RAM authorization - CloudMonitor - Alibaba Cloud Documentation Center

Resource Access Management (RAM) is a service provided by Alibaba Cloud to manage user identities and resource access permissions. You can use RAM to prevent RAM users from sharing the AccessKey pairs of your Alibaba Cloud account. You can also use RAM to grant minimum permissions to RAM users. RAM uses policies to define permissions.

This topic describes the elements, such as Action, Resource, and Condition, which are defined by CloudMonitorService. You can use the elements to create policies in RAM. The code (RamCode) in RAM that is used to indicate CloudMonitorService is cms. You can grant permissions on CloudMonitorService at the RESOURCE.

General structure of a policy

Policies can be stored as JSON files. The following code provides an example on the general structure of a policy:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

The following list describes the fields in the policy:

Effect: specifies the authorization effect. Valid values: Allow, Deny.
Action: specifies one or more API operations that are allowed or denied. For more information, see the Action section of this topic.
Resource: specifies one or more resources to which the policy applies. You can use an Alibaba Cloud Resource Name (ARN) to specify a resource. For more information, see the Resource section of this topic.
Condition: specifies one or more conditions that are required for the policy to take effect. This is an optional field. For more information, see the Condition section of this topic.
- Condition_operator: specifies the conditional operators. Different types of conditions support different conditional operators. For more information, see Policy elements.
- Condition_key: specifies the condition keys.
- Condition_value: specifies the condition values.

Action

CloudMonitorService defines the values that you can use in the Action element of a policy statement. The following table describes the values.

Operation: the value that you can use in the Action element to specify the operation on a resource.
API operation: the API operation that you can call to perform the operation.
Access level: the access level of each operation. The levels are read, write, and list.
Resource type: the type of the resource on which you can authorize the RAM user or the RAM role to perform the operation. Take note of the following items:
- The required resource types are displayed in bold characters.
- If the permissions cannot be granted at the resource level, All Resources is used in the Resource type column of the operation.
Condition key: the condition keys that are defined by the Alibaba Cloud service. The Condition key column does not list the common condition keys that are defined by Alibaba Cloud. For more information about the common condition keys, see Generic Condition Keyword.
Associated operation: other operations that the RAM user or the RAM role must have permissions to perform to complete the operation. To complete the operation, the RAM user or the RAM role must have the permissions to perform the associated operations.

Actions	API operation	Access level	Resource type	Condition key	Associated operation
cms:EnableEventRules	EnableEventRules	update	All Resources *	None	None
cms:DescribeCustomEventAttribute	DescribeCustomEventAttribute	get	All Resources *	None	None
cms:ModifyHybridMonitorTask	ModifyHybridMonitorTask	update	All Resources *	None	None
cms:PutContactGroup	PutContactGroup	create	All Resources *	None	None
cms:DescribeLogMonitorList	DescribeLogMonitorList	get	All Resources *	None	None
cms:PutCustomMetricRule	PutCustomMetricRule	create	All Resources *	None	None
cms:DescribeMonitorGroupDynamicRules	DescribeMonitorGroupDynamicRules	get	All Resources *	None	None
cms:PutCustomEvent	PutCustomEvent	create	All Resources *	None	None
cms:PutResourceMetricRules	PutResourceMetricRules	create	All Resources *	None	None
cms:DescribeSiteMonitorStatistics	DescribeSiteMonitorStatistics	get	All Resources *	None	None
cms:DescribeMetricRuleCount	DescribeMetricRuleCount	get	All Resources *	None	None
cms:CreateGroupMonitoringAgentProcess	CreateGroupMonitoringAgentProcess	create	GroupMonitoringAgentProcess acs:cms::{#accountId}:group/{#groupId}	None	None
cms:DescribeMetricRuleList	DescribeMetricRuleList	get	All Resources *	None	None
cms:DescribeSystemEventAttribute	DescribeSystemEventAttribute	get	All Resources *	None	None
cms:DescribeContactGroupList	DescribeContactGroupList	get	All Resources *	None	None
cms:CreateMetricRuleTemplate	CreateMetricRuleTemplate	create	All Resources *	None	None
cms:CreateHybridMonitorTask	CreateHybridMonitorTask	create	All Resources *	None	None
cms:UpdateCustomNamespace	ModifyHybridMonitorNamespace	create	All Resources *	None	None
cms:DeleteCustomNamespace	DeleteHybridMonitorNamespace	create	All Resources *	None	None
cms:DeleteMetricRules	DeleteMetricRules	delete	All Resources *	None	None
cms:CreateDynamicTagGroup	CreateDynamicTagGroup	create	All Resources *	None	None
cms:DescribeMonitorGroupNotifyPolicyList	DescribeMonitorGroupNotifyPolicyList	get	All Resources *	None	None
cms:DescribeHybridMonitorTaskList	DescribeHybridMonitorTaskList	list	All Resources *	None	None
cms:DisableEventRules	DisableEventRules	update	All Resources *	None	None
cms:CreateMetricRuleBlackList	CreateMetricRuleBlackList	create	All Resources *	None	None
cms:DisableHostAvailability	DisableHostAvailability	update	HostAvailability acs:cms::{#accountId}:group/{#groupId}	None	None
cms:DescribeCustomNamespace	DescribeHybridMonitorNamespaceList	create	All Resources *	None	None
cms:CreateMonitorGroupByResourceGroupId	CreateMonitorGroupByResourceGroupId	create	All Resources *	None	None
cms:DescribeMonitorGroupInstances	DescribeMonitorGroupInstances	get	All Resources *	None	None
cms:DeleteHostAvailability	DeleteHostAvailability	delete	HostAvailability acs:cms::{#accountId}:group/{#groupId}	None	None
cms:EnableHostAvailability	EnableHostAvailability	update	All Resources *	None	None
cms:DescribeHostAvailabilityList	DescribeHostAvailabilityList	get	All Resources *	None	None
cms:DeleteMonitorGroupDynamicRule	DeleteMonitorGroupDynamicRule	delete	All Resources *	None	None
cms:DescribeAlertLogHistogram	DescribeAlertLogHistogram	get	All Resources *	None	None
cms:DeleteContactGroup	DeleteContactGroup	delete	All Resources *	None	None
cms:DescribeCustomEventHistogram	DescribeCustomEventHistogram	get	All Resources *	None	None
cms:DeleteMetricRuleTemplate	DeleteMetricRuleTemplate	delete	All Resources *	None	None
cms:DescribeEventRuleList	DescribeEventRuleList	get	All Resources *	None	None
cms:ModifySiteMonitor	ModifySiteMonitor	update	All Resources *	None	None
cms:QueryMetricList	DescribeMetricList	get	All Resources *	None	None
cms:QueryMetricTop	DescribeMetricTop	get	All Resources *	None	None
cms:DescribeMonitoringAgentAccessKey	DescribeMonitoringAgentAccessKey	get	All Resources *	None	None
cms:AddTags	AddTags	create	All Resources *	None	None
cms:DeleteEventRuleTargets	DeleteEventRuleTargets	delete	All Resources *	None	None
cms:DeleteMetricRuleTargets	DeleteMetricRuleTargets	delete	All Resources *	None	None
cms:DescribeContactListByContactGroup	DescribeContactListByContactGroup	get	All Resources *	None	None
cms:ApplyMetricRuleTemplate	ApplyMetricRuleTemplate	create	MetricRuleTemplate acs:cms::{#accountId}:group/{#groupId}	None	None
cms:DeleteGroupMonitoringAgentProcess	DeleteGroupMonitoringAgentProcess	delete	All Resources *	None	None
cms:DeleteMonitoringAgentProcess	DeleteMonitoringAgentProcess	delete	All Resources *	None	None
cms:PutGroupMetricRule	PutGroupMetricRule	create	GroupMetricRule acs:cms::{#accountId}:group/{#groupId}	None	None
cms:CreateMonitorGroupInstances	CreateMonitorGroupInstances	create	All Resources *	None	None
cms:DescribeHybridMonitorSLSGroup	DescribeHybridMonitorSLSGroup	create	All Resources *	None	None
cms:DescribeMetricRuleBlackList	DescribeMetricRuleBlackList	list	All Resources *	None	None
cms:DescribeMonitoringAgentStatuses	DescribeMonitoringAgentStatuses	get	All Resources *	None	None
cms:EnableMetricRuleBlackList	EnableMetricRuleBlackList	update	All Resources *	None	None
cms:CreateHybridMonitorSLSGroup	CreateHybridMonitorSLSGroup	create	All Resources *	None	None
cms:ModifyMonitorGroup	ModifyMonitorGroup	update	MonitorGroup acs:cms::{#accountId}:group/{#groupId}	None	None
cms:DeleteMetricRuleBlackList	DeleteMetricRuleBlackList	delete	All Resources *	None	None
cms:DeleteHybridMonitorSLSGroup	DeleteHybridMonitorSLSGroup	create	All Resources *	None	None
cms:DescribeUnhealthyHostAvailability	DescribeUnhealthyHostAvailability	get	All Resources *	None	None
cms:DescribeSiteMonitorLog	DescribeSiteMonitorLog	list	All Resources *	None	None
cms:EnableSiteMonitors	EnableSiteMonitors	update	All Resources *	None	None
cms:DeleteSiteMonitors	DeleteSiteMonitors	delete	All Resources *	None	None
cms:DeleteDynamicTagGroup	DeleteDynamicTagGroup	delete	All Resources *	None	None
cms:ModifyMonitorGroupInstances	ModifyMonitorGroupInstances	update	All Resources *	None	None
cms:DescribeMonitorGroupInstanceAttribute	DescribeMonitorGroupInstanceAttribute	get	MonitorGroupInstances acs:cms::{#accountId}:group/{#groupId}	None	None
cms:SendDryRunSystemEvent	SendDryRunSystemEvent	none	All Resources *	None	None
cms:DescribeMonitoringAgentHosts	DescribeMonitoringAgentHosts	get	All Resources *	None	None
cms:PutCustomMetric	PutCustomMetric	create	All Resources *	None	None
cms:DescribeMetricRuleTemplateAttribute	DescribeMetricRuleTemplateAttribute	get	All Resources *	None	None
cms:DescribeSiteMonitorQuota	DescribeSiteMonitorQuota	get	All Resources *	None	None
cms:ModifyMetricRuleTemplate	ModifyMetricRuleTemplate	update	All Resources *	None	None
cms:DescribeGroupMonitoringAgentProcess	DescribeGroupMonitoringAgentProcess	get	All Resources *	None	None
cms:RemoveTags	RemoveTags	delete	All Resources *	None	None
cms:PutContact	PutContact	create	All Resources *	None	None
cms:DeleteEventRules	DeleteEventRules	delete	All Resources *	None	None
cms:PutCustomEventRule	PutCustomEventRule	create	All Resources *	None	None
cms:DescribeSiteMonitorList	DescribeSiteMonitorList	get	All Resources *	None	None
cms:DeleteHybridMonitorTask	DeleteHybridMonitorTask	delete	All Resources *	None	None
cms:ModifyGroupMonitoringAgentProcess	ModifyGroupMonitoringAgentProcess	update	MonitoringAgentProcess acs:cms::{#accountId}:group/{#groupId}	None	None
cms:BatchCreateInstantSiteMonitor	BatchCreateInstantSiteMonitor	create	All Resources *	None	None
cms:CreateInstantSiteMonitor	CreateInstantSiteMonitor	create	All Resources *	None	None
cms:InstallMonitoringAgent	InstallMonitoringAgent	create	All Resources *	None	None
cms:DescribeMetricRuleTargets	DescribeMetricRuleTargets	list	All Resources *	None	None
cms:PutMonitoringConfig	PutMonitoringConfig	create	All Resources *	None	None
cms:DescribeMetricRuleTemplateList	DescribeMetricRuleTemplateList	get	All Resources *	None	None
cms:DescribeSiteMonitorAttribute	DescribeSiteMonitorAttribute	get	All Resources *	None	None
cms:DisableMetricRules	DisableMetricRules	update	All Resources *	None	None
cms:PutMonitorGroupDynamicRule	PutMonitorGroupDynamicRule	create	MonitorGroup acs:cms::{#accountId}:group/{#groupId}	None	None
cms:DisableSiteMonitors	DisableSiteMonitors	update	All Resources *	None	None
cms:DescribeAlertingMetricRuleResources	DescribeAlertingMetricRuleResources	get	All Resources *	None	None
cms:DescribeDynamicTagRuleList	DescribeDynamicTagRuleList	get	All Resources *	None	None
cms:DeleteMonitorGroupInstances	DeleteMonitorGroupInstances	delete	MonitorGroupInstances acs:cms::{#accountId}:group/{#groupId}	None	None
cms:DescribeContactList	DescribeContactList	get	All Resources *	None	None
cms:DeleteLogMonitor	DeleteLogMonitor	delete	All Resources *	None	None
cms:PutMetricRuleTargets	PutMetricRuleTargets	create	All Resources *	None	None
cms:DescribeAlertLogCount	DescribeAlertLogCount	get	All Resources *	None	None
cms:DescribeLogMonitorAttribute	DescribeLogMonitorAttribute	get	All Resources *	None	None
cms:CreateMonitorGroupNotifyPolicy	CreateMonitorGroupNotifyPolicy	create	All Resources *	None	None
cms:DeleteMetricRuleResources	DeleteMetricRuleResources	delete	All Resources *	None	None
cms:DescribeMonitoringAgentConfig	DescribeMonitoringAgentConfig	get	All Resources *	None	None
cms:PutEventRuleTargets	PutEventRuleTargets	create	All Resources *	None	None
cms:CreateGroupMetricRules	CreateGroupMetricRules	create	GroupMetricRule acs:cms::{#accountId}:group/{#groupId}	None	None
cms:CreateMonitoringAgentProcess	CreateMonitoringAgentProcess	create	All Resources *	None	None
cms:DescribeActiveMetricRuleList	DescribeActiveMetricRuleList	get	All Resources *	None	None
cms:DeleteMonitorGroup	DeleteMonitorGroup	delete	All Resources *	None	None
cms:DescribeTagValueList	DescribeTagValueList	get	All Resources *	None	None
cms:DescribeSiteMonitorISPCityList	DescribeSiteMonitorISPCityList	get	All Resources *	None	None
cms:CreateHostAvailability	CreateHostAvailability	create	HostAvailability acs:cms::{#accountId}:group/{#groupId}	None	None
cms:DescribeMonitorGroups	DescribeMonitorGroups	get	All Resources *	None	None
cms:DescribeSystemEventCount	DescribeSystemEventCount	get	All Resources *	None	None
cms:PutHybridMonitorMetricData	PutHybridMonitorMetricData	create	All Resources *	None	None
cms:DisableActiveMetricRule	DisableActiveMetricRule	update	All Resources *	None	None
cms:CreateMonitorAgentProcess	CreateMonitorAgentProcess	create	All Resources *	None	None
cms:DescribeMonitorGroupCategories	DescribeMonitorGroupCategories	get	MonitorGroup acs:cms::{#accountId}:group/{#groupId}	None	None
cms:DescribeTagKeyList	DescribeTagKeyList	get	All Resources *	None	None
cms:QueryMetricLast	DescribeMetricLast	get	All Resources *	None	None
cms:PutEventRule	PutEventRule	create	All Resources *	None	None
cms:CreateMonitorGroup	CreateMonitorGroup	create	All Resources *	None	None
cms:UninstallMonitoringAgent	UninstallMonitoringAgent	delete	All Resources *	None	None
cms:EnableActiveMetricRule	EnableActiveMetricRule	update	All Resources *	None	None
cms:DescribeMonitoringAgentProcesses	DescribeMonitoringAgentProcesses	get	All Resources *	None	None
cms:EnableMetricRules	EnableMetricRules	update	All Resources *	None	None
cms:ModifyHostAvailability	ModifyHostAvailability	update	All Resources *	None	None
cms:QueryMetricData	DescribeMetricData	get	All Resources *	None	None
cms:CreateCustomNamespace	CreateHybridMonitorNamespace	create	All Resources *	None	None
cms:CreateSiteMonitor	CreateSiteMonitor	create	All Resources *	None	None
cms:DescribeMonitoringConfig	DescribeMonitoringConfig	get	All Resources *	None	None
cms:CreateMetricRuleResources	CreateMetricRuleResources	create	All Resources *	None	None
cms:ModifyMetricRuleBlackList	ModifyMetricRuleBlackList	update	All Resources *	None	None
cms:DescribeAlertLogList	DescribeAlertLogList	get	All Resources *	None	None
cms:DescribeProductResourceTagKeyList	DescribeProductResourceTagKeyList	get	All Resources *	None	None
cms:PutLogMonitor	PutLogMonitor	create	All Resources *	None	None
cms:PutResourceMetricRule	PutResourceMetricRule	create	All Resources *	None	None
cms:DescribeCustomEventCount	DescribeCustomEventCount	get	All Resources *	None	None
cms:DescribeProductsOfActiveMetricRule	DescribeProductsOfActiveMetricRule	get	All Resources *	None	None
cms:ModifyHostInfo	ModifyHostInfo	update	All Resources *	None	None
cms:DeleteMonitorGroupNotifyPolicy	DeleteMonitorGroupNotifyPolicy	delete	All Resources *	None	None
cms:DescribeSiteMonitorData	DescribeSiteMonitorData	get	All Resources *	None	None
cms:DescribeEventRuleTargetList	DescribeEventRuleTargetList	get	All Resources *	None	None
cms:DescribeCustomMetricList	DescribeCustomMetricList	get	All Resources *	None	None
cms:DescribeEventRuleAttribute	DescribeEventRuleAttribute	get	All Resources *	None	None
cms:DeleteCustomMetric	DeleteCustomMetric	delete	All Resources *	None	None
cms:DescribeMonitorResourceQuotaAttribute	DescribeMonitorResourceQuotaAttribute	get	All Resources *	None	None
cms:DescribeSystemEventHistogram	DescribeSystemEventHistogram	get	All Resources *	None	None
cms:DeleteContact	DeleteContact	delete	All Resources *	None	None
cms:ModifyHybridMonitorSLSGroup	ModifyHybridMonitorSLSGroup	create	All Resources *	None	None

Resource

CloudMonitorService defines the values that you can use in the Resource. You can attach the policy to a RAM user or a RAM role so that the RAM user or the RAM role can perform a specific operation on a specific resource. The ARN is the unique identifier of the resource on Alibaba Cloud. Take note of the following items:

{#}indicates a variable. {#} must be replaced with an actual value. For example, {#ramcode} must be replaced with the actual code of an Alibaba Cloud service in RAM.
An asterisk (*) is used as a wildcard. Examples:
- {#resourceType} is set to *, all resources are specified.
- {#regionId} is set to *, all regions are specified.
- {#accountId} is set to *, all Alibaba Cloud accounts are specified.

Resource type	ARN
LogMonitor	acs:cms::{#accountId}:group/{#groupId}
GroupMonitoringAgentProcess	acs:cms::{#accountId}:group/{#groupId}
HostAvailability	acs:cms::{#accountId}:group/{#groupId}
HybridMonitorNamespace	acs:cms::{#accountId}:
MetricRuleTemplate	acs:cms::{#accountId}:group/{#groupId}
GroupMetricRule	acs:cms::{#accountId}:group/{#groupId}
SlsGroup	acs:cms:{#regionId}:{#accountId}:SlsGroup/*
MonitorGroup	acs:cms::{#accountId}:group/{#groupId}
SlsGroup	acs:cms:{#regionId}:{#accountId}:SlsGroup/SlsGroupId
SiteMonitor	acs:cloudmonitorservice:{#regionId}:{#accountId}:sitemonitor/{#TaskId}
HostAvailability	acs:cms:{#regionId}:{#accountId}:HostAvailability/*
MonitorGroupInstances	acs:cms::{#accountId}:group/{#groupId}
SystemEvent	acs:cms::{#accountId}:group/{#groupId}
AlarmContact	acs:cms:{#regionId}:{#accountId}:AlarmContact/*
MonitoringAgentProcess	acs:cms::{#accountId}:group/{#groupId}
MetricRuleTargets	acs:cms::{#accountId}:*

Condition

CloudMonitorService does not define service-specific condition keys. For more information about common condition keys that are defined by Alibaba Cloud, see Generic Condition Keyword.

What to do next

You can create a custom policy and attach the policy to a RAM user, RAM user group, or RAM role. For more information, see the following topics: