全部產品
Search

搜尋本產品

    OpenSearch：授權信息

    文件中心

    OpenSearch：授權信息

    更新時間：Jul 16, 2026

    存取控制（RAM）是阿里雲提供的系統管理使用者身份與資源存取權限的服務。使用 RAM 可以讓您避免與其他使用者共用阿里雲帳號密鑰，並可按需為使用者授予最小許可權。RAM 中使用權限原則描述授權的具體內容。

    本文為您介紹 Open Search 為 RAM 權限原則定義的操作（Action）、資源（Resource）和條件（Condition）。 Open Search 的 RAM 代碼（RamCode）為 searchengine ，支援的授權粒度為 RESOURCE 。

    權限原則通用結構

    權限原則支援 JSON 格式，其通用結構如下：

    {
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

    各欄位含義如下：

    • Effect：權限原則效果。取值：Allow（允許）、Deny（拒絕）。

    • Action：授予允許或拒絕許可權的具體操作。具體資訊，請參見操作（Action）。

    • Resource：受操作影響的具體對象，您可以使用資源 ARN 來描述指定資源。具體資訊，請參見資源（Resource）。

    • Condition：指授權生效的條件。可選欄位。具體資訊，請參見條件（Condition）。

      • Condition_operator：條件運算子，不同類型的條件對應不同的條件運算子。具體資訊，請參見權限原則基本元素。

      • Condition_key：條件關鍵字。

      • Condition_value：條件關鍵字對應的值。

    操作（Action）

    下表是Open Search定義的操作，這些操作可以在 RAM 權限原則語句的Action元素中使用，用來授予執行該操作的許可權。下面對錶中的具體項提供說明：

    • 操作：是指具體的許可權點。

    • API：是指操作對應的 API 介面。

    • 存取層級：是指每個操作的存取層級，取值為寫入（Write）、讀取（Read）或列出（List）。

    • 資源類型：是指操作中支援授權的資源類型。具體說明如下：

      • 對於必選的資源類型，用前面加 * 表示。

      • 對於不支援資源級授權的操作，用全部資源表示。

    • 條件關鍵字：是指雲產品自身定義的條件關鍵字。該列不體現適用於任何操作的通用條件關鍵字。

    • 關聯操作：是指成功執行操作所需要的其他許可權。操作者必須同時具備關聯操作的許可權，操作才能成功。

    操作

    API

    存取層級

    資源類型

    條件關鍵字

    關聯操作
    searchengine:GetDataSourceDeploy GetDataSourceDeploy get

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#instanceId}

    		 無 無
    searchengine:CreateConfigFile CreateConfigFile

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:CreateFolder CreateFolder create

    *Folder

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:UpdateSqlInstanceContent UpdateSqlInstanceContent update

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#instanceId}

    		 無 無
    searchengine:ModifyPassword ModifyPassword update

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:GetNodeConfig GetNodeConfig get

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:DeleteModel DeleteModel delete

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:ListInstanceSpecs ListInstanceSpecs get

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#instanceId}

    		 無 無
    searchengine:ListLogs ListLogs list

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:ModifySearcherReplica ModifySearcherReplica update

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:ForceSwitch ForceSwitch

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:ListDateSourceGenerations ListDateSourceGenerations list

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#instanceId}

    		 無 無
    searchengine:DeleteAdvanceConfig DeleteAdvanceConfig

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:ListAdvanceConfigs ListAdvanceConfigs list

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:GetAdvanceConfigFile GetAdvanceConfigFile get

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:DeleteTable DeleteTable delete

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:ModifyDataSourceDeploy ModifyDataSourceDeploy update

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#instanceId}

    		 無 無
    searchengine:ModifyAlias ModifyAlias update

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:DeleteConfigDir DeleteConfigDir

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:GetIndex GetIndex get

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:ListDataSources ListDataSources list

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:DeleteIndexVersion DeleteIndexVersion

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:TagResources TagResources update

    *All Resource

    *

    		 無 無
    searchengine:RenameFolder RenameFolder update

    *Folder

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:ModifyAdvanceConfig ModifyAdvanceConfig update

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:GetInstance GetInstance get

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:GetIndexOnlineStrategy GetIndexOnlineStrategy get

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#instanceId}

    		 無 無
    searchengine:ListAdvanceConfigDir ListAdvanceConfigDir list

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#instanceId}

    		 無 無
    searchengine:ModifyModel ModifyModel update

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:DeletePublicUrl DeletePublicUrl delete

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:GetClusterRunTimeInfo GetClusterRunTimeInfo get

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:StartIndex StartIndex update

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:DeleteIndex DeleteIndex

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:GetTable GetTable get

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:ModifyFile ModifyFile

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:ModifyIndex ModifyIndex update

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:GetDeployGraph GetDeployGraph get

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:CreateModel CreateModel create

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:UpdateSqlInstanceName UpdateSqlInstanceName update

    *SqlInstance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:ListDataSourceTasks ListDataSourceTasks list

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:StopTask StopTask

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:GetIndexVersion GetIndexVersion get

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:ModifyOnlineConfig ModifyOnlineConfig

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:UpdateInstance UpdateInstance update

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:GetTableGeneration GetTableGeneration get

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:ModifyClusterOfflineConfig ModifyClusterOfflineConfig update

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:CreateTable CreateTable create

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:ListOnlineConfigs ListOnlineConfigs list

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#instanceId}

    		 無 無
    searchengine:ListRestQueryResult ListRestQueryResult list

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:ModifyIndexVersion ModifyIndexVersion

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:DeleteFolder DeleteFolder delete

    *Folder

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:ModifyNodeConfig ModifyNodeConfig

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:DeleteAlias DeleteAlias delete

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:ListInstances ListInstances get

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/*

    		 無 無
    searchengine:ListClusters ListClusters list

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:DeleteSqlInstance DeleteSqlInstance delete

    *SqlInstance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:ListIndexes ListIndexes list

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:ListPausePolicys ListPausePolicys list

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:PublishAdvanceConfig PublishAdvanceConfig update

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:DeleteDataSource DeleteDataSource

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:Reindex Reindex update

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:CreateSqlInstance CreateSqlInstance create

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#instanceId}

    		 無 無
    searchengine:ListTableGenerations ListTableGenerations list

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:GetCluster GetCluster get

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:ModifyAdvanceConfigFile ModifyAdvanceConfigFile

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:ListAliases ListAliases list

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:ListVectorQueryResult ListVectorQueryResult list

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:ListTables ListTables list

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:ListSchemas ListSchemas list

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:RemoveCluster RemoveCluster

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:CreateAlias CreateAlias create

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:UpdateSqlInstanceParams UpdateSqlInstanceParams update

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#instanceId}

    		 無 無
    searchengine:ListQueryResult ListQueryResult get

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:TransformPlan TransformPlan create

    *All Resource

    *

    		 無 無
    searchengine:BuildIndex BuildIndex update

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:CreateDataSource CreateDataSource create

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:ModifyClusterOnlineConfig ModifyClusterOnlineConfig

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#instanceId}

    		 無 無
    searchengine:ModifyTable ModifyTable update

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:CreateCluster CreateCluster create

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:ListTagResources ListTagResources list

    *All Resource

    *

    		 無 無
    searchengine:ListIndexRecoverRecords ListIndexRecoverRecords list

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:ListClusterTasks ListClusterTasks list

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:DebugModel DebugModel get

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:RecoverIndex RecoverIndex update

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:DeleteConfigFile DeleteConfigFile

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:ListClusterNames ListClusterNames list

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:UntagResources UntagResources delete

    *All Resource

    *

    		 無 無
    searchengine:PublishIndexVersion PublishIndexVersion

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:ListDatabases ListDatabases list

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#instanceId}

    		 無 無
    searchengine:ModifyIndexPartition ModifyIndexPartition

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#instanceId}

    		 無 無
    searchengine:ListDataSourceSchemas ListDataSourceSchemas list

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#instanceId}

    		 無 無
    searchengine:CreateInstance CreateInstance create

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/*

    		 無 無
    searchengine:ModifyClusterDesc ModifyClusterDesc

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:ListTasks ListTasks none

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:ExecuteSqlInstance ExecuteSqlInstance create

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#instanceId}

    		 無 無
    searchengine:GetSqlInstance GetSqlInstance get

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#instanceId}

    		 無 無
    searchengine:CreatePublicUrl CreatePublicUrl create

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:GetModel GetModel get

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:ModifyPublicUrlIpList ModifyPublicUrlIpList update

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:GetDataSource GetDataSource get

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:GetAdvanceConfig GetAdvanceConfig get

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:CloneSqlInstance CloneSqlInstance create

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#instanceId}

    		 無 無
    searchengine:GetFile GetFile get

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:PushDocuments PushDocuments

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:ListModels ListModels list

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:GetDatabaseSchema GetDatabaseSchema get

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#instanceId}

    		 無 無
    searchengine:ModifyPausePolicy ModifyPausePolicy update

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:StopIndex StopIndex update

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:ModifyIndexOnlineStrategy ModifyIndexOnlineStrategy

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#instanceId}

    		 無 無
    searchengine:CreateIndex CreateIndex create

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:ListPostQueryResult ListPostQueryResult list

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:ChangeResourceGroup ChangeResourceGroup update

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:CreateConfigDir CreateConfigDir

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無
    searchengine:DeleteInstance DeleteInstance delete

    *Instance

    acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    		 無 無

    資源（Resource）

    下表是Open Search定義的資源，這些資源可以在 RAM 權限原則語句的Resource元素中使用，用來授予對該資源執行具體操作的許可權。 其中，資源 ARN 是資源在阿里雲上的唯一標識。具體說明如下：

    • {#}為變數標識，需要您替換為實際值。例如：{#ramcode}需要您替換為實際的雲端服務RAM代碼。

    • *表示全部。例如：

      • {#resourceType}為*時：表示全部資源。

      • {#regionId}為*時：表示全部地區。

      • {#accountId}為*時：表示全部阿里雲帳號。

    資源類型

    資源 ARN
    Instance
    • acs:searchengine:{#regionId}:{#accountId}:instance/{#instanceId}
    • acs:searchengine:{#regionId}:{#accountId}:instance/*
    Folder
    • acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}
    SqlInstance
    • acs:searchengine:{#regionId}:{#accountId}:instance/{#InstanceId}

    條件（Condition）

    Open Search未定義產品層級的條件關鍵字。如需查看適用於所有雲產品的通用條件關鍵字，請參見通用條件關鍵字。

    相關操作

    您可以建立自訂權限原則，並將權限原則授予 RAM 使用者、RAM 使用者組或 RAM 角色。具體操作如下：