ALIYUN::RAM::ManagedPolicy類型用於建立Resource Access Management策略。
文法
{
"Type": "ALIYUN::RAM::ManagedPolicy",
"Properties": {
"PolicyName": String,
"Description": String,
"Roles": List,
"PolicyDocumentUnchecked": Map,
"PolicyDocument": Map,
"Groups": List,
"Users": List,
"IgnoreExisting": Boolean
}
}屬性
|
屬性名稱 |
類型 |
必須 |
允許更新 |
描述 |
約束 |
|
PolicyName |
String |
是 |
否 |
策略名稱稱。 |
最長為128個字元。 |
|
Description |
String |
否 |
否 |
策略描述。 |
最長為1024個字元。 |
|
Groups |
List |
否 |
否 |
適用此策略的使用者組。 |
無 |
|
IgnoreExisting |
Boolean |
否 |
否 |
是否忽略現有策略。 |
取值：
|
|
PolicyDocument |
Map |
否 |
是 |
策略詳細定義。 |
更多資訊，請參見PolicyDocument屬性。 |
|
PolicyDocumentUnchecked |
Map |
否 |
是 |
描述允許在哪些資源上執行哪些操作的策略文檔。 |
如果指定該參數，PolicyDocument將被忽略。 |
|
Roles |
List |
否 |
否 |
適用此策略的角色。 |
無 |
|
Users |
List |
否 |
否 |
適用此策略的使用者。 |
無 |
PolicyDocument文法
"PolicyDocument": {
"Version": String,
"Statement": List
}PolicyDocument屬性
|
屬性名稱 |
類型 |
必須 |
允許更新 |
描述 |
約束 |
|
Statement |
List |
是 |
否 |
策略具體規則。 |
更多資訊，請參見Statement屬性。 |
|
Version |
String |
是 |
否 |
策略版本。 |
無 |
Statement文法
"Statement": [
{
"Condition": Map,
"Action": List,
"Resource": List,
"Effect": String,
"NotAction": List
}
]Statement屬性
|
屬性名稱 |
類型 |
必須 |
允許更新 |
描述 |
約束 |
|
Action |
List |
否 |
否 |
權限原則針對的具體操作。 |
無 |
|
Condition |
Map |
否 |
否 |
授權生效的限制條件。 |
無 |
|
Effect |
String |
否 |
否 |
授權效力。 |
取值：
|
|
NotAction |
List |
否 |
否 |
允許或拒絕時例外的指定操作。 |
無 |
|
Resource |
List |
否 |
否 |
權限原則針對的具體資源。 |
無 |
傳回值
Fn::GetAtt
PolicyName：策略名稱稱。
樣本
情境 1 ：建立OSS唯讀權限原則並授權給指定RAM使用者。
ROSTemplateFormatVersion: '2015-09-01'
Description:
zh-cn: 建立OSS唯讀權限原則並授權給指定RAM使用者。
en: Create an OSS read-only policy and attach it to specified RAM users.
Parameters:
PolicyName:
Type: String
Label:
zh-cn: 策略名稱稱
en: Policy Name
Description:
zh-cn: RAM自訂策略名稱稱，最長128個字元。
en: RAM custom policy name, up to 128 characters.
Default: oss-readonly-policy
OssBucketName:
Type: String
Label:
zh-cn: OSS儲存桶名稱
en: OSS Bucket Name
Description:
zh-cn: 允許唯讀訪問的OSS儲存桶名稱。
en: The OSS bucket name to allow read-only access.
UserName:
Type: String
Label:
zh-cn: RAM使用者
en: RAM User
Description:
zh-cn: 要授權的RAM使用者名稱稱。
en: The RAM user to attach this policy to.
AssociationProperty: ALIYUN::RAM::User
Resources:
ManagedPolicy:
Type: ALIYUN::RAM::ManagedPolicy
Properties:
PolicyName:
Ref: PolicyName
Description:
Fn::Sub: 允許對OSS儲存桶${OssBucketName}進行唯讀訪問
PolicyDocument:
Version: '1'
Statement:
- Effect: Allow
Action:
- oss:GetObject
- oss:GetObjectAcl
- oss:ListObjects
- oss:GetBucket
- oss:GetBucketInfo
- oss:ListBuckets
Resource:
- Fn::Sub: acs:oss:*:*:${OssBucketName}
- Fn::Sub: acs:oss:*:*:${OssBucketName}/*
Users:
- Ref: UserName
Outputs:
PolicyName:
Label:
zh-cn: 策略名稱稱
en: Policy Name
Description:
zh-cn: 建立成功的RAM自訂策略名稱稱。
en: The name of the created RAM custom policy.
Value:
Fn::GetAtt:
- ManagedPolicy
- PolicyName{
"ROSTemplateFormatVersion": "2015-09-01",
"Description": {
"zh-cn": "建立OSS唯讀權限原則並授權給指定RAM使用者。",
"en": "Create an OSS read-only policy and attach it to specified RAM users."
},
"Parameters": {
"PolicyName": {
"Type": "String",
"Label": {
"zh-cn": "策略名稱稱",
"en": "Policy Name"
},
"Description": {
"zh-cn": "RAM自訂策略名稱稱，最長128個字元。",
"en": "RAM custom policy name, up to 128 characters."
},
"Default": "oss-readonly-policy"
},
"OssBucketName": {
"Type": "String",
"Label": {
"zh-cn": "OSS儲存桶名稱",
"en": "OSS Bucket Name"
},
"Description": {
"zh-cn": "允許唯讀訪問的OSS儲存桶名稱。",
"en": "The OSS bucket name to allow read-only access."
}
},
"UserName": {
"Type": "String",
"Label": {
"zh-cn": "RAM使用者",
"en": "RAM User"
},
"Description": {
"zh-cn": "要授權的RAM使用者名稱稱。",
"en": "The RAM user to attach this policy to."
},
"AssociationProperty": "ALIYUN::RAM::User"
}
},
"Resources": {
"ManagedPolicy": {
"Type": "ALIYUN::RAM::ManagedPolicy",
"Properties": {
"PolicyName": {
"Ref": "PolicyName"
},
"Description": {
"Fn::Sub": "允許對OSS儲存桶${OssBucketName}進行唯讀訪問"
},
"PolicyDocument": {
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"oss:GetObject",
"oss:GetObjectAcl",
"oss:ListObjects",
"oss:GetBucket",
"oss:GetBucketInfo",
"oss:ListBuckets"
],
"Resource": [
{
"Fn::Sub": "acs:oss:*:*:${OssBucketName}"
},
{
"Fn::Sub": "acs:oss:*:*:${OssBucketName}/*"
}
]
}
]
},
"Users": [
{
"Ref": "UserName"
}
]
}
}
},
"Outputs": {
"PolicyName": {
"Label": {
"zh-cn": "策略名稱稱",
"en": "Policy Name"
},
"Description": {
"zh-cn": "建立成功的RAM自訂策略名稱稱。",
"en": "The name of the created RAM custom policy."
},
"Value": {
"Fn::GetAtt": [
"ManagedPolicy",
"PolicyName"
]
}
}
}
}情境 2 ：建立ECS系統管理權限策略並附加IP條件限制，授權給使用者組和角色。
ROSTemplateFormatVersion: '2015-09-01'
Description:
zh-cn: 建立ECS系統管理權限策略並附加IP條件限制，授權給使用者組和角色。
en: Create an ECS management policy with IP condition and attach to groups and roles.
Parameters:
PolicyName:
Type: String
Label:
zh-cn: 策略名稱稱
en: Policy Name
Default: ecs-manage-ip-restricted
AllowedCidrBlock:
Type: String
Label:
zh-cn: 允許的源IP網段
en: Allowed Source CIDR
Description:
zh-cn: >-
允許發起請求的源IP網段，
例如10.0.0.0/8或192.168.1.0/24。
en: >-
Allowed source IP CIDR block,
e.g. 10.0.0.0/8 or 192.168.1.0/24.
Default: 10.0.0.0/8
GroupName:
Type: String
Label:
zh-cn: RAM使用者組
en: RAM Group
Description:
zh-cn: 要授權的RAM使用者組名稱。
en: The RAM group to attach this policy to.
AssociationProperty: ALIYUN::RAM::Group
RoleName:
Type: String
Label:
zh-cn: RAM角色
en: RAM Role
Description:
zh-cn: 要授權的RAM角色名稱。
en: The RAM role to attach this policy to.
AssociationProperty: ALIYUN::RAM::Role
Resources:
ManagedPolicy:
Type: ALIYUN::RAM::ManagedPolicy
Properties:
PolicyName:
Ref: PolicyName
Description: ECS執行個體系統管理權限，限定源IP訪問，禁止刪除和釋放操作
PolicyDocument:
Version: '1'
Statement:
- Effect: Allow
Action:
- ecs:DescribeInstances
- ecs:DescribeInstanceStatus
- ecs:DescribeInstanceAttribute
- ecs:StartInstance
- ecs:StopInstance
- ecs:RebootInstance
Resource:
- '*'
Condition:
IpAddress:
acs:SourceIp:
- Ref: AllowedCidrBlock
- Effect: Deny
Action:
- ecs:DeleteInstance
- ecs:ModifyInstanceAttribute
Resource:
- '*'
Groups:
- Ref: GroupName
Roles:
- Ref: RoleName
Outputs:
PolicyName:
Label:
zh-cn: 策略名稱稱
en: Policy Name
Description:
zh-cn: 建立成功的RAM自訂策略名稱稱。
en: The name of the created RAM custom policy.
Value:
Fn::GetAtt:
- ManagedPolicy
- PolicyName{
"ROSTemplateFormatVersion": "2015-09-01",
"Description": {
"zh-cn": "建立ECS系統管理權限策略並附加IP條件限制，授權給使用者組和角色。",
"en": "Create an ECS management policy with IP condition and attach to groups and roles."
},
"Parameters": {
"PolicyName": {
"Type": "String",
"Label": {
"zh-cn": "策略名稱稱",
"en": "Policy Name"
},
"Default": "ecs-manage-ip-restricted"
},
"AllowedCidrBlock": {
"Type": "String",
"Label": {
"zh-cn": "允許的源IP網段",
"en": "Allowed Source CIDR"
},
"Description": {
"zh-cn": "允許發起請求的源IP網段，例如10.0.0.0/8或192.168.1.0/24。",
"en": "Allowed source IP CIDR block, e.g. 10.0.0.0/8 or 192.168.1.0/24."
},
"Default": "10.0.0.0/8"
},
"GroupName": {
"Type": "String",
"Label": {
"zh-cn": "RAM使用者組",
"en": "RAM Group"
},
"Description": {
"zh-cn": "要授權的RAM使用者組名稱。",
"en": "The RAM group to attach this policy to."
},
"AssociationProperty": "ALIYUN::RAM::Group"
},
"RoleName": {
"Type": "String",
"Label": {
"zh-cn": "RAM角色",
"en": "RAM Role"
},
"Description": {
"zh-cn": "要授權的RAM角色名稱。",
"en": "The RAM role to attach this policy to."
},
"AssociationProperty": "ALIYUN::RAM::Role"
}
},
"Resources": {
"ManagedPolicy": {
"Type": "ALIYUN::RAM::ManagedPolicy",
"Properties": {
"PolicyName": {
"Ref": "PolicyName"
},
"Description": "ECS執行個體系統管理權限，限定源IP訪問，禁止刪除和釋放操作",
"PolicyDocument": {
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ecs:DescribeInstances",
"ecs:DescribeInstanceStatus",
"ecs:DescribeInstanceAttribute",
"ecs:StartInstance",
"ecs:StopInstance",
"ecs:RebootInstance"
],
"Resource": [
"*"
],
"Condition": {
"IpAddress": {
"acs:SourceIp": [
{
"Ref": "AllowedCidrBlock"
}
]
}
}
},
{
"Effect": "Deny",
"Action": [
"ecs:DeleteInstance",
"ecs:ModifyInstanceAttribute"
],
"Resource": [
"*"
]
}
]
},
"Groups": [
{
"Ref": "GroupName"
}
],
"Roles": [
{
"Ref": "RoleName"
}
]
}
}
},
"Outputs": {
"PolicyName": {
"Label": {
"zh-cn": "策略名稱稱",
"en": "Policy Name"
},
"Description": {
"zh-cn": "建立成功的RAM自訂策略名稱稱。",
"en": "The name of the created RAM custom policy."
},
"Value": {
"Fn::GetAtt": [
"ManagedPolicy",
"PolicyName"
]
}
}
}
}情境 3 ：建立跨服務權限原則並同時授權給使用者、使用者組和角色，實現全面的許可權分發
ROSTemplateFormatVersion: '2015-09-01'
Description:
zh-cn: 建立跨服務權限原則並同時授權給使用者、使用者組和角色，實現全面的許可權分發。
en: Create a cross-service policy and attach to users, groups and roles for comprehensive authorization.
Parameters:
PolicyName:
Type: String
Label:
zh-cn: 策略名稱稱
en: Policy Name
Description:
zh-cn: RAM自訂策略名稱稱。
en: RAM custom policy name.
Default: cross-service-devops-policy
UserNames:
Type: Json
Label:
zh-cn: RAM使用者列表
en: RAM User List
Description:
zh-cn: 要授權的RAM使用者名稱稱列表。
en: List of RAM user names to attach this policy to.
Default: []
AssociationProperty: List[Parameter]
AssociationPropertyMetadata:
Parameter:
Type: String
Required: false
AssociationProperty: ALIYUN::RAM::User
Label:
zh-cn: RAM使用者
en: RAM User
GroupNames:
Type: Json
Label:
zh-cn: RAM使用者組列表
en: RAM Group List
Description:
zh-cn: 要授權的RAM使用者組名稱列表。
en: List of RAM group names to attach this policy to.
Default: []
AssociationProperty: List[Parameter]
AssociationPropertyMetadata:
Parameter:
Type: String
Required: false
AssociationProperty: ALIYUN::RAM::Group
Label:
zh-cn: RAM使用者組
en: RAM Group
RoleNames:
Type: Json
Label:
zh-cn: RAM角色列表
en: RAM Role List
Description:
zh-cn: 要授權的RAM角色名稱列表。
en: List of RAM role names to attach this policy to.
Default: []
AssociationProperty: List[Parameter]
AssociationPropertyMetadata:
Parameter:
Type: String
Required: false
AssociationProperty: ALIYUN::RAM::Role
Label:
zh-cn: RAM角色
en: RAM Role
Resources:
ManagedPolicy:
Type: ALIYUN::RAM::ManagedPolicy
Properties:
PolicyName:
Ref: PolicyName
Description: 跨服務DevOps權限原則，覆蓋ECS、RDS、SLB、VPC和CloudMonitor
PolicyDocumentUnchecked:
Version: '1'
Statement:
- Effect: Allow
Action:
- ecs:Describe*
- ecs:StartInstance
- ecs:StopInstance
- ecs:RebootInstance
Resource:
- '*'
- Effect: Allow
Action:
- rds:Describe*
- rds:ModifyDBInstanceSpec
- rds:SwitchDBInstanceHA
Resource:
- '*'
- Effect: Allow
Action:
- slb:Describe*
- slb:SetBackendServers
- slb:AddBackendServers
- slb:RemoveBackendServers
Resource:
- '*'
- Effect: Allow
Action:
- vpc:Describe*
Resource:
- '*'
- Effect: Allow
Action:
- cms:Describe*
- cms:QueryMetric*
Resource:
- '*'
- Effect: Deny
Action:
- ecs:DeleteInstance
- rds:DeleteDBInstance
- slb:DeleteLoadBalancer
Resource:
- '*'
Users:
Ref: UserNames
Groups:
Ref: GroupNames
Roles:
Ref: RoleNames
IgnoreExisting: true
Outputs:
PolicyName:
Label:
zh-cn: 策略名稱稱
en: Policy Name
Description:
zh-cn: 建立成功的RAM自訂策略名稱稱。
en: The name of the created RAM custom policy.
Value:
Fn::GetAtt:
- ManagedPolicy
- PolicyName{
"ROSTemplateFormatVersion": "2015-09-01",
"Description": {
"zh-cn": "建立跨服務權限原則並同時授權給使用者、使用者組和角色，實現全面的許可權分發。",
"en": "Create a cross-service policy and attach to users, groups and roles for comprehensive authorization."
},
"Parameters": {
"PolicyName": {
"Type": "String",
"Label": {
"zh-cn": "策略名稱稱",
"en": "Policy Name"
},
"Description": {
"zh-cn": "RAM自訂策略名稱稱。",
"en": "RAM custom policy name."
},
"Default": "cross-service-devops-policy"
},
"UserNames": {
"Type": "Json",
"Label": {
"zh-cn": "RAM使用者列表",
"en": "RAM User List"
},
"Description": {
"zh-cn": "要授權的RAM使用者名稱稱列表。",
"en": "List of RAM user names to attach this policy to."
},
"Default": [],
"AssociationProperty": "List[Parameter]",
"AssociationPropertyMetadata": {
"Parameter": {
"Type": "String",
"Required": false,
"AssociationProperty": "ALIYUN::RAM::User",
"Label": {
"zh-cn": "RAM使用者",
"en": "RAM User"
}
}
}
},
"GroupNames": {
"Type": "Json",
"Label": {
"zh-cn": "RAM使用者組列表",
"en": "RAM Group List"
},
"Description": {
"zh-cn": "要授權的RAM使用者組名稱列表。",
"en": "List of RAM group names to attach this policy to."
},
"Default": [],
"AssociationProperty": "List[Parameter]",
"AssociationPropertyMetadata": {
"Parameter": {
"Type": "String",
"Required": false,
"AssociationProperty": "ALIYUN::RAM::Group",
"Label": {
"zh-cn": "RAM使用者組",
"en": "RAM Group"
}
}
}
},
"RoleNames": {
"Type": "Json",
"Label": {
"zh-cn": "RAM角色列表",
"en": "RAM Role List"
},
"Description": {
"zh-cn": "要授權的RAM角色名稱列表。",
"en": "List of RAM role names to attach this policy to."
},
"Default": [],
"AssociationProperty": "List[Parameter]",
"AssociationPropertyMetadata": {
"Parameter": {
"Type": "String",
"Required": false,
"AssociationProperty": "ALIYUN::RAM::Role",
"Label": {
"zh-cn": "RAM角色",
"en": "RAM Role"
}
}
}
}
},
"Resources": {
"ManagedPolicy": {
"Type": "ALIYUN::RAM::ManagedPolicy",
"Properties": {
"PolicyName": {
"Ref": "PolicyName"
},
"Description": "跨服務DevOps權限原則，覆蓋ECS、RDS、SLB、VPC和CloudMonitor",
"PolicyDocumentUnchecked": {
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ecs:Describe*",
"ecs:StartInstance",
"ecs:StopInstance",
"ecs:RebootInstance"
],
"Resource": [
"*"
]
},
{
"Effect": "Allow",
"Action": [
"rds:Describe*",
"rds:ModifyDBInstanceSpec",
"rds:SwitchDBInstanceHA"
],
"Resource": [
"*"
]
},
{
"Effect": "Allow",
"Action": [
"slb:Describe*",
"slb:SetBackendServers",
"slb:AddBackendServers",
"slb:RemoveBackendServers"
],
"Resource": [
"*"
]
},
{
"Effect": "Allow",
"Action": [
"vpc:Describe*"
],
"Resource": [
"*"
]
},
{
"Effect": "Allow",
"Action": [
"cms:Describe*",
"cms:QueryMetric*"
],
"Resource": [
"*"
]
},
{
"Effect": "Deny",
"Action": [
"ecs:DeleteInstance",
"rds:DeleteDBInstance",
"slb:DeleteLoadBalancer"
],
"Resource": [
"*"
]
}
]
},
"Users": {
"Ref": "UserNames"
},
"Groups": {
"Ref": "GroupNames"
},
"Roles": {
"Ref": "RoleNames"
},
"IgnoreExisting": true
}
}
},
"Outputs": {
"PolicyName": {
"Label": {
"zh-cn": "策略名稱稱",
"en": "Policy Name"
},
"Description": {
"zh-cn": "建立成功的RAM自訂策略名稱稱。",
"en": "The name of the created RAM custom policy."
},
"Value": {
"Fn::GetAtt": [
"ManagedPolicy",
"PolicyName"
]
}
}
}
}