RAM用户调用资源管理API前，需要阿里云账号（主账号）创建权限策略并对RAM用户进行授权。在权限策略中，使用资源描述符ARN（Aliyun Resource Name）指定授权资源。

资源（Resource）中用到的字段含义如下，请在使用时替换为实际值。

  • <account_id>：阿里云账号（主账号）ID。
  • <resourcegroup_id>：资源组ID。
  • <policy_name>：权限策略名称。
  • <role_name>：RAM角色名称。
  • <resource_type>：资源类型。
  • <resource_id>：资源ID。
  • <region_id>：地域ID。
  • <product>：云服务代码。
  • <handshake_id>：成员邀请ID。
  • <policy_id>：管控策略ID。
  • <resource_directory_path>：RDPath，资源夹或成员在资源目录中的位置信息。

对于必选的资源类型，用加粗字体显示。

资源组鉴权列表

下表列举了资源组中可授权的操作（Action）和资源（Resource）。

ActionResource
ram:CreateResourceGroupacs:ram:*:<account_id>:resourcegroup/*
ram:DeleteResourceGroupacs:ram:*:<account_id>:resourcegroup/<resourcegroup_id>
ram:UpdateResourceGroupacs:ram:*:<account_id>:resourcegroup/<resourcegroup_id>
ram:CreatePolicyacs:ram:*:<account_id>:policy/*
ram:DeletePolicyacs:ram:*:<account_id>:policy/<policy_name>
ram:ListPoliciesacs:ram:*:<account_id>:policy/*
ram:GetPolicyacs:ram:*:<account_id>:policy/<policy_name>
ram:CreatePolicyVersionacs:ram:*:<account_id>:policy/<policy_name>
ram:DeletePolicyVersionacs:ram:*:<account_id>:policy/<policy_name>
ram:ListPolicyVersionsacs:ram:*:<account_id>:policy/<policy_name>
ram:GetPolicyVersionacs:ram:*:<account_id>:policy/<policy_name>
ram:SetDefaultPolicyVersionacs:ram:*:<account_id>:policy/<policy_name>
ram:AttachPolicy
  • Policy：

    acs:ram:*:system:policy/<policy_name>或acs:ram:*:<account_id>:policy/<policy_name>

  • IMSUser：

    acs:ims:*:<account_id>:user/*

  • IMSGroup：

    acs:ims:*:<account_id>:group/*

  • ServiceRole：

    acs:ram:*:<account_id>:role/*

ram:DetachPolicy
  • Policy：

    acs:ram:*:system:policy/<policy_name>或acs:ram:*:<account_id>:policy/<policy_name>

  • IMSUser：

    acs:ims:*:<account_id>:user/*

  • IMSGroup：

    acs:ims:*:<account_id>:group/*

  • ServiceRole：

    acs:ram:*:<account_id>:role/*

ram:ListPolicyAttachmentsacs:ram:*:<account_id>:*
ram:CreateRoleacs:ram:*:<account_id>:role/*
ram:GetRoleacs:ram:*:<account_id>:role/<role_name>
ram:ListRolesacs:ram:*:<account_id>:role/*
ram:UpdateRoleacs:ram:*:<account_id>:role/<role_name>
ram:DeleteRoleacs:ram:*:<account_id>:role/<role_name>
ram:CreateServiceLinkedRoleacs:ram:*:<account_id>:role/*
ram:DeleteServiceLinkedRoleacs:ram:*:<account_id>:role/<role_name>
ram:GetServiceLinkedRoleDeletionStatusacs:ram:*:<account_id>:role/<role_name>

资源目录鉴权列表

下表列举了资源目录中可授权的操作（Action）和资源（Resource）。

ActionResource
resourcemanager:AcceptHandshakeacs:resourcemanager:*:<account_id>:handshake/<handshake_id>
resourcemanager:AttachControlPolicy
  • ControlPolicy：

    acs:resourcemanager:*:<account_id>:policy/controlpolicy/<policy_id>

  • Account：

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

  • Folder：

    acs:resourcemanager:*:<account_id>:folder/<resource_directory_path>

resourcemanager:BindSecureMobilePhoneacs:resourcemanager:*:<account_id>:account/<resource_directory_path>
resourcemanager:CancelHandshakeacs:resourcemanager:*:<account_id>:handshake/<handshake_id>
resourcemanager:CheckAccountDeleteacs:resourcemanager:*:<account_id>:account/<resource_directory_path>
resourcemanager:CreateCloudAccountacs:resourcemanager:*:<account_id>:*
resourcemanager:CreateControlPolicyacs:resourcemanager:*:<account_id>:policy/controlpolicy/*
resourcemanager:CreateFolderacs:resourcemanager:*:<account_id>:folder/<resource_directory_path>
resourcemanager:CreateResourceAccountacs:resourcemanager:*:<account_id>:folder/<resource_directory_path>
resourcemanager:DeclineHandshakeacs:resourcemanager:*:<account_id>:handshake/<handshake_id>
resourcemanager:DeleteAccountacs:resourcemanager:*:<account_id>:account/<resource_directory_path>
resourcemanager:DeleteControlPolicyacs:resourcemanager:*:<account_id>:policy/controlpolicy/<policy_id>
resourcemanager:DeleteFolderacs:resourcemanager:*:<account_id>:folder/<resource_directory_path>
resourcemanager:DeregisterDelegatedAdministratoracs:resourcemanager:*:<account_id>:account/<resource_directory_path>
resourcemanager:DestroyResourceDirectoryacs:resourcemanager:*:<account_id>:*
resourcemanager:DetachControlPolicy
  • ControlPolicy：

    acs:resourcemanager:*:<account_id>:policy/controlpolicy/<policy_id>

  • Account：

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

  • Folder：

    acs:resourcemanager:*:<account_id>:folder/<resource_directory_path>

resourcemanager:DisableControlPolicyacs:resourcemanager:*:<account_id>:policy/controlpolicy/*
resourcemanager:EnableControlPolicyacs:resourcemanager:*:<account_id>:policy/controlpolicy/*
resourcemanager:EnableResourceDirectoryacs:resourcemanager:*:<account_id>:*
resourcemanager:GetAccountacs:resourcemanager:*:<account_id>:account/<resource_directory_path>
resourcemanager:GetAccountDeletionCheckResultacs:resourcemanager:*:<account_id>:account/<resource_directory_path>
resourcemanager:GetAccountDeletionStatusacs:resourcemanager:*:<account_id>:account/<resource_directory_path>
resourcemanager:GetControlPolicyacs:resourcemanager:*:<account_id>:policy/controlpolicy/<policy_id>
resourcemanager:GetControlPolicyEnablementStatusacs:resourcemanager:*:<account_id>:policy/controlpolicy/*
resourcemanager:GetFolderacs:resourcemanager:*:<account_id>:folder/<resource_directory_path>
resourcemanager:GetHandshakeacs:resourcemanager:*:<account_id>:handshake/<handshake_id>
resourcemanager:GetPayerForAccountacs:resourcemanager:*:<account_id>:account/<resource_directory_path>
resourcemanager:GetResourceDirectoryacs:resourcemanager:*:<account_id>:*
resourcemanager:InviteAccountToResourceDirectory
  • Handshake：

    acs:resourcemanager:*:<account_id>:handshake/*

  • Folder：

    acs:resourcemanager:*:<account_id>:folder/<resource_directory_path>

resourcemanager:ListAccountsacs:resourcemanager:*:<account_id>:account/*
resourcemanager:ListAccountsForParentacs:resourcemanager:*:<account_id>:folder/<resource_directory_path>
resourcemanager:ListAncestorsacs:resourcemanager:*:<account_id>:folder/*
resourcemanager:ListControlPoliciesacs:resourcemanager:*:<account_id>:policy/controlpolicy/*
resourcemanager:ListControlPolicyAttachmentsForTarget
  • ControlPolicy：

    acs:resourcemanager:*:<account_id>:policy/controlpolicy/<policy_id>

  • Account：

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

  • Folder：

    acs:resourcemanager:*:<account_id>:folder/<resource_directory_path>

resourcemanager:ListDelegatedAdministratorsacs:resourcemanager:*:<account_id>:account/*
resourcemanager:ListDelegatedServicesForAccountacs:resourcemanager:*:<account_id>:account/<resource_directory_path>
resourcemanager:ListFoldersForParentacs:resourcemanager:*:<account_id>:folder/<resource_directory_path>
resourcemanager:ListHandshakesForAccountacs:resourcemanager:*:<account_id>:handshake/*
resourcemanager:ListHandshakesForResourceDirectoryacs:resourcemanager:*:<account_id>:handshake/*
resourcemanager:ListTagKeysacs:resourcemanager:*:<account_id>:*
resourcemanager:ListTagResourcesacs:resourcemanager:*:<account_id>:*
resourcemanager:ListTagValuesacs:resourcemanager:*:<account_id>:*
resourcemanager:ListTargetAttachmentsForControlPolicyacs:resourcemanager:*:<account_id>:policy/controlpolicy/<policy_id>
resourcemanager:ListTrustedServiceStatusacs:resourcemanager:*:<account_id>:*
resourcemanager:MoveAccount
  • Account：

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

  • Folder：

    acs:resourcemanager:*:<account_id>:folder/<resource_directory_path>

resourcemanager:PromoteResourceAccountacs:resourcemanager:*:<account_id>:*
resourcemanager:RegisterDelegatedAdministratoracs:resourcemanager:*:<account_id>:account/<resource_directory_path>
resourcemanager:RemoveCloudAccountacs:resourcemanager:*:<account_id>:account/<resource_directory_path>
resourcemanager:SendVerificationCodeForBindSecureMobilePhoneacs:resourcemanager:*:<account_id>:account/<resource_directory_path>
resourcemanager:SendVerificationCodeForEnableRDacs:resourcemanager:*:<account_id>:*
resourcemanager:TagResourcesacs:resourcemanager:*:<account_id>:*
resourcemanager:UntagResourcesacs:resourcemanager:*:<account_id>:*
resourcemanager:UpdateAccountacs:resourcemanager:*:<account_id>:account/<resource_directory_path>
resourcemanager:UpdateControlPolicyacs:resourcemanager:*:<account_id>:policy/controlpolicy/<policy_id>
resourcemanager:UpdateFolderacs:resourcemanager:*:<account_id>:folder/<resource_directory_path>

资源共享鉴权列表

下表列举了资源共享中可授权的操作（Action）和资源（Resource）。

ActionResource
resourcesharing:EnableSharingWithResourceDirectoryacs:resourcesharing:<region_id>:<account_id>:*
resourcesharing:CreateResourceShareacs:resourcesharing:<region_id>:<account_id>:*
resourcesharing:UpdateResourceShareacs:resourcesharing:<region_id>:<account_id>:*
resourcesharing:DeleteResourceShareacs:resourcesharing:<region_id>:<account_id>:*
resourcesharing:ListResourceSharesacs:resourcesharing:<region_id>:<account_id>:*
resourcesharing:AssociateResourceShareacs:resourcesharing:<region_id>:<account_id>:*
resourcesharing:DisassociateResourceShareacs:resourcesharing:<region_id>:<account_id>:*
resourcesharing:ListResourceShareAssociationsacs:resourcesharing:<region_id>:<account_id>:*
resourcesharing:ListSharedResourcesacs:resourcesharing:<region_id>:<account_id>:*
resourcesharing:ListSharedTargetsacs:resourcesharing:<region_id>:<account_id>:*
resourcesharing:DescribeRegionsacs:resourcesharing:<region_id>:<account_id>:*
resourcesharing:ListResourceShareInvitationsacs:resourcesharing:<region_id>:<account_id>:*
resourcesharing:AcceptResourceShareInvitationacs:resourcesharing:<region_id>:<account_id>:*
resourcesharing:RejectResourceShareInvitationacs:resourcesharing:<region_id>:<account_id>:*
resourcesharing:AssociateResourceSharePermissionacs:resourcesharing:<region_id>:<account_id>:*
resourcesharing:DisassociateResourceSharePermissionacs:resourcesharing:<region_id>:<account_id>:*
resourcesharing:ListResourceSharePermissionsacs:resourcesharing:<region_id>:<account_id>:*
resourcesharing:GetPermissionacs:resourcesharing:<region_id>:<account_id>:*
resourcesharing:ListPermissionVersionsacs:resourcesharing:<region_id>:<account_id>:*
resourcesharing:ListPermissionsacs:resourcesharing:<region_id>:<account_id>:*

标签鉴权列表

下表列举了标签中可授权的操作（Action）和资源（Resource）。

ActionResource
tag:ListTagResourcesacs:tag:<region_id>:<account_id>:<resource_type>/<resource_id>
tag:TagResources
  • acs:tag:<region_id>:<account_id>:<resource_type>/<resource_id>
  • acs:<product>:<region_id>:<account_id>:<resource_type>/<resource_id>
tag:UntagResources
  • acs:tag:<region_id>:<account_id>:<resource_type>/<resource_id>
  • acs:<product>:<region_id>:<account_id>:<resource_type>/<resource_id>
tag:ListTagKeysacs:tag:<region_id>:<account_id>:*/*
tag:ListTagValuesacs:tag:<region_id>:<account_id>:*/*
tag:CreateTagsacs:tag:<region_id>:<account_id>:*/*
tag:DeleteTagacs:tag:<region_id>:<account_id>:*/*