RAM authorization - Cloud Config - Alibaba Cloud Documentation Center

Resource Access Management (RAM) is a service provided by Alibaba Cloud to manage user identities and resource access permissions. You can use RAM to prevent RAM users from sharing the AccessKey pairs of your Alibaba Cloud account. You can also use RAM to grant minimum permissions to RAM users. RAM uses policies to define permissions.

This topic describes the elements, such as Action, Resource, and Condition, which are defined by Config. You can use the elements to create policies in RAM. The code (RamCode) in RAM that is used to indicate Config is config. You can grant permissions on Config at the OPERATION.

General structure of a policy

Policies can be stored as JSON files. The following code provides an example on the general structure of a policy:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

The following list describes the fields in the policy:

Effect: specifies the authorization effect. Valid values: Allow, Deny.
Action: specifies one or more API operations that are allowed or denied. For more information, see the Action section of this topic.
Resource: specifies one or more resources to which the policy applies. You can use an Alibaba Cloud Resource Name (ARN) to specify a resource. For more information, see the Resource section of this topic.
Condition: specifies one or more conditions that are required for the policy to take effect. This is an optional field. For more information, see the Condition section of this topic.
- Condition_operator: specifies the conditional operators. Different types of conditions support different conditional operators. For more information, see Policy elements.
- Condition_key: specifies the condition keys.
- Condition_value: specifies the condition values.

Action

Config defines the values that you can use in the Action element of a policy statement. The following table describes the values.

Operation: the value that you can use in the Action element to specify the operation on a resource.
API operation: the API operation that you can call to perform the operation.
Access level: the access level of each operation. The levels are read, write, and list.
Resource type: the type of the resource on which you can authorize the RAM user or the RAM role to perform the operation. Take note of the following items:
- The required resource types are displayed in bold characters.
- If the permissions cannot be granted at the resource level, All Resources is used in the Resource type column of the operation.
Condition key: the condition keys that are defined by the Alibaba Cloud service. The Condition key column does not list the common condition keys that are defined by Alibaba Cloud. For more information about the common condition keys, see Generic Condition Keyword.
Associated operation: other operations that the RAM user or the RAM role must have permissions to perform to complete the operation. To complete the operation, the RAM user or the RAM role must have the permissions to perform the associated operations.

Actions	API operation	Access level	Resource type	Condition key	Associated operation
config:ListRemediationTemplates	ListRemediationTemplates	get	All Resources *	None	None
config:ListAggregateResourceEvaluationResults	ListAggregateResourceEvaluationResults	list	All Resources *	None	None
config:UpdateAggregateConfigDeliveryChannel	UpdateAggregateConfigDeliveryChannel	Write	All Resources *	None	None
config:GetAggregateResourceCountsGroupByResourceType	GetAggregateResourceCountsGroupByResourceType	get	All Resources *	None	None
config:ListAggregateRemediations	ListAggregateRemediations	list	All Resources *	None	None
config:ListConfigRules	ListConfigRules	list	All Resources *	None	None
config:DetachConfigRuleToCompliancePack	DetachConfigRuleToCompliancePack	Write	All Resources *	None	None
config:CopyCompliancePacks	CopyCompliancePacks	create	All Resources *	None	None
config:CreateConfigRule	CreateConfigRule	create	All Resources *	None	None
config:GetAggregator	GetAggregator	get	All Resources *	None	None
config:DeleteAggregateRemediations	DeleteAggregateRemediations	delete	All Resources *	None	None
config:ListRemediations	ListRemediations	list	All Resources *	None	None
config:UpdateConfigRule	UpdateConfigRule	update	All Resources *	None	None
config:ListConfigDeliveryChannels	ListConfigDeliveryChannels	list	All Resources *	None	None
config:ListConfigRuleEvaluationStatistics	ListConfigRuleEvaluationStatistics	list	All Resources *	None	None
config:GetAggregateResourceComplianceTimeline	GetAggregateResourceComplianceTimeline	get	All Resources *	None	None
config:UpdateRemediation	UpdateRemediation	Write	All Resources *	None	None
config:ListAggregators	ListAggregators	get	All Resources *	None	None
config:UpdateConfigurationRecorder	UpdateConfigurationRecorder	update	All Resources *	None	None
config:GetAggregateConfigRuleSummaryByRiskLevel	GetAggregateConfigRuleSummaryByRiskLevel	get	All Resources *	None	None
config:GetAggregateAccountComplianceByPack	GetAggregateAccountComplianceByPack	get	All Resources *	None	None
config:GetAdvancedSearchFile	GetAdvancedSearchFile	get	All Resources *	None	None
config:CreateAggregateConfigRule	CreateAggregateConfigRule	create	All Resources *	None	None
config:ListAggregateConfigRules	ListAggregateConfigRules	list	All Resources *	None	None
config:ListAggregateRemediationExecutions	ListAggregateRemediationExecutions	list	All Resources *	None	None
config:ListResourcesByAdvancedSearch	ListResourcesByAdvancedSearch	list	All Resources *	None	None
config:DeleteRemediations	DeleteRemediations	Write	All Resources *	None	None
config:PutEvaluations	PutEvaluations	none	All Resources *	None	None
config:UpdateAggregateRemediation	UpdateAggregateRemediation	Write	All Resources *	None	None
config:GetAggregateResourceComplianceByPack	GetAggregateResourceComplianceByPack	get	All Resources *	None	None
config:GetAggregateResourceConfigurationTimeline	GetAggregateResourceConfigurationTimeline	list	All Resources *	None	None
config:ListAggregateConfigRuleEvaluationResults	ListAggregateConfigRuleEvaluationResults	list	All Resources *	None	None
config:CreateCompliancePack	CreateCompliancePack	create	All Resources *	None	None
config:UpdateCompliancePack	UpdateCompliancePack	update	All Resources *	None	None
config:ListAggregateDiscoveredResources	ListAggregateDiscoveredResources	list	All Resources *	None	None
config:IgnoreEvaluationResults	IgnoreEvaluationResults	Write	All Resources *	None	None
config:GetResourceComplianceTimeline	GetResourceComplianceTimeline	list	All Resources *	None	None
config:ListTagResources	ListTagResources	get	All Resources *	None	None
config:GetResourceComplianceGroupByRegion	GetResourceComplianceGroupByRegion	get	All Resources *	None	None
config:GenerateAggregateCompliancePackReport	GenerateAggregateCompliancePackReport	create	All Resources *	None	None
config:StartConfigRuleEvaluation	StartConfigRuleEvaluation		All Resources *	None	None
config:GenerateCompliancePackReport	GenerateCompliancePackReport	create	All Resources *	None	None
config:GetAggregateConfigRuleComplianceByPack	GetAggregateConfigRuleComplianceByPack	get	All Resources *	None	None
config:GetResourceComplianceGroupByResourceType	GetResourceComplianceGroupByResourceType	get	All Resources *	None	None
config:GetAggregateResourceComplianceByConfigRule	GetAggregateResourceComplianceByConfigRule	get	All Resources *	None	None
config:ListRemediationExecutions	ListRemediationExecutions	list	All Resources *	None	None
config:CreateDeliveryChannel	CreateDeliveryChannel	Write	All Resources *	None	None
config:ListAggregateCompliancePacks	ListAggregateCompliancePacks	list	All Resources *	None	None
config:GetAggregateCompliancePackReport	GetAggregateCompliancePackReport	get	All Resources *	None	None
config:StartAggregateConfigRuleEvaluation	StartAggregateConfigRuleEvaluation	Write	All Resources *	None	None
config:UpdateAggregateConfigRule	UpdateAggregateConfigRule	update	All Resources *	None	None
config:CreateAggregateRemediation	CreateAggregateRemediation	Write	All Resources *	None	None
config:ActiveConfigRules	ActiveConfigRules	update	All Resources *	None	None
config:GetResourceComplianceByConfigRule	GetResourceComplianceByConfigRule	get	All Resources *	None	None
config:CreateAggregateAdvancedSearchFile	CreateAggregateAdvancedSearchFile	create	All Resources *	None	None
config:GetCompliancePackReport	GetCompliancePackReport	get	All Resources *	None	None
config:GetConfigRulesReport	GetConfigRulesReport	get	All Resources *	None	None
config:ListAggregateConfigDeliveryChannels	ListAggregateConfigDeliveryChannels	list	All Resources *	None	None
config:ListResourceEvaluationResults	ListResourceEvaluationResults	list	All Resources *	None	None
config:RevertEvaluationResults	RevertEvaluationResults	Write	All Resources *	None	None
config:DeactiveConfigRules	DeactiveConfigRules	Write	All Resources *	None	None
config:DeleteAggregateConfigRules	DeleteAggregateConfigRules	Write	All Resources *	None	None
config:GetDiscoveredResource	GetDiscoveredResource	get	All Resources *	None	None
config:GetDiscoveredResourceCountsGroupByResourceType	GetDiscoveredResourceCountsGroupByResourceType	get	All Resources *	None	None
config:GetResourceInventory	GetResourceInventory	get	All Resources *	None	None
config:GetConfigDeliveryChannel	GetConfigDeliveryChannel	get	All Resources *	None	None
config:GetResourceComplianceByPack	GetResourceComplianceByPack	get	All Resources *	None	None
config:GetManagedRule	GetManagedRule	get	All Resources *	None	None
config:GetRemediationTemplate	GetRemediationTemplate	get	All Resources *	None	None
config:CreateAggregateCompliancePack	CreateAggregateCompliancePack	create	All Resources *	None	None
config:StartAggregateRemediation	StartAggregateRemediation	Write	All Resources *	None	None
config:ListAggregateResourceRelations	ListAggregateResourceRelations	get	All Resources *	None	None
config:GenerateResourceInventory	GenerateResourceInventory	none	All Resources *	None	None
config:UpdateConfigDeliveryChannel	UpdateConfigDeliveryChannel	Write	All Resources *	None	None
config:DeleteAggregateCompliancePacks	DeleteAggregateCompliancePacks	Write	All Resources *	None	None
config:GenerateAggregateResourceInventory	GenerateAggregateResourceInventory	none	All Resources *	None	None
config:ListResourceRelations	ListResourceRelations	get	All Resources *	None	None
config:AttachConfigRuleToCompliancePack	AttachConfigRuleToCompliancePack	Write	All Resources *	None	None
config:UpdateDeliveryChannel	UpdateDeliveryChannel	Write	All Resources *	None	None
config:GetDiscoveredResourceCountsGroupByRegion	GetDiscoveredResourceCountsGroupByRegion	get	All Resources *	None	None
config:ListManagedRules	ListManagedRules	get	All Resources *	None	None
config:CreateAggregator	CreateAggregator	create	All Resources *	None	None
config:IgnoreAggregateEvaluationResults	IgnoreAggregateEvaluationResults	update	All Resources *	None	None
config:GetAggregateComplianceSummary	GetAggregateComplianceSummary	get	All Resources *	None	None
config:GetConfigurationRecorder	GetConfigurationRecorder	get	All Resources *	None	None
config:GenerateAggregateConfigRulesReport	GenerateAggregateConfigRulesReport	create	All Resources *	None	None
config:CreateConfigDeliveryChannel	CreateConfigDeliveryChannel	Write	All Resources *	None	None
config:GetAggregateConfigDeliveryChannel	GetAggregateConfigDeliveryChannel	get	All Resources *	None	None
config:GetIntegratedServiceStatus	GetIntegratedServiceStatus	get	All Resources *	None	None
config:GetComplianceSummary	GetComplianceSummary	get	All Resources *	None	None
config:ListIntegratedService	ListIntegratedService	list	All Resources *	None	None
config:GenerateConfigRulesReport	GenerateConfigRulesReport	Write	All Resources *	None	None
config:CreateRemediation	CreateRemediation	Write	All Resources *	None	None
config:DeleteConfigRules	DeleteConfigRules		All Resources *	None	None
config:ListDiscoveredResources	ListDiscoveredResources	list	All Resources *	None	None
config:GetConfigRuleSummaryByRiskLevel	GetConfigRuleSummaryByRiskLevel	get	All Resources *	None	None
config:GetResourceConfigurationTimeline	GetResourceConfigurationTimeline	list	All Resources *	None	None
config:TagResources	TagResources	update	All Resources *	None	None
config:ActiveAggregateConfigRules	ActiveAggregateConfigRules	update	All Resources *	None	None
config:ListConfigRuleEvaluationResults	ListConfigRuleEvaluationResults	list	All Resources *	None	None
config:StopConfigurationRecorder	StopConfigurationRecorder	update	All Resources *	None	None
config:DeleteAggregators	DeleteAggregators	delete	All Resources *	None	None
config:CopyConfigRules	CopyConfigRules	update	All Resources *	None	None
config:AttachAggregateConfigRuleToCompliancePack	AttachAggregateConfigRuleToCompliancePack	Write	All Resources *	None	None
config:DetachAggregateConfigRuleToCompliancePack	DetachAggregateConfigRuleToCompliancePack	Write	All Resources *	None	None
config:GetAggregateDiscoveredResource	GetAggregateDiscoveredResource	get	All Resources *	None	None
config:CreateAggregateConfigDeliveryChannel	CreateAggregateConfigDeliveryChannel	Write	All Resources *	None	None
config:UpdateAggregateCompliancePack	UpdateAggregateCompliancePack	update	All Resources *	None	None
config:GetConfigRule	GetConfigRule	get	All Resources *	None	None
config:ListAggregateConfigRuleEvaluationStatistics	ListAggregateConfigRuleEvaluationStatistics	list	All Resources *	None	None
config:GetAggregateCompliancePack	GetAggregateCompliancePack	get	All Resources *	None	None
config:ListAggregateResourcesByAdvancedSearch	ListAggregateResourcesByAdvancedSearch	list	All Resources *	None	None
config:DeactiveAggregateConfigRules	DeactiveAggregateConfigRules	update	All Resources *	None	None
config:GetCompliancePack	GetCompliancePack	get	All Resources *	None	None
config:DeleteConfigDeliveryChannel	DeleteConfigDeliveryChannel	Write	All Resources *	None	None
config:EvaluatePreConfigRules	EvaluatePreConfigRules	list	All Resources *	None	None
config:GetAggregateResourceComplianceGroupByRegion	GetAggregateResourceComplianceGroupByRegion	get	All Resources *	None	None
config:CreateAdvancedSearchFile	CreateAdvancedSearchFile	create	All Resources *	None	None
config:DeleteCompliancePacks	DeleteCompliancePacks	Write	All Resources *	None	None
config:GetConfigRuleComplianceByPack	GetConfigRuleComplianceByPack	get	All Resources *	None	None
config:UpdateIntegratedServiceStatus	UpdateIntegratedServiceStatus	update	All Resources *	None	None
config:GetAggregateAdvancedSearchFile	GetAggregateAdvancedSearchFile	get	All Resources *	None	None
config:GetAggregateResourceInventory	GetAggregateResourceInventory	get	All Resources *	None	None
config:DeleteAggregateConfigDeliveryChannel	DeleteAggregateConfigDeliveryChannel	delete	All Resources *	None	None
config:GetAggregateResourceComplianceGroupByResourceType	GetAggregateResourceComplianceGroupByResourceType	get	All Resources *	None	None
config:RevertAggregateEvaluationResults	RevertAggregateEvaluationResults	update	All Resources *	None	None
config:GetAggregateConfigRule	GetAggregateConfigRule	get	All Resources *	None	None
config:StartRemediation	StartRemediation	Write	All Resources *	None	None
config:UntagResources	UntagResources	update	All Resources *	None	None
config:ListCompliancePacks	ListCompliancePacks	list	All Resources *	None	None
config:UpdateAggregator	UpdateAggregator	update	All Resources *	None	None
config:StartConfigurationRecorder	StartConfigurationRecorder	create	All Resources *	None	None
config:DescribeRemediation	DescribeRemediation	get	All Resources *	None	None
config:GetAggregateResourceCountsGroupByRegion	GetAggregateResourceCountsGroupByRegion	get	All Resources *	None	None
config:GetAggregateConfigRulesReport	GetAggregateConfigRulesReport	get	All Resources *	None	None

Resource

In Config, you cannot specify an ARN in the Resource element in a policy statement. If you want to authorize a RAM user or a RAM role to access Config, you cannot specify an ARN in the "Resource": "*".

Condition

Config does not define service-specific condition keys. For more information about common condition keys that are defined by Alibaba Cloud, see Generic Condition Keyword.

What to do next

You can create a custom policy and attach the policy to a RAM user, RAM user group, or RAM role. For more information, see the following topics: