Network Intelligence Service：使用資源群組進行精細化資源控制-最新

資源群組授權的工作原理

您可以使用資源群組（Resource Group）對阿里雲帳號內的資源進行分組管理。例如，為不同的專案建立對應的資源群組，並將資源轉移到對應的組中，以便集中管理各專案的資源。更多資訊，請參見什麼是資源群組。

在完成資源分組後，您可以為不同的RAM授權主體（RAM使用者、RAM使用者組或RAM角色）授予指定資源群組範圍的許可權，從而限定這個授權主體只能管理該資源群組內的資源。更多資訊，請參見資源分組和授權。

這種授權方式的優點有：

• 許可權精細化：確保每個身份能獲得最準確的資源存取權限，避免帳號下的多重專案的資源混合管理。

• 良好的擴充性：後續新增資源時，只需將其加入該資源群組，RAM身份便會自動獲得新資源的相應許可權，無需再次授權。

為RAM使用者授予資源群組層級的許可權

下面以RAM使用者為例，介紹授予指定資源群組內網路智慧型服務資源許可權的操作步驟。

支援資源群組的資源類型

網路智慧型服務支援資源群組的資源類型如下表所示：

不支援資源群組層級授權的操作

網路智慧型服務中不支援資源群組層級授權的操作（Action）如下：

對於不支援資源群組授權的操作，授權時資源範圍選取資源群組層級將無效。如果仍需要RAM使用者有上述操作許可權，您需要建立自訂權限原則，授權時資源範圍選取帳號層級。

以下是兩個自訂權限原則樣本，您可以根據實際需要調整策略內容。

• 允許不支援資源群組層級授權的全部唯讀操作：Action中列舉不支援資源群組層級授權的所有隻讀操作。

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "nis:CountNetworkPath",
          "nis:CountNetworkResource",
          "nis:CountNisEvent",
          "nis:DescribeBatchFlowLogCacheTask",
          "nis:DescribeInspectionObjectList",
          "nis:DescribeInspectionReportDetail",
          "nis:DescribeNISTrafficAnalyzer",
          "nis:DescribeNisInspectionRecommendationResources",
          "nis:DescribeNisInspectionReportCheckItems",
          "nis:DescribeNisInspectionReportStatus",
          "nis:DescribeNisInspectionReportSummary",
          "nis:DescribeNisInspectionTask",
          "nis:DescribeNisTrafficRanking",
          "nis:DescribeRegions",
          "nis:DescribeTopologyNode",
          "nis:GetInsightPredictBytes",
          "nis:GetInsightSummary",
          "nis:GetInspectionSummary",
          "nis:GetInternetFiveTupleHistory",
          "nis:GetInternetMetric",
          "nis:GetInternetQuality",
          "nis:GetInternetScoreMetric",
          "nis:GetInternetTopN",
          "nis:GetInternetTuple",
          "nis:GetMultiAccountStatus",
          "nis:GetNatMetric",
          "nis:GetNatTopN",
          "nis:GetNetworkObservability",
          "nis:GetNisEventDetail",
          "nis:GetNisEventHistory",
          "nis:GetNisNetworkMetrics",
          "nis:GetNisNetworkRanking",
          "nis:GetNisTrafficMetrics",
          "nis:GetNisTrafficStatistics",
          "nis:GetSameRegionSumBytes",
          "nis:GetSameRegionTopN",
          "nis:GetSameRegionVpcMetric",
          "nis:GetTopoSummary",
          "nis:GetTrafficAnalyzerOpenStatus",
          "nis:GetTransitRouterFlowMetric",
          "nis:GetTransitRouterFlowTopN",
          "nis:GetVbrFlowMetric",
          "nis:GetVbrFlowTopN",
          "nis:IsOpenService",
          "nis:ListDiagnosisInstance",
          "nis:ListInsight",
          "nis:ListInsightEvent",
          "nis:ListInstance",
          "nis:ListInternetEnum",
          "nis:ListLatencyInfoBetweenClusters",
          "nis:ListLatencyInfoBetweenRegions",
          "nis:ListLatencyInfoBetweenZones",
          "nis:ListMultiAccount",
          "nis:ListNISTrafficAnalyzers",
          "nis:ListNisAssistantSessions",
          "nis:ListNisAssistantTasks",
          "nis:ListNisEvent",
          "nis:ListNisInspectionResourceType",
          "nis:ListNisInspectionTaskReports",
          "nis:ListNisInspectionTasks",
          "nis:ListNisTrafficAnalyzerDataMappings",
          "nis:ListNonPublicFlowAnalysis",
          "nis:ListNoneInsightEvent",
          "nis:ListSameRegionVpc",
          "nis:ListTagResources",
          "nis:ListTrafficAnalyzerFlowLogs",
          "nis:ListTrafficAnalyzerMappingResources",
          "nis:OpenMultiAccount",
          "nis:RefreshMultiAccount"
        ],
        "Resource": "*"
      }
    ]
  }
  

• 允許不支援資源群組層級授權的全部操作：Action中列舉不支援資源群組層級授權的全部操作。

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "nis:ActiveNonPublicFlowAnalysis",
          "nis:AddNisTrafficAnalyzerDataMapping",
          "nis:BatchCreateFlowLogsToTrafficAnalyzer",
          "nis:BatchUpdateFlowlogsForTrafficAnalyzer",
          "nis:CheckFlowLogStatus",
          "nis:CloseInsight",
          "nis:CloseNetworkObservability",
          "nis:CloseNis",
          "nis:CloseNonPublicFlowAnalysis",
          "nis:ConfigNetworkObservability",
          "nis:CountNetworkPath",
          "nis:CountNetworkResource",
          "nis:CountNisEvent",
          "nis:CreateAndAnalyzeNetworkPath",
          "nis:CreateInsight",
          "nis:CreateInspectionTask",
          "nis:CreateNISTrafficAnalyzer",
          "nis:CreateNisAssistantTask",
          "nis:DeleteInsight",
          "nis:DeleteNISTrafficAnalyzer",
          "nis:DeleteNisAssistantSession",
          "nis:DeleteNisAssistantTask",
          "nis:DeleteNisInspectionReport",
          "nis:DeleteNisInspectionTask",
          "nis:DescribeBatchFlowLogCacheTask",
          "nis:DescribeInspectionObjectList",
          "nis:DescribeInspectionReportDetail",
          "nis:DescribeNISTrafficAnalyzer",
          "nis:DescribeNetworkAnalyticsNetQuality",
          "nis:DescribeNisInspectionRecommendationResources",
          "nis:DescribeNisInspectionReportCheckItems",
          "nis:DescribeNisInspectionReportStatus",
          "nis:DescribeNisInspectionReportSummary",
          "nis:DescribeNisInspectionTask",
          "nis:DescribeNisTrafficRanking",
          "nis:DescribeRegions",
          "nis:DescribeTopologyNode",
          "nis:DisableMultiAccount",
          "nis:GetInsightPredictBytes",
          "nis:GetInsightSummary",
          "nis:GetInspectionSummary",
          "nis:GetInternetFiveTupleHistory",
          "nis:GetInternetMetric",
          "nis:GetInternetQuality",
          "nis:GetInternetScoreMetric",
          "nis:GetInternetTopN",
          "nis:GetInternetTuple",
          "nis:GetMultiAccountStatus",
          "nis:GetNatMetric",
          "nis:GetNatTopN",
          "nis:GetNetworkObservability",
          "nis:GetNisEventDetail",
          "nis:GetNisEventHistory",
          "nis:GetNisNetworkMetrics",
          "nis:GetNisNetworkRanking",
          "nis:GetNisTrafficMetrics",
          "nis:GetNisTrafficStatistics",
          "nis:GetSameRegionSumBytes",
          "nis:GetSameRegionTopN",
          "nis:GetSameRegionVpcMetric",
          "nis:GetTopoSummary",
          "nis:GetTrafficAnalyzerOpenStatus",
          "nis:GetTransitRouterFlowMetric",
          "nis:GetTransitRouterFlowTopN",
          "nis:GetVbrFlowMetric",
          "nis:GetVbrFlowTopN",
          "nis:IsOpenService",
          "nis:ListDiagnosisInstance",
          "nis:ListInsight",
          "nis:ListInsightCycleIp",
          "nis:ListInsightEvent",
          "nis:ListInstance",
          "nis:ListInternetEnum",
          "nis:ListLatencyInfoBetweenClusters",
          "nis:ListLatencyInfoBetweenRegions",
          "nis:ListLatencyInfoBetweenZones",
          "nis:ListMultiAccount",
          "nis:ListNISTrafficAnalyzers",
          "nis:ListNisAssistantSessions",
          "nis:ListNisAssistantTasks",
          "nis:ListNisEvent",
          "nis:ListNisInspectionResourceType",
          "nis:ListNisInspectionTaskReports",
          "nis:ListNisInspectionTasks",
          "nis:ListNisTrafficAnalyzerDataMapping",
          "nis:ListNisTrafficAnalyzerDataMappings",
          "nis:ListNonPublicFlowAnalysis",
          "nis:ListNoneInsightEvent",
          "nis:ListSameRegionVpc",
          "nis:ListTagResources",
          "nis:ListTrafficAnalyzerFlowLogs",
          "nis:ListTrafficAnalyzerMappingResources",
          "nis:ModifyNisTrafficAnalyzerDataMapping",
          "nis:OpenInsight",
          "nis:OpenMultiAccount",
          "nis:OpenNISTrafficAnalyzer",
          "nis:OpenNonPublicFlowAnalysis",
          "nis:RefreshMultiAccount",
          "nis:RemoveNisTrafficAnalyzerDataMapping",
          "nis:StartNisInspectionTask",
          "nis:StartNisTrafficRanking",
          "nis:StopNisAssistantTask",
          "nis:SubmitNisAssistantTaskFeedback",
          "nis:UpdateInsight",
          "nis:UpdateInsightCycleIp",
          "nis:UpdateInspectionObjects",
          "nis:UpdateInspectionTaskStatus",
          "nis:UpdateNISTrafficAnalyzer",
          "nis:UpdateNisInspectionTask",
          "nis:UpdateSameRegionFlowAnalysis"
        ],
        "Resource": "*"
      }
    ]
  }
  

常見問題