureObjectList",
          "cdn:DescribeCdnCertificateDetail",
          "cdn:DescribeCdnCertificateDetailById",
          "cdn:DescribeCdnComputeUserDomain",
          "cdn:DescribeCdnConditionIPBInfo",
          "cdn:DescribeCdnDeletedDomains",
          "cdn:DescribeCdnDeliverList",
          "cdn:DescribeCdnDiagnoseReport",
          "cdn:DescribeCdnDomainByCertificate",
          "cdn:DescribeCdnFullDomainsBlockIPConfig",
          "cdn:DescribeCdnFullDomainsBlockIPHistory",
          "cdn:DescribeCdnHttpsDomainList",
          "cdn:DescribeCdnIpCidr",
          "cdn:DescribeCdnMonitorData",
          "cdn:DescribeCdnOrderCommodityCode",
          "cdn:DescribeCdnRegionAndIsp",
          "cdn:DescribeCdnReportList",
          "cdn:DescribeCdnSMCertificateDetail",
          "cdn:DescribeCdnSecFuncInfo",
          "cdn:DescribeCdnService",
          "cdn:DescribeCdnSubList",
          "cdn:DescribeCdnTypes",
          "cdn:DescribeCdnUserAppSecDrop",
          "cdn:DescribeCdnUserBillHistory",
          "cdn:DescribeCdnUserBillPrediction",
          "cdn:DescribeCdnUserBillType",
          "cdn:DescribeCdnUserConfigs",
          "cdn:DescribeCdnUserQuota",
          "cdn:DescribeCdnUserResourcePackage",
          "cdn:DescribeCdnUserSecDrop",
          "cdn:DescribeCertificateInfoByID",
          "cdn:DescribeConfigGroupDetail",
          "cdn:DescribeConfigGroupVersion",
          "cdn:DescribeCustomDomainSampleRate",
          "cdn:DescribeCustomLogConfig",
          "cdn:DescribeDomainConfigs",
          "cdn:DescribeDomainISPLocationDetailData",
          "cdn:DescribeDomainMd5Info",
          "cdn:DescribeDomainSrcFlowData",
          "cdn:DescribeDomainVerifyData",
          "cdn:DescribeDomainsBySource",
          "cdn:DescribeEsExceptionData",
          "cdn:DescribeEsExecuteData",
          "cdn:DescribeFCTrigger",
          "cdn:DescribeGifshowView",
          "cdn:DescribeIpInfo",
          "cdn:DescribeIpStatus",
          "cdn:DescribeLiveStreamOnlineUserNum",
          "cdn:DescribeLiveStreamPushData",
          "cdn:DescribeLiveStreamRecordIndexFile",
          "cdn:DescribeLiveStreamRecordIndexFiles",
          "cdn:DescribeLiveStreamSnapshotInfo",
          "cdn:DescribeLiveStreamTranscodeStreamNum",
          "cdn:DescribeLiveStreamsFrameRateAndBitRateData",
          "cdn:DescribeLiveStreamsOnlineList",
          "cdn:DescribePreloadDetailById",
          "cdn:DescribeRealtimeDeliveryAcc",
          "cdn:DescribeRealtimeLogAuthorized",
          "cdn:DescribeRefreshQuota",
          "cdn:DescribeRefreshTaskById",
          "cdn:DescribeSinaUidsBlockData",
          "cdn:DescribeSnMultiLive",
          "cdn:DescribeStagingIp",
          "cdn:DescribeTopDomainsByFlow",
          "cdn:DescribeUserCdnStatus",
          "cdn:DescribeUserCdncomputeStatus",
          "cdn:DescribeUserCertificateExpireCount",
          "cdn:DescribeUserConfigs",
          "cdn:DescribeUserTags",
          "cdn:DescribeUserUsageDataExportTask",
          "cdn:DescribeUserUsageDetailDataExportTask",
          "cdn:DescribeVerifyContent",
          "cdn:DescribeVersionConfig",
          "cdn:DescribeVersionConfigForDiff",
          "cdn:DescribeViewUsedTraf",
          "cdn:ForbidLiveStream",
          "cdn:GenerateCdnDiagnose",
          "cdn:GetCancelPreloadTask",
          "cdn:HttpRequestStagingTest",
          "cdn:HttpRequestTestTool",
          "cdn:ListConfigGroupActivateRecords",
          "cdn:ListConfigGroupVersionDomains",
          "cdn:ListConfigGroupVersions",
          "cdn:ListConfigGroups",
          "cdn:ListDomainsByLogConfigId",
          "cdn:ListEsTemplateInfo",
          "cdn:ListFCTrigger",
          "cdn:ListRealtimeLogDelivery",
          "cdn:ListRealtimeLogDeliveryDomains",
          "cdn:ListRealtimeLogDeliveryInfos",
          "cdn:ListUserCustomLogConfig",
          "cdn:ModifyBlockSinaUids",
          "cdn:ModifyByteUrlBlockData",
          "cdn:ModifyCdnDomainOwner",
          "cdn:ModifyCdnService",
          "cdn:ModifyConfigGroup",
          "cdn:ModifyConfigGroupVersion",
          "cdn:ModifyCustomDomainSampleRate",
          "cdn:ModifyRefererBlockData",
          "cdn:NotifyDomainBeiAnExpiration",
          "cdn:OpenCdnService",
          "cdn:PenaliseDomainBeiAnExpiration",
          "cdn:RefreshObjectCacheByCacheTag",
          "cdn:ResumeLiveStream",
          "cdn:SetCdnDomainSMCertificate",
          "cdn:SetCdnFullDomainsBlockIP",
          "cdn:SetCdnUserConfig",
          "cdn:SetForceRedirectConfig",
          "cdn:SetHttpHeaderConfig",
          "cdn:SetHttpsOptionConfig",
          "cdn:SetIgnoreQueryStringConfig",
          "cdn:SetIpAllowListConfig",
          "cdn:SetIpBlackListConfig",
          "cdn:SetOptimizeConfig",
          "cdn:SetPageCompressConfig",
          "cdn:SetPathCacheExpiredConfig",
          "cdn:SetRemoteReqAuthConfig",
          "cdn:SetReqAuthConfig",
          "cdn:SetReqHeaderConfig",
          "cdn:SetSnMultiLive",
          "cdn:SetSnMultiLiveDomainConf",
          "cdn:SetSourceHostConfig",
          "cdn:SetVersionConfig",
          "cdn:SetWaitingRoomConfig",
          "cdn:StopPreload",
          "cdn:UpdateCdnDeliverTask",
          "cdn:UpdateFCTrigger",
          "cdn:VerifyDomainOwner",
          "cdn:describeRefreshTasks",
          "cdn:describeUserDomains",
          "cdn:describeVerifyContent",
          "cdn:describedomainsrcqpsdata",
          "cdn:verifyDomainOwner"
        ],
        "Resource": "*"
      }
    ]
  }
  

常見問題