RAM authorization - Application Real-Time Monitoring Service

Resource Access Management (RAM) is a service provided by Alibaba Cloud to manage user identities and resource access permissions. You can use RAM to prevent RAM users from sharing the AccessKey pairs of your Alibaba Cloud account. You can also use RAM to grant minimum permissions to RAM users. RAM uses policies to define permissions.

This topic describes the elements, such as Action, Resource, and Condition, which are defined by ARMS. You can use the elements to create policies in RAM. The code (RamCode) in RAM that is used to indicate ARMS is arms,xtrace. You can grant permissions on ARMS at the RESOURCE.

General structure of a policy

Policies can be stored as JSON files. The following code provides an example on the general structure of a policy:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

The following list describes the fields in the policy:

Effect: specifies the authorization effect. Valid values: Allow, Deny.
Action: specifies one or more API operations that are allowed or denied. For more information, see the Action section of this topic.
Resource: specifies one or more resources to which the policy applies. You can use an Alibaba Cloud Resource Name (ARN) to specify a resource. For more information, see the Resource section of this topic.
Condition: specifies one or more conditions that are required for the policy to take effect. This is an optional field. For more information, see the Condition section of this topic.
- Condition_operator: specifies the conditional operators. Different types of conditions support different conditional operators. For more information, see Policy elements.
- Condition_key: specifies the condition keys.
- Condition_value: specifies the condition values.

Action

ARMS defines the values that you can use in the Action element of a policy statement. The following table describes the values.

Operation: the value that you can use in the Action element to specify the operation on a resource.
API operation: the API operation that you can call to perform the operation.
Access level: the access level of each operation. The levels are read, write, and list.
Resource type: the type of the resource on which you can authorize the RAM user or the RAM role to perform the operation. Take note of the following items:
- The required resource types are displayed in bold characters.
- If the permissions cannot be granted at the resource level, All Resources is used in the Resource type column of the operation.
Condition key: the condition keys that are defined by the Alibaba Cloud service. The Condition key column does not list the common condition keys that are defined by Alibaba Cloud. For more information about the common condition keys, see Generic Condition Keyword.
Associated operation: other operations that the RAM user or the RAM role must have permissions to perform to complete the operation. To complete the operation, the RAM user or the RAM role must have the permissions to perform the associated operations.

Actions	API operation	Access level	Resource type	Condition key	Associated operation
arms:DeleteTraceApp	DeleteTraceApp	none	TraceApp acs:arms:{#regionId}:{#AccountId}:traceapp/{#Pid}	None	None
arms:UntagResources	UntagResources	update	All Resources *	None	None
arms:GetTrace	GetTrace	none	All Resources *	None	None
arms:QueryCommercialUsage	QueryCommercialUsage	get	All Resources *	None	None
arms:ChangeResourceGroup	ChangeResourceGroup	update	All Resources *	None	None
arms:CheckCommercialStatus	CheckCommercialStatus	none	All Resources *	None	None
arms:QueryTopology	QueryAppTopology	get	All Resources *	None	None
arms:GetCommercialStatus	GetCommercialStatus	none	All Resources *	None	None
arms:QueryMetricByPage	QueryMetricByPage	get	All Resources *	None	None
arms:GetAlert	ListInsightsEvents	none	All Resources *	None	None
arms:QueryReleaseMetric	QueryReleaseMetric	none	All Resources *	None	None
arms:TagResources	TagResources	update	Prometheus acs:arms:{#regionId}:{#accountId}:prometheus/{#ClusterId} RetcodeApp acs:arms:{#regionId}:{#accountId}:retcodeapp/{#Pid} TraceApp acs:arms:{#regionId}:{#accountId}:traceapp/{#Pid} Environment acs:arms:{#regionId}:{#accountId}:environment/{#EnvironmentId} GrafanaWorkspace acs:arms:{#regionId}:{#accountId}:grafanaworkspace/{#GrafanaWorkspaceId}	None	None
arms:OpenArmsDefaultSLR	OpenArmsDefaultSLR	none	All Resources *	None	None
arms:GetAppJVMConfig	GetAppJVMConfig	none	All Resources *	None	None
arms:DeleteAppList	DeleteAppList	none	TraceApp acs:arms:{#regionId}:{#accountId}:traceapp/{#Pid}	None	None
arms:SaveTraceAppConfig	SaveTraceAppConfig	none	TraceApp acs:arms:{#regionId}:{#accountId}:traceapp/{#Pid}	None	None
arms:GetAppApiPageInfo	GetAppApiByPage	none	All Resources *	None	None
arms:GetAgentDownloadUrl	GetAgentDownloadUrl	none	All Resources *	None	None
arms:SearchTraces	SearchTraces	none	All Resources *	None	None
arms:OpenArmsService	OpenArmsServiceSecondVersion	none	All Resources *	None	None
arms:QueryAppMetadata	QueryAppMetadata	get	All Resources *	None	None
arms:SearchTracesByPage	SearchTracesByPage	none	All Resources *	None	None
arms:SearchTraceAppByPage	SearchTraceAppByPage	none	TraceApp acs:arms:{#regionId}:{#accountId}:traceapp/*	None	None
arms:DoInsightsAction	DoInsightsAction	get	All Resources *	None	None
arms:ListTraceApps	ListTraceApps	none	All Resources *	None	None
arms:GetMultipleTrace	GetMultipleTrace	none	All Resources *	None	None
arms:GetTraceApp	GetTraceApp	none	TraceApp acs:arms:{#regionId}:{#AccountId}:traceapp/{#Pid}	None	None
arms:GetTraceAppConfig	GetTraceAppConfig	get	TraceApp acs:arms:{#regionId}:{#accountId}:traceapp/{#Pid}	None	None
arms:OpenXtraceDefaultSLR	OpenXtraceDefaultSLR	none	All Resources *	None	None
arms:ConfigApp	ConfigApp	none	All Resources *	None	None
arms:SearchTraceAppByName	SearchTraceAppByName	get	TraceApp acs:arms:{#regionId}:{#AccountId}:traceapp/{#Pid}	None	None
arms:DescribeTraceLicenseKey	DescribeTraceLicenseKey	none	All Resources *	None	None
arms:GetStack	GetStack	none	All Resources *	None	None

Resource

ARMS defines the values that you can use in the Resource. You can attach the policy to a RAM user or a RAM role so that the RAM user or the RAM role can perform a specific operation on a specific resource. The ARN is the unique identifier of the resource on Alibaba Cloud. Take note of the following items:

{#}indicates a variable. {#} must be replaced with an actual value. For example, {#ramcode} must be replaced with the actual code of an Alibaba Cloud service in RAM.
An asterisk (*) is used as a wildcard. Examples:
- {#resourceType} is set to *, all resources are specified.
- {#regionId} is set to *, all regions are specified.
- {#accountId} is set to *, all Alibaba Cloud accounts are specified.

Resource type	ARN
Prometheus	acs:arms:{#regionId}:{#accountId}:prometheus/*
Prometheus	acs:arms:{#regionId}:{#accountId}:prometheus/{#ClusterId}
TraceApp	acs:arms:{#regionId}:{#AccountId}:traceapp/{#Pid}
GrafanaWorkspace	acs:arms:{#regionId}:{#accountId}:grafanaworkspace/{#GrafanaWorkspaceId}
TraceApp	acs:arms:{#regionId}:{#accountId}:traceapp/{#Pid}
AlertRule	acs:arms:{#regionId}:{#AccountId}:alertrule/{#AlertRuled}
RetcodeApp	acs:arms:{#regionId}:{#accountId}:retcodeapp/{#Pid}
Environment	acs:arms:{#regionId}:{#accountId}:environment/{#EnvironmentId}
RetcodeApp	acs:arms:{#regionId}:{#accountId}:retcodeapp/*
Prometheus	acs:arms:{#regionId}:{#accountId}:prometheus/{#prometheusId}
Environment	acs:arms:{#regionId}:{#accountId}:environment/{#environmentId}
Environment	acs:arms:{#regionId}:{#accountId}:environment/*
Prometheus	acs:arms:{#regionId}:{#accountId}:Prometheus/#{ClusterId}
SyntheticTask	acs:arms:{#regionId}:{#accountId}:synthetictask/{#TaskId}
Prometheus	acs:arms:{#regionId}:{#accountId}:Prometheus/{#ClusterId}
Prometheus	acs:arms:{#regionId}:{#accountId}:Prometheus/*
GrafanaWorkspace	acs:arms:{#regionId}:{#accountId}:grafanaworkspace/*
GrafanaWorkspace	acs:arms:{#regionId}:{#AccountId}:grafanaworkspace/*
TraceApp	acs:arms:{#regionId}:{#accountId}:traceapp/*
PrometheusAlertRule	acs:arms:${Region}:${AccountId}:prometheus/${ClusterId}/prometheusalertrule/${PrometheusAlertRuleId}
XTraceApp	acs:arms:{#regionId}:{#accountId}:xtraceapp/{#Pid}
Rum	acs:arms:{#regionId}:{#accountId}:rum/*
PrometheusAlertRule	acs:arms:${Region}:${AccountId}:prometheus/${ClusterId}/prometheusalertrule/*
SyntheticTask	acs:arms:{#regionId}:{#accountId}:*
PrometheusMonitoring	acs:arms:{#regionId}:{#accountId}:prometheus/{#clusterId}/monitoring/*
PrometheusMonitoring	acs:arms:{#regionId}:{#accountId}:prometheus/{#clusterId}/monitoring/{#type}/{#monitoringName}/*
RetcodeApp	acs:arms:{#regionId}:{#accountId}:retcodeapp/{#RetcodeAppId}
IntegrationExporter	acs:arms:{#regionId}:{#accountId}:prometheus/{#clusterId}
AlertRule	acs:arms:{#regionId}:{#accountId}:AlertRule/{#AlertRuled}
IntegrationExporter	acs:arms:{#regionId}:{#accountId}:prometheus/{#ClusterId}
PrometheusMonitoring	acs:arms:{#regionId}:{#accountId}:prometheus/{#ClusterId}
Prometheus	acs:arms:{#regionId}:{#accountId}:prometheus/{#clusterId}
PrometheusMonitoring	acs:arms:{#regionId}:{#accountId}:prometheus/{#clusterId}/monitoring/{#type}/*
XTraceApp	acs:arms:{#regionId}:{#accountId}:xtraceapp/*
PrometheusAlertRule	acs:arms:{#regionId}:{#accountId}:prometheusalertrule/{#ClusterId}/{#PrometheusAlertRuleId}
RetcodeApp	acs:arms:{#regionId}:{#AccountId}:retcodeapp/{#Pid}
Prometheus	acs:arms:{#regionId}:{#AccountId}:prometheus/{#ClusterId}
GrafanaWorkspace	acs:arms:{#regionId}:{#AccountId}:grafanaworkspace/{#GrafanaWorkspaceId}
SyntheticTask	acs:arms:{#regionId}:{#AccountId}:synthetictask/{#TaskId}
IntegrationExporter	acs:arms:${Region}:${AccountId}:prometheus/${ClusterId}/integrationexporter/*
PrometheusMonitoring	acs:arms:{#regionId}:{#accountId}:prometheus/{#clusterId}/monitoring/{#type}/{#monitoringName}
SyntheticTask	acs:arms:{#regionId}:{#accountId}:synthetictask/*
AgentInfo	acs:arms:{#regionId}:{#accountId}:
AlertRule	acs:arms:{#regionId}:{#AccountId}:AlertRule/*
PrometheusAlertRule	acs:arms:{#regionId}:${AccountId}:prometheus/${ClusterId}/prometheusalertrule/*

Condition

ARMS does not define service-specific condition keys. For more information about common condition keys that are defined by Alibaba Cloud, see Generic Condition Keyword.

What to do next

You can create a custom policy and attach the policy to a RAM user, RAM user group, or RAM role. For more information, see the following topics: