RAM authorization - Alibaba Cloud Service Mesh - Alibaba Cloud Documentation Center

Resource Access Management (RAM) is a service provided by Alibaba Cloud to manage user identities and resource access permissions. You can use RAM to prevent RAM users from sharing the AccessKey pairs of your Alibaba Cloud account. You can also use RAM to grant minimum permissions to RAM users. RAM uses policies to define permissions.

This topic describes the elements, such as Action, Resource, and Condition, which are defined by ServiceMesh. You can use the elements to create policies in RAM. The code (RamCode) in RAM that is used to indicate ServiceMesh is servicemesh. You can grant permissions on ServiceMesh at the RESOURCE.

General structure of a policy

Policies can be stored as JSON files. The following code provides an example on the general structure of a policy:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

The following list describes the fields in the policy:

Effect: specifies the authorization effect. Valid values: Allow, Deny.
Action: specifies one or more API operations that are allowed or denied. For more information, see the Action section of this topic.
Resource: specifies one or more resources to which the policy applies. You can use an Alibaba Cloud Resource Name (ARN) to specify a resource. For more information, see the Resource section of this topic.
Condition: specifies one or more conditions that are required for the policy to take effect. This is an optional field. For more information, see the Condition section of this topic.
- Condition_operator: specifies the conditional operators. Different types of conditions support different conditional operators. For more information, see Policy elements.
- Condition_key: specifies the condition keys.
- Condition_value: specifies the condition values.

Action

ServiceMesh defines the values that you can use in the Action element of a policy statement. The following table describes the values.

Operation: the value that you can use in the Action element to specify the operation on a resource.
API operation: the API operation that you can call to perform the operation.
Access level: the access level of each operation. The levels are read, write, and list.
Resource type: the type of the resource on which you can authorize the RAM user or the RAM role to perform the operation. Take note of the following items:
- The required resource types are displayed in bold characters.
- If the permissions cannot be granted at the resource level, All Resources is used in the Resource type column of the operation.
Condition key: the condition keys that are defined by the Alibaba Cloud service. The Condition key column does not list the common condition keys that are defined by Alibaba Cloud. For more information about the common condition keys, see Generic Condition Keyword.
Associated operation: other operations that the RAM user or the RAM role must have permissions to perform to complete the operation. To complete the operation, the RAM user or the RAM role must have the permissions to perform the associated operations.

Actions	API operation	Access level	Resource type	Condition key	Associated operation
servicemesh:DescribeCrTemplates	DescribeCrTemplates	get	All Resources *	None	None
servicemesh:DescribeGuestClusterNamespaces	DescribeGuestClusterNamespaces	get	All Resources *	None	None
servicemesh:UpgradeMeshEditionPartially	UpgradeMeshEditionPartially	update	All Resources *	None	None
servicemesh:UpdateControlPlaneLogConfig	UpdateControlPlaneLogConfig		All Resources *	None	None
servicemesh:DeleteSwimLaneGroup	DeleteSwimLaneGroup	delete	All Resources *	None	None
servicemesh:ModifyServiceMeshName	ModifyServiceMeshName	update	All Resources *	None	None
servicemesh:CreateSwimLaneGroup	CreateSwimLaneGroup	create	All Resources *	None	None
servicemesh:UpdateASMGatewayImportedServices	UpdateASMGatewayImportedServices	update	All Resources *	None	None
servicemesh:TagResources	TagResources		All Resources *	None	None
servicemesh:UntagResources	UntagResources		All Resources *	None	None
servicemesh:ListWaypoints	ListWaypoints	none	All Resources *	None	None
servicemesh:CreateASMGateway	CreateASMGateway	create	All Resources *	None	None
servicemesh:DeleteGatewayRoute	DeleteGatewayRoute	delete	All Resources *	None	None
servicemesh:GetGrafanaDashboardUrl	GetGrafanaDashboardUrl	get	All Resources *	None	None
servicemesh:UpdateASMNamespaceFromGuestCluster	UpdateASMNamespaceFromGuestCluster	update	All Resources *	None	None
servicemesh:DescribeIstioGatewayRouteDetail	DescribeIstioGatewayRouteDetail	get	All Resources *	None	None
servicemesh:DescribeGatewaySecretDetails	DescribeGatewaySecretDetails	get	All Resources *	None	None
servicemesh:DescribeUserPermissions	DescribeUserPermissions	get	All Resources *	None	None
servicemesh:DescribeNamespaceScopeSidecarConfig	DescribeNamespaceScopeSidecarConfig	get	All Resources *	None	None
servicemesh:UpdateMeshCRAggregation	UpdateMeshCRAggregation	update	All Resources *	None	None
servicemesh:DeleteServiceMesh	DeleteServiceMesh	delete	All Resources *	None	None
servicemesh:DescribeServiceMeshes	DescribeServiceMeshes	get	All Resources *	None	None
servicemesh:GetSwimLaneGroupList	GetSwimLaneGroupList	get	All Resources *	None	None
servicemesh:DescribeNodesInstanceType	DescribeNodesInstanceType	get	All Resources *	None	None
servicemesh:CreateIstioGatewayRoutes	CreateIstioGatewayRoutes	create	All Resources *	None	None
servicemesh:DescribeClustersInServiceMesh	DescribeClustersInServiceMesh	get	All Resources *	None	None
servicemesh:DescribeImportedServicesDetail	DescribeImportedServicesDetail	get	All Resources *	None	None
servicemesh:UpdateWaypoint	UpdateWaypoint	none	All Resources *	None	None
servicemesh:DeleteGatewaySecret	DeleteGatewaySecret	delete	All Resources *	None	None
servicemesh:GetSwimLaneList	GetSwimLaneList	get	All Resources *	None	None
servicemesh:DescribeIstioGatewayDomains	DescribeIstioGatewayDomains	get	All Resources *	None	None
servicemesh:RemoveClusterFromServiceMesh	RemoveClusterFromServiceMesh	delete	All Resources *	None	None
servicemesh:DescribeVersions	DescribeVersions	get	All Resources *	None	None
servicemesh:DescribeServiceMeshLogs	DescribeServiceMeshLogs	get	All Resources *	None	None
servicemesh:DescribeClusterGrafana	DescribeClusterGrafana	get	All Resources *	None	None
servicemesh:DeleteIstioGatewayDomains	DeleteIstioGatewayDomains	delete	All Resources *	None	None
servicemesh:UpdateASMGateway	UpdateASMGateway	update	All Resources *	None	None
servicemesh:ModifyApiServerEipResource	ModifyApiServerEipResource	update	All Resources *	None	None
servicemesh:DescribeServiceMeshProxyStatus	DescribeServiceMeshProxyStatus	get	All Resources *	None	None
servicemesh:UpdateIstioRouteAdditionalStatus	UpdateIstioRouteAdditionalStatus	update	All Resources *	None	None
servicemesh:DescribeServiceMeshKubeconfig	DescribeServiceMeshKubeconfig	get	All Resources *	None	None
servicemesh:DescribeVpcs	DescribeVpcs	get	All Resources *	None	None
servicemesh:UpdateSwimLane	UpdateSwimLane	update	All Resources *	None	None
servicemesh:DescribeReusableSlb	DescribeReusableSlb	get	All Resources *	None	None
servicemesh:GetRegisteredServiceEndpoints	GetRegisteredServiceEndpoints	get	All Resources *	None	None
servicemesh:DescribeServiceMeshAdditionalStatus	DescribeServiceMeshAdditionalStatus	get	All Resources *	None	None
servicemesh:ListServiceAccounts	ListServiceAccounts	none	All Resources *	None	None
servicemesh:GetRegisteredServiceNamespaces	GetRegisteredServiceNamespaces	get	All Resources *	None	None
servicemesh:DescribeVSwitches	DescribeVSwitches	get	All Resources *	None	None
servicemesh:RevokeKubeconfig	RevokeKubeconfig	update	All Resources *	None	None
servicemesh:CreateWaypoint	CreateWaypoint	none	All Resources *	None	None
servicemesh:UpdateMeshFeature	UpdateMeshFeature	update	All Resources *	None	None
servicemesh:UpdateIstioGatewayRoutes	UpdateIstioGatewayRoutes	update	All Resources *	None	None
servicemesh:DescribeServiceMeshDetail	DescribeServiceMeshDetail	get	All Resources *	None	None
servicemesh:DescribeServiceMeshUpgradeStatus	DescribeServiceMeshUpgradeStatus	get	All Resources *	None	None
servicemesh:UpgradeMeshVersion	UpgradeMeshVersion	update	All Resources *	None	None
servicemesh:DescribeEipResources	DescribeEipResources	get	All Resources *	None	None
servicemesh:GrantUserPermissions	GrantUserPermissions	get	All Resources *	None	None
servicemesh:DescribeUpgradeVersion	DescribeUpgradeVersion	get	All Resources *	None	None
servicemesh:GetSwimLaneDetail	GetSwimLaneDetail	get	All Resources *	None	None
servicemesh:DeleteSwimLane	DeleteSwimLane	delete	All Resources *	None	None
servicemesh:GetDeploymentBySelector	GetDeploymentBySelector		All Resources *	None	None
servicemesh:DeleteWaypoint	DeleteWaypoint	none	All Resources *	None	None
servicemesh:UpdateSwimLaneGroup	UpdateSwimLaneGroup	update	All Resources *	None	None
servicemesh:CreateIstioGatewayDomains	CreateIstioGatewayDomains	create	All Resources *	None	None
servicemesh:CreateServiceMesh	CreateServiceMesh	create	All Resources *	None	None
servicemesh:GetCaCert	GetCaCert	get	All Resources *	None	None
servicemesh:DescribeUsersWithPermissions	DescribeUsersWithPermissions	get	All Resources *	None	None
servicemesh:UpdateNamespaceScopeSidecarConfig	UpdateNamespaceScopeSidecarConfig	update	All Resources *	None	None
servicemesh:DescribeMetadata	DescribeMetadata	get	All Resources *	None	None
servicemesh:DescribeGuestClusterAccessLogDashboards	DescribeGuestClusterAccessLogDashboards	get	All Resources *	None	None
servicemesh:DescribeASMGatewayImportedServices	DescribeASMGatewayImportedServices	get	All Resources *	None	None
servicemesh:ReActivateAudit	ReActivateAudit	update	All Resources *	None	None
servicemesh:DescribeCens	DescribeCens	get	All Resources *	None	None
servicemesh:DescribeCCMVersion	DescribeCCMVersion	get	All Resources *	None	None
servicemesh:DescribeIstioGatewayRoutes	DescribeIstioGatewayRoutes	get	All Resources *	None	None
servicemesh:DescribeGuestClusterPods	DescribeGuestClusterPods	get	All Resources *	None	None
servicemesh:DescribeClusterPrometheus	DescribeClusterPrometheus	get	All Resources *	None	None
servicemesh:UpdateIstioInjectionConfig	UpdateIstioInjectionConfig	update	All Resources *	None	None
servicemesh:CreateGatewaySecret	CreateGatewaySecret	create	All Resources *	None	None
servicemesh:DescribeServiceMeshClusters	DescribeServiceMeshClusters	get	All Resources *	None	None
servicemesh:AddClusterIntoServiceMesh	AddClusterIntoServiceMesh	create	All Resources *	None	None
servicemesh:CreateSwimLane	CreateSwimLane	create	All Resources *	None	None
servicemesh:ListTagResources	ListTagResources		All Resources *	None	None

Resource

ServiceMesh defines the values that you can use in the Resource. You can attach the policy to a RAM user or a RAM role so that the RAM user or the RAM role can perform a specific operation on a specific resource. The ARN is the unique identifier of the resource on Alibaba Cloud. Take note of the following items:

{#}indicates a variable. {#} must be replaced with an actual value. For example, {#ramcode} must be replaced with the actual code of an Alibaba Cloud service in RAM.
An asterisk (*) is used as a wildcard. Examples:
- {#resourceType} is set to *, all resources are specified.
- {#regionId} is set to *, all regions are specified.
- {#accountId} is set to *, all Alibaba Cloud accounts are specified.

Resource type	ARN

No data

Condition

ServiceMesh does not define service-specific condition keys. For more information about common condition keys that are defined by Alibaba Cloud, see Generic Condition Keyword.

What to do next

You can create a custom policy and attach the policy to a RAM user, RAM user group, or RAM role. For more information, see the following topics: