Edge Security Acceleration：使用資源群組進行精細化資源控制-最新

資源群組授權的工作原理

您可以使用資源群組（Resource Group）對阿里雲帳號內的資源進行分組管理。例如，為不同的專案建立對應的資源群組，並將資源轉移到對應的組中，以便集中管理各專案的資源。更多資訊，請參見什麼是資源群組。

在完成資源分組後，您可以為不同的RAM授權主體（RAM使用者、RAM使用者組或RAM角色）授予指定資源群組範圍的許可權，從而限定這個授權主體只能管理該資源群組內的資源。更多資訊，請參見資源分組和授權。

這種授權方式的優點有：

• 許可權精細化：確保每個身份能獲得最準確的資源存取權限，避免帳號下的多重專案的資源混合管理。

• 良好的擴充性：後續新增資源時，只需將其加入該資源群組，RAM身份便會自動獲得新資源的相應許可權，無需再次授權。

為RAM使用者授予資源群組層級的許可權

下面以RAM使用者為例，介紹授予指定資源群組內全站加速資源許可權的操作步驟。

支援資源群組的資源類型

全站加速支援資源群組的資源類型如下表所示：

不支援資源群組層級授權的操作

全站加速中不支援資源群組層級授權的操作（Action）如下：

對於不支援資源群組授權的操作，授權時資源範圍選取資源群組層級將無效。如果仍需要RAM使用者有上述操作許可權，您需要建立自訂權限原則，授權時資源範圍選取帳號層級。

以下是兩個自訂權限原則樣本，您可以根據實際需要調整策略內容。

• 允許不支援資源群組層級授權的全部唯讀操作：Action中列舉不支援資源群組層級授權的所有隻讀操作。

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "dcdn:BatchSetRDBlockIP",
          "dcdn:CheckDcdnIpaVip",
          "dcdn:CheckDcdnProjectExist",
          "dcdn:CreateBackOriginMapping",
          "dcdn:CreateCustomScenePolicy",
          "dcdn:CreateDcdnWafGroup",
          "dcdn:CreateRegistryNamespace",
          "dcdn:CreateRegistryUser",
          "dcdn:CreateWasm",
          "dcdn:CustomScenePolicyBindObject",
          "dcdn:DcdnHttpRequestStagingTest",
          "dcdn:DcdnHttpRequestTestTool",
          "dcdn:DeleteWasm",
          "dcdn:DeleteWasmCodeRevision",
          "dcdn:DescribeApp",
          "dcdn:DescribeAppConfigs",
          "dcdn:DescribeAppState",
          "dcdn:DescribeAppTenant",
          "dcdn:DescribeAppVersion",
          "dcdn:DescribeAppVersions",
          "dcdn:DescribeApps",
          "dcdn:DescribeBackOriginAreas",
          "dcdn:DescribeCustomDomainSampleRate",
          "dcdn:DescribeCustomScenePolicies",
          "dcdn:DescribeCustomScenePolicyObject",
          "dcdn:DescribeDcdnAclFields",
          "dcdn:DescribeDcdnActivationHistory",
          "dcdn:DescribeDcdnActiveVersionOfConfigGroup",
          "dcdn:DescribeDcdnBgpBpsData",
          "dcdn:DescribeDcdnBgpTrafficData",
          "dcdn:DescribeDcdnBlockedRegions",
          "dcdn:DescribeDcdnCcSignatureArgList",
          "dcdn:DescribeDcdnCcSignatureObjectList",
          "dcdn:DescribeDcdnCertificateDetail",
          "dcdn:DescribeDcdnCertificateDetailById",
          "dcdn:DescribeDcdnConditionIPBInfo",
          "dcdn:DescribeDcdnConfigGroupDetail",
          "dcdn:DescribeDcdnConfigGroupList",
          "dcdn:DescribeDcdnConfigOfVersion",
          "dcdn:DescribeDcdnConfigOfVersionForDiff",
          "dcdn:DescribeDcdnContainerStats",
          "dcdn:DescribeDcdnDdosService",
          "dcdn:DescribeDcdnDdosSpecInfo",
          "dcdn:DescribeDcdnDeletedDomains",
          "dcdn:DescribeDcdnDeliverList",
          "dcdn:DescribeDcdnDomainByCertificate",
          "dcdn:DescribeDcdnDomainCcActivityLog",
          "dcdn:DescribeDcdnDomainMax95BpsData",
          "dcdn:DescribeDcdnDomainMd5Info",
          "dcdn:DescribeDcdnDomainNamesOfVersion",
          "dcdn:DescribeDcdnDomainVerifyData",
          "dcdn:DescribeDcdnDomainsBySource",
          "dcdn:DescribeDcdnErUsageData",
          "dcdn:DescribeDcdnFullDomainsBlockIPConfig",
          "dcdn:DescribeDcdnFullDomainsBlockIPHistory",
          "dcdn:DescribeDcdnHttpsDomainList",
          "dcdn:DescribeDcdnIpInfo",
          "dcdn:DescribeDcdnIpaDomainCidr",
          "dcdn:DescribeDcdnIpaService",
          "dcdn:DescribeDcdnKvAccount",
          "dcdn:DescribeDcdnKvAccountStatus",
          "dcdn:DescribeDcdnKvNamespace",
          "dcdn:DescribeDcdnL2Ips",
          "dcdn:DescribeDcdnL2Vips",
          "dcdn:DescribeDcdnRealTimeDeliveryField",
          "dcdn:DescribeDcdnRefreshQuota",
          "dcdn:DescribeDcdnRefreshTaskById",
          "dcdn:DescribeDcdnRegionAndIsp",
          "dcdn:DescribeDcdnReportList",
          "dcdn:DescribeDcdnResourcesProperty",
          "dcdn:DescribeDcdnSLSRealTimeLogType",
          "dcdn:DescribeDcdnSLSRealtimeLogDelivery",
          "dcdn:DescribeDcdnSMCertificateDetail",
          "dcdn:DescribeDcdnSecFuncInfo",
          "dcdn:DescribeDcdnSecSpecInfo",
          "dcdn:DescribeDcdnService",
          "dcdn:DescribeDcdnStagingIp",
          "dcdn:DescribeDcdnSubList",
          "dcdn:DescribeDcdnTopDomainsByFlow",
          "dcdn:DescribeDcdnUserBillHistory",
          "dcdn:DescribeDcdnUserBillType",
          "dcdn:DescribeDcdnUserCertificateExpireCount",
          "dcdn:DescribeDcdnUserConfigs",
          "dcdn:DescribeDcdnUserQuota",
          "dcdn:DescribeDcdnUserRealTimeDeliveryField",
          "dcdn:DescribeDcdnUserResourcePackage",
          "dcdn:DescribeDcdnUserSecDrop",
          "dcdn:DescribeDcdnUserSecDropByMinute",
          "dcdn:DescribeDcdnUserTags",
          "dcdn:DescribeDcdnVerifyContent",
          "dcdn:DescribeDcdnVersionInfo",
          "dcdn:DescribeDcdnVersionOfConfigGroup",
          "dcdn:DescribeDcdnWafBotAppKey",
          "dcdn:DescribeDcdnWafDefaultRules",
          "dcdn:DescribeDcdnWafDomains",
          "dcdn:DescribeDcdnWafFilterInfo",
          "dcdn:DescribeDcdnWafGeoInfo",
          "dcdn:DescribeDcdnWafGroup",
          "dcdn:DescribeDcdnWafGroups",
          "dcdn:DescribeDcdnWafList",
          "dcdn:DescribeDcdnWafLists",
          "dcdn:DescribeDcdnWafPolicies",
          "dcdn:DescribeDcdnWafPolicy",
          "dcdn:DescribeDcdnWafPolicyDomains",
          "dcdn:DescribeDcdnWafPolicyValidDomains",
          "dcdn:DescribeDcdnWafQuota",
          "dcdn:DescribeDcdnWafRule",
          "dcdn:DescribeDcdnWafRules",
          "dcdn:DescribeDcdnWafScenes",
          "dcdn:DescribeDcdnWafService",
          "dcdn:DescribeDcdnWafSpecInfo",
          "dcdn:DescribeDcdnsecService",
          "dcdn:DescribeDdosAllEventList",
          "dcdn:DescribeDdosBpsList",
          "dcdn:DescribeDdosBpsMax",
          "dcdn:DescribeDdosEventMax",
          "dcdn:DescribeDdosSpecialPort",
          "dcdn:DescribeEncryptRoutineUid",
          "dcdn:DescribeEsExceptionData",
          "dcdn:DescribeEsExecuteData",
          "dcdn:DescribeHighlightInfo",
          "dcdn:DescribeKVTimeoutRequestDistributionData",
          "dcdn:DescribeKvPerfData",
          "dcdn:DescribeKvRealTimeQpsData",
          "dcdn:DescribeKvUsageData",
          "dcdn:DescribeRDDomainConfig",
          "dcdn:DescribeRDDomains",
          "dcdn:DescribeRegistryNamespace",
          "dcdn:DescribeRegistryUser",
          "dcdn:DescribeRoutine",
          "dcdn:DescribeRoutineCanaryEnvs",
          "dcdn:DescribeRoutineCodeRevision",
          "dcdn:DescribeRoutineRelatedDomains",
          "dcdn:DescribeRoutineSpec",
          "dcdn:DescribeRoutineUserInfo",
          "dcdn:DescribeRuleHitsTopResource",
          "dcdn:DescribeRuleIdInfo",
          "dcdn:DescribeUserDcdnIpaStatus",
          "dcdn:DescribeUserDcdnStatus",
          "dcdn:DescribeUserErStatus",
          "dcdn:DescribeUserLogserviceStatus",
          "dcdn:DescribeWasm",
          "dcdn:DescribeWasmUserInfo",
          "dcdn:DisableCustomScenePolicy",
          "dcdn:DisableDcdnRDAccess",
          "dcdn:EditWasmConf",
          "dcdn:EnableCustomScenePolicy",
          "dcdn:EnableDcdnRDAccess",
          "dcdn:GetAuthorizationToken",
          "dcdn:GetDcdnKv",
          "dcdn:GetDcdnKvDetail",
          "dcdn:GetDcdnKvStatus",
          "dcdn:ListBackOriginMapping",
          "dcdn:ListBackOriginSource",
          "dcdn:ListDcdnEsTemplateInfo",
          "dcdn:ListDcdnIpaTagResources",
          "dcdn:ListDcdnKv",
          "dcdn:ModifyCustomScenePolicy",
          "dcdn:ModifyDcdnService",
          "dcdn:OpenDcdnService",
          "dcdn:PutDcdnKvAccount",
          "dcdn:PutDcdnKvWithHighCapacity",
          "dcdn:SetDcdnBlockIP",
          "dcdn:SetDcdnDomainRouteTunnelConfig",
          "dcdn:SetL7GlobalCfg",
          "dcdn:VerifyDcdnDomainOwner"
        ],
        "Resource": "*"
      }
    ]
  }
  

• 允許不支援資源群組層級授權的全部操作：Action中列舉不支援資源群組層級授權的全部操作。

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "dcdn:ActivateDcdnVersionOfConfigGroup",
          "dcdn:AddBackOriginSource",
          "dcdn:AddDcdnConfigGroup",
          "dcdn:BatchCreateDcdnWafRules",
          "dcdn:BatchDeleteDcdnKv",
          "dcdn:BatchDeleteDcdnKvWithHighCapacity",
          "dcdn:BatchDeleteDcdnWafRules",
          "dcdn:BatchModifyDcdnWafRules",
          "dcdn:BatchPutDcdnKv",
          "dcdn:BatchPutDcdnKvWithHighCapacity",
          "dcdn:BatchSetDcdnIpaDomainConfigs",
          "dcdn:BatchSetRDBlockIP",
          "dcdn:BlockDcdnObjectCaches",
          "dcdn:CheckDcdnIpaVip",
          "dcdn:CheckDcdnProjectExist",
          "dcdn:CloneDcdnVersionOfConfigGroup",
          "dcdn:CommitStagingRoutineCode",
          "dcdn:CreateApp",
          "dcdn:CreateAppConfig",
          "dcdn:CreateAppVersion",
          "dcdn:CreateBackOriginMapping",
          "dcdn:CreateCustomScenePolicy",
          "dcdn:CreateDcdnCertificateSigningRequest",
          "dcdn:CreateDcdnWafGroup",
          "dcdn:CreateDcdnWafList",
          "dcdn:CreateDcdnWafPolicy",
          "dcdn:CreateDcdnpaybag",
          "dcdn:CreateRegistryNamespace",
          "dcdn:CreateRegistryUser",
          "dcdn:CreateRoutine",
          "dcdn:CreateSlrAndSlsProject",
          "dcdn:CreateWasm",
          "dcdn:CustomScenePolicyBindObject",
          "dcdn:DcdnHttpRequestStagingTest",
          "dcdn:DcdnHttpRequestTestTool",
          "dcdn:DeactivateDcdnConfigOfVersion",
          "dcdn:DeleteBackOriginMapping",
          "dcdn:DeleteCustomDomainSampleRate",
          "dcdn:DeleteCustomScenePolicy",
          "dcdn:DeleteDcdnConfigGroup",
          "dcdn:DeleteDcdnConfigOfVersion",
          "dcdn:DeleteDcdnDeliverTask",
          "dcdn:DeleteDcdnIpaSpecificConfig",
          "dcdn:DeleteDcdnKv",
          "dcdn:DeleteDcdnKvNamespace",
          "dcdn:DeleteDcdnRealTimeLogProject",
          "dcdn:DeleteDcdnSubTask",
          "dcdn:DeleteDcdnUserConfig",
          "dcdn:DeleteDcdnVersionOfConfigGroup",
          "dcdn:DeleteDcdnWafGroup",
          "dcdn:DeleteDcdnWafList",
          "dcdn:DeleteDcdnWafPolicy",
          "dcdn:DeleteRoutine",
          "dcdn:DeleteRoutineCodeRevision",
          "dcdn:DeleteRoutineConfEnvs",
          "dcdn:DeleteWasm",
          "dcdn:DeleteWasmCodeRevision",
          "dcdn:DeployAppVersion",
          "dcdn:DescribeApp",
          "dcdn:DescribeAppConfigs",
          "dcdn:DescribeAppState",
          "dcdn:DescribeAppTenant",
          "dcdn:DescribeAppVersion",
          "dcdn:DescribeAppVersions",
          "dcdn:DescribeApps",
          "dcdn:DescribeBackOriginAreas",
          "dcdn:DescribeCustomDomainSampleRate",
          "dcdn:DescribeCustomScenePolicies",
          "dcdn:DescribeCustomScenePolicyObject",
          "dcdn:DescribeDcdnAclFields",
          "dcdn:DescribeDcdnActivationHistory",
          "dcdn:DescribeDcdnActiveVersionOfConfigGroup",
          "dcdn:DescribeDcdnBgpBpsData",
          "dcdn:DescribeDcdnBgpTrafficData",
          "dcdn:DescribeDcdnBlockedRegions",
          "dcdn:DescribeDcdnCcSignatureArgList",
          "dcdn:DescribeDcdnCcSignatureObjectList",
          "dcdn:DescribeDcdnCertificateDetail",
          "dcdn:DescribeDcdnCertificateDetailById",
          "dcdn:DescribeDcdnConditionIPBInfo",
          "dcdn:DescribeDcdnConfigGroupDetail",
          "dcdn:DescribeDcdnConfigGroupList",
          "dcdn:DescribeDcdnConfigOfVersion",
          "dcdn:DescribeDcdnConfigOfVersionForDiff",
          "dcdn:DescribeDcdnContainerStats",
          "dcdn:DescribeDcdnDdosService",
          "dcdn:DescribeDcdnDdosSpecInfo",
          "dcdn:DescribeDcdnDeletedDomains",
          "dcdn:DescribeDcdnDeliverList",
          "dcdn:DescribeDcdnDomainByCertificate",
          "dcdn:DescribeDcdnDomainCcActivityLog",
          "dcdn:DescribeDcdnDomainMax95BpsData",
          "dcdn:DescribeDcdnDomainMd5Info",
          "dcdn:DescribeDcdnDomainNamesOfVersion",
          "dcdn:DescribeDcdnDomainVerifyData",
          "dcdn:DescribeDcdnDomainsBySource",
          "dcdn:DescribeDcdnErUsageData",
          "dcdn:DescribeDcdnFullDomainsBlockIPConfig",
          "dcdn:DescribeDcdnFullDomainsBlockIPHistory",
          "dcdn:DescribeDcdnHttpsDomainList",
          "dcdn:DescribeDcdnIpInfo",
          "dcdn:DescribeDcdnIpaDomainCidr",
          "dcdn:DescribeDcdnIpaService",
          "dcdn:DescribeDcdnKvAccount",
          "dcdn:DescribeDcdnKvAccountStatus",
          "dcdn:DescribeDcdnKvNamespace",
          "dcdn:DescribeDcdnL2Ips",
          "dcdn:DescribeDcdnL2Vips",
          "dcdn:DescribeDcdnRealTimeDeliveryField",
          "dcdn:DescribeDcdnRefreshQuota",
          "dcdn:DescribeDcdnRefreshTaskById",
          "dcdn:DescribeDcdnRegionAndIsp",
          "dcdn:DescribeDcdnReportList",
          "dcdn:DescribeDcdnResourcesProperty",
          "dcdn:DescribeDcdnSLSRealTimeLogType",
          "dcdn:DescribeDcdnSLSRealtimeLogDelivery",
          "dcdn:DescribeDcdnSMCertificateDetail",
          "dcdn:DescribeDcdnSecFuncInfo",
          "dcdn:DescribeDcdnSecSpecInfo",
          "dcdn:DescribeDcdnService",
          "dcdn:DescribeDcdnStagingIp",
          "dcdn:DescribeDcdnSubList",
          "dcdn:DescribeDcdnTopDomainsByFlow",
          "dcdn:DescribeDcdnUserBillHistory",
          "dcdn:DescribeDcdnUserBillType",
          "dcdn:DescribeDcdnUserCertificateExpireCount",
          "dcdn:DescribeDcdnUserConfigs",
          "dcdn:DescribeDcdnUserQuota",
          "dcdn:DescribeDcdnUserRealTimeDeliveryField",
          "dcdn:DescribeDcdnUserResourcePackage",
          "dcdn:DescribeDcdnUserSecDrop",
          "dcdn:DescribeDcdnUserSecDropByMinute",
          "dcdn:DescribeDcdnUserTags",
          "dcdn:DescribeDcdnVerifyContent",
          "dcdn:DescribeDcdnVersionInfo",
          "dcdn:DescribeDcdnVersionOfConfigGroup",
          "dcdn:DescribeDcdnWafBotAppKey",
          "dcdn:DescribeDcdnWafDefaultRules",
          "dcdn:DescribeDcdnWafDomains",
          "dcdn:DescribeDcdnWafFilterInfo",
          "dcdn:DescribeDcdnWafGeoInfo",
          "dcdn:DescribeDcdnWafGroup",
          "dcdn:DescribeDcdnWafGroups",
          "dcdn:DescribeDcdnWafList",
          "dcdn:DescribeDcdnWafLists",
          "dcdn:DescribeDcdnWafPolicies",
          "dcdn:DescribeDcdnWafPolicy",
          "dcdn:DescribeDcdnWafPolicyDomains",
          "dcdn:DescribeDcdnWafPolicyValidDomains",
          "dcdn:DescribeDcdnWafQuota",
          "dcdn:DescribeDcdnWafRule",
          "dcdn:DescribeDcdnWafRules",
          "dcdn:DescribeDcdnWafScenes",
          "dcdn:DescribeDcdnWafService",
          "dcdn:DescribeDcdnWafSpecInfo",
          "dcdn:DescribeDcdnsecService",
          "dcdn:DescribeDdosAllEventList",
          "dcdn:DescribeDdosBpsList",
          "dcdn:DescribeDdosBpsMax",
          "dcdn:DescribeDdosEventMax",
          "dcdn:DescribeDdosSpecialPort",
          "dcdn:DescribeDomainAttackEventList",
          "dcdn:DescribeDomainOverview",
          "dcdn:DescribeDomainQpsList",
          "dcdn:DescribeEncryptRoutineUid",
          "dcdn:DescribeEsExceptionData",
          "dcdn:DescribeEsExecuteData",
          "dcdn:DescribeHighlightInfo",
          "dcdn:DescribeKVTimeoutRequestDistributionData",
          "dcdn:DescribeKvPerfData",
          "dcdn:DescribeKvRealTimeQpsData",
          "dcdn:DescribeKvUsageData",
          "dcdn:DescribeRDDomainConfig",
          "dcdn:DescribeRDDomains",
          "dcdn:DescribeRegistryNamespace",
          "dcdn:DescribeRegistryUser",
          "dcdn:DescribeRoutine",
          "dcdn:DescribeRoutineCanaryEnvs",
          "dcdn:DescribeRoutineCodeRevision",
          "dcdn:DescribeRoutineRelatedDomains",
          "dcdn:DescribeRoutineSpec",
          "dcdn:DescribeRoutineUserInfo",
          "dcdn:DescribeRuleHitsTopResource",
          "dcdn:DescribeRuleIdInfo",
          "dcdn:DescribeUserDcdnDdosStatus",
          "dcdn:DescribeUserDcdnIpaStatus",
          "dcdn:DescribeUserDcdnStatus",
          "dcdn:DescribeUserDcdnWafStatus",
          "dcdn:DescribeUserErStatus",
          "dcdn:DescribeUserLogserviceStatus",
          "dcdn:DescribeWasm",
          "dcdn:DescribeWasmUserInfo",
          "dcdn:DisableCustomScenePolicy",
          "dcdn:DisableDcdnRDAccess",
          "dcdn:EditRoutineConf",
          "dcdn:EditWasmConf",
          "dcdn:EnableCustomScenePolicy",
          "dcdn:EnableDcdnRDAccess",
          "dcdn:GetAuthorizationToken",
          "dcdn:GetDcdnKv",
          "dcdn:GetDcdnKvDetail",
          "dcdn:GetDcdnKvStatus",
          "dcdn:ListBackOriginMapping",
          "dcdn:ListBackOriginSource",
          "dcdn:ListDcdnEsTemplateInfo",
          "dcdn:ListDcdnIpaTagResources",
          "dcdn:ListDcdnKv",
          "dcdn:ModifyCustomScenePolicy",
          "dcdn:ModifyDcdnConfigTemplate",
          "dcdn:ModifyDcdnDescriptionOfVersion",
          "dcdn:ModifyDcdnDomainOwner",
          "dcdn:ModifyDcdnService",
          "dcdn:ModifyDcdnWafGroup",
          "dcdn:ModifyDcdnWafList",
          "dcdn:ModifyDcdnWafPolicy",
          "dcdn:ModifyDcdnWafPolicyDomains",
          "dcdn:ModifyDcdnWafRule",
          "dcdn:OpenDcdnService",
          "dcdn:PublishAppVersion",
          "dcdn:PublishRoutineCodeRevision",
          "dcdn:PutDcdnKv",
          "dcdn:PutDcdnKvAccount",
          "dcdn:PutDcdnKvNamespace",
          "dcdn:PutDcdnKvWithHighCapacity",
          "dcdn:RemoveBackOriginSource",
          "dcdn:RollbackAppVersion",
          "dcdn:SetDcdnBlockIP",
          "dcdn:SetDcdnConfigOfVersion",
          "dcdn:SetDcdnDomainRouteTunnelConfig",
          "dcdn:SetDcdnFullDomainsBlockIP",
          "dcdn:SetDcdnUserConfig",
          "dcdn:SetDdosSpecialPort",
          "dcdn:SetIntelligentCCCfg",
          "dcdn:SetL7GlobalCfg",
          "dcdn:SetRoutineSubdomain",
          "dcdn:TagDcdnIpaResources",
          "dcdn:UnDeployAppVersion",
          "dcdn:UntagDcdnIpaResources",
          "dcdn:UpdateAppConfig",
          "dcdn:UpdateAppHealthCheck",
          "dcdn:UpdateBackOriginNameServer",
          "dcdn:UpdateDcdnUserRealTimeDeliveryField",
          "dcdn:UploadRoutineCode",
          "dcdn:UploadStagingRoutineCode",
          "dcdn:UploadWasmCode",
          "dcdn:VerifyDcdnDomainOwner"
        ],
        "Resource": "*"
      }
    ]
  }
  

常見問題