Realtime Compute for Apache Flink：使用資源群組進行精細化資源控制-最新

資源群組授權的工作原理

您可以使用資源群組（Resource Group）對阿里雲帳號內的資源進行分組管理。例如，為不同的專案建立對應的資源群組，並將資源轉移到對應的組中，以便集中管理各專案的資源。更多資訊，請參見什麼是資源群組。

在完成資源分組後，您可以為不同的RAM授權主體（RAM使用者、RAM使用者組或RAM角色）授予指定資源群組範圍的許可權，從而限定這個授權主體只能管理該資源群組內的資源。更多資訊，請參見資源分組和授權。

這種授權方式的優點有：

• 許可權精細化：確保每個身份能獲得最準確的資源存取權限，避免帳號下的多重專案的資源混合管理。

• 良好的擴充性：後續新增資源時，只需將其加入該資源群組，RAM身份便會自動獲得新資源的相應許可權，無需再次授權。

為RAM使用者授予資源群組層級的許可權

下面以RAM使用者為例，介紹授予指定資源群組內Realtime ComputeFlink版資源許可權的操作步驟。

支援資源群組的資源類型

Realtime ComputeFlink版支援資源群組的資源類型如下表所示：

不支援資源群組層級授權的操作

Realtime ComputeFlink版中不支援資源群組層級授權的操作（Action）如下：

對於不支援資源群組授權的操作，授權時資源範圍選取資源群組層級將無效。如果仍需要RAM使用者有上述操作許可權，您需要建立自訂權限原則，授權時資源範圍選取帳號層級。

以下是兩個自訂權限原則樣本，您可以根據實際需要調整策略內容。

• 允許不支援資源群組層級授權的全部唯讀操作：Action中列舉不支援資源群組層級授權的所有隻讀操作。

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "stream:CheckOssBucket",
          "stream:CheckUserVSwitch",
          "stream:CheckUserVpc",
          "stream:DescribeLxCommodity",
          "stream:FetchSqlPreviewResults",
          "stream:FlinkApiProxy",
          "stream:GetArtifactMetadataV1",
          "stream:GetCatalogs",
          "stream:GetCatalogsSnapshot",
          "stream:GetClusterQuantityByRegion",
          "stream:GetCustomFlinkArtifactsSnapshot",
          "stream:GetDatabases",
          "stream:GetDeployment",
          "stream:GetDeploymentDraft",
          "stream:GetDeploymentDraftLock",
          "stream:GetDeploymentV1",
          "stream:GetDeploymentsByIp",
          "stream:GetDeploymentsByLabel",
          "stream:GetDeploymentsByName",
          "stream:GetEvents",
          "stream:GetFolder",
          "stream:GetGenerateResourcePlanResult",
          "stream:GetJob",
          "stream:GetJobDiagnosis",
          "stream:GetMember",
          "stream:GetPreSignedUrlForPutObject",
          "stream:GetSavepoint",
          "stream:GetSessionCluster",
          "stream:GetSpecifications",
          "stream:GetTables",
          "stream:GetUdfArtifacts",
          "stream:GetValidateDeploymentDraftResult",
          "stream:HasStreamDefaultRole",
          "stream:ListArtifactsV1",
          "stream:ListDeploymentDrafts",
          "stream:ListDeploymentTargets",
          "stream:ListDeploymentTargetsV1",
          "stream:ListDeployments",
          "stream:ListDeploymentsV1",
          "stream:ListEngineVersionMetadata",
          "stream:ListJobs",
          "stream:ListMembers",
          "stream:ListNamespacesV1",
          "stream:ListOssInfo",
          "stream:ListRegionWithClusterQuantity",
          "stream:ListSavepoints",
          "stream:ListScheduledPlan",
          "stream:ListScheduledPlanExecutedHistory",
          "stream:ListSessionClusters",
          "stream:ListSessionClustersV1",
          "stream:ListTagKeys",
          "stream:ListTagValues",
          "stream:ListUserVswitch",
          "stream:ListVariables",
          "stream:QueryCloneNamespace",
          "stream:QueryCreateLxCommodityPrice",
          "stream:QueryCreateVvpInstancePrice",
          "stream:QueryTagVvpResources",
          "stream:SearchOrderStatistics",
          "stream:WorkflowCallbackQueryNodeStatus"
        ],
        "Resource": "*"
      }
    ]
  }
  

• 允許不支援資源群組層級授權的全部操作：Action中列舉不支援資源群組層級授權的全部操作。

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "stream:ActOnBehalfOfAnotherUser",
          "stream:ApplyScheduledPlan",
          "stream:CancelSqlPreview",
          "stream:CheckNamespaceName",
          "stream:CheckOssBucket",
          "stream:CheckUserVSwitch",
          "stream:CheckUserVpc",
          "stream:CreateDeployment",
          "stream:CreateDeploymentDraft",
          "stream:CreateDeploymentDraftV1",
          "stream:CreateDeploymentTarget",
          "stream:CreateDeploymentTargetV2",
          "stream:CreateDeploymentV1",
          "stream:CreateFolder",
          "stream:CreateFolderV1",
          "stream:CreateInstance",
          "stream:CreateLxCommodity",
          "stream:CreateMember",
          "stream:CreateSavepoint",
          "stream:CreateScheduledPlan",
          "stream:CreateSessionCluster",
          "stream:CreateSqlFile",
          "stream:CreateUdfArtifact",
          "stream:CreateVariable",
          "stream:DeleteCustomConnector",
          "stream:DeleteDeployment",
          "stream:DeleteDeploymentByName",
          "stream:DeleteDeploymentDraft",
          "stream:DeleteDeploymentDraftV1",
          "stream:DeleteDeploymentTarget",
          "stream:DeleteDeploymentV1",
          "stream:DeleteFolder",
          "stream:DeleteJob",
          "stream:DeleteMember",
          "stream:DeleteSavepoint",
          "stream:DeleteScheduledPlan",
          "stream:DeleteSessionCluster",
          "stream:DeleteSqlFile",
          "stream:DeleteUdfArtifact",
          "stream:DeleteUdfFunction",
          "stream:DeleteVariable",
          "stream:DeployDeploymentDraftAsync",
          "stream:DeployDeploymentDraftV1",
          "stream:DescribeFlussInstances",
          "stream:DescribeLxCommodity",
          "stream:ExecuteSqlScriptV1",
          "stream:ExecuteSqlStatement",
          "stream:FetchSqlExecutionResult",
          "stream:FetchSqlPreviewResults",
          "stream:FlinkApiProxy",
          "stream:ForcefullyCreateLockV1",
          "stream:GenerateResourcePlanV1",
          "stream:GenerateResourcePlanWithFlinkConfAsync",
          "stream:GetAppliedScheduledPlan",
          "stream:GetArtifactMetadataV1",
          "stream:GetCatalogs",
          "stream:GetCatalogsSnapshot",
          "stream:GetClusterQuantityByRegion",
          "stream:GetCommodityCode",
          "stream:GetCustomFlinkArtifactsSnapshot",
          "stream:GetDatabases",
          "stream:GetDeployDeploymentDraftResult",
          "stream:GetDeployment",
          "stream:GetDeploymentDefaultsV1",
          "stream:GetDeploymentDraft",
          "stream:GetDeploymentDraftByIdV1",
          "stream:GetDeploymentDraftByNameV1",
          "stream:GetDeploymentDraftLock",
          "stream:GetDeploymentDraftResourcePlanV1",
          "stream:GetDeploymentDraftResourcePlanWithBestEffortV1",
          "stream:GetDeploymentV1",
          "stream:GetDeploymentsByIp",
          "stream:GetDeploymentsByLabel",
          "stream:GetDeploymentsByName",
          "stream:GetEvents",
          "stream:GetFolder",
          "stream:GetFolderByIdV1",
          "stream:GetGenerateResourcePlanResult",
          "stream:GetGlobalDeploymentDefaultsV1",
          "stream:GetHotUpdateJobResult",
          "stream:GetJob",
          "stream:GetJobDiagnosis",
          "stream:GetLatestJobStartLog",
          "stream:GetLineageInfo",
          "stream:GetMember",
          "stream:GetPreSignedUrlForPutObject",
          "stream:GetRootFolderByTypeV1",
          "stream:GetSavepoint",
          "stream:GetSessionCluster",
          "stream:GetSpecifications",
          "stream:GetSqlFile",
          "stream:GetTables",
          "stream:GetUdfArtifacts",
          "stream:GetValidateDeploymentDraftResult",
          "stream:HandleCatalogChanges",
          "stream:HasStreamDefaultRole",
          "stream:HotUpdateJob",
          "stream:ListArtifactsV1",
          "stream:ListCustomConnectors",
          "stream:ListDeploymentDrafts",
          "stream:ListDeploymentTargets",
          "stream:ListDeploymentTargetsV1",
          "stream:ListDeployments",
          "stream:ListDeploymentsV1",
          "stream:ListEngineVersionMetadata",
          "stream:ListFlinkVersionsV1",
          "stream:ListJobs",
          "stream:ListMembers",
          "stream:ListNamespacesV1",
          "stream:ListOssInfo",
          "stream:ListRegionWithClusterQuantity",
          "stream:ListSavepoints",
          "stream:ListScheduledPlan",
          "stream:ListScheduledPlanExecutedHistory",
          "stream:ListSessionClusters",
          "stream:ListSessionClustersV1",
          "stream:ListTagKeys",
          "stream:ListTagResources",
          "stream:ListTagValues",
          "stream:ListUserVswitch",
          "stream:ListVariables",
          "stream:ModifyDns",
          "stream:ModifyInstanceVswitch",
          "stream:QueryCloneNamespace",
          "stream:QueryCreateLxCommodityPrice",
          "stream:QueryCreateVvpInstancePrice",
          "stream:QueryTagVvpResources",
          "stream:RegisterCustomConnector",
          "stream:RegisterUdfFunction",
          "stream:ReplaceDeploymentV1",
          "stream:SaveDeploymentDraftResourcePlanV1",
          "stream:SearchFoldersByKeywordV1",
          "stream:SearchOrderStatistics",
          "stream:SetDeploymentResourceModeV1",
          "stream:StartJob",
          "stream:StartJobWithParams",
          "stream:StartOrGetNonTerminalSqlExecution",
          "stream:StartSessionCluster",
          "stream:StartSqlExecution",
          "stream:StopApplyScheduledPlan",
          "stream:StopJob",
          "stream:StopSessionCluster",
          "stream:StopSqlExecution",
          "stream:SubmitSqlPreview",
          "stream:TagVvpResources",
          "stream:UnTagVvpResources",
          "stream:UpdateDeployment",
          "stream:UpdateDeploymentByName",
          "stream:UpdateDeploymentDesiredStateV1",
          "stream:UpdateDeploymentDraft",
          "stream:UpdateDeploymentDraftV1",
          "stream:UpdateDeploymentTarget",
          "stream:UpdateDeploymentTargetV2",
          "stream:UpdateDeploymentV1",
          "stream:UpdateFolder",
          "stream:UpdateInstanceMonitorType",
          "stream:UpdateMember",
          "stream:UpdateMemberV1",
          "stream:UpdateScheduledPlan",
          "stream:UpdateSessionCluster",
          "stream:UpdateSqlFile",
          "stream:UpdateUdfArtifact",
          "stream:UpdateVariable",
          "stream:ValidateDeploymentDraftAsync",
          "stream:ValidateSqlScriptV1",
          "stream:ValidateSqlStatement",
          "stream:WorkflowCallbackQueryNodeStatus",
          "stream:WorkflowCallbackStartNode",
          "stream:WorkflowCallbackStopNode"
        ],
        "Resource": "*"
      }
    ]
  }
  

常見問題