RAM authorization - Alibaba Cloud DNS - Alibaba Cloud Documentation Center

Resource Access Management (RAM) is a service provided by Alibaba Cloud to manage user identities and resource access permissions. You can use RAM to prevent RAM users from sharing the AccessKey pairs of your Alibaba Cloud account. You can also use RAM to grant minimum permissions to RAM users. RAM uses policies to define permissions.

This topic describes the elements, such as Action, Resource, and Condition, which are defined by Alidns. You can use the elements to create policies in RAM. The code (RamCode) in RAM that is used to indicate Alidns is alidns,pubdns,pvtz. You can grant permissions on Alidns at the RESOURCE.

General structure of a policy

Policies can be stored as JSON files. The following code provides an example on the general structure of a policy:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

The following list describes the fields in the policy:

Effect: specifies the authorization effect. Valid values: Allow, Deny.
Action: specifies one or more API operations that are allowed or denied. For more information, see the Action section of this topic.
Resource: specifies one or more resources to which the policy applies. You can use an Alibaba Cloud Resource Name (ARN) to specify a resource. For more information, see the Resource section of this topic.
Condition: specifies one or more conditions that are required for the policy to take effect. This is an optional field. For more information, see the Condition section of this topic.
- Condition_operator: specifies the conditional operators. Different types of conditions support different conditional operators. For more information, see Policy elements.
- Condition_key: specifies the condition keys.
- Condition_value: specifies the condition values.

Action

Alidns defines the values that you can use in the Action element of a policy statement. The following table describes the values.

Operation: the value that you can use in the Action element to specify the operation on a resource.
API operation: the API operation that you can call to perform the operation.
Access level: the access level of each operation. The levels are read, write, and list.
Resource type: the type of the resource on which you can authorize the RAM user or the RAM role to perform the operation. Take note of the following items:
- The required resource types are displayed in bold characters.
- If the permissions cannot be granted at the resource level, All Resources is used in the Resource type column of the operation.
Condition key: the condition keys that are defined by the Alibaba Cloud service. The Condition key column does not list the common condition keys that are defined by Alibaba Cloud. For more information about the common condition keys, see Generic Condition Keyword.
Associated operation: other operations that the RAM user or the RAM role must have permissions to perform to complete the operation. To complete the operation, the RAM user or the RAM role must have the permissions to perform the associated operations.

Actions	API operation	Access level	Resource type	Condition key	Associated operation
alidns:GetMainDomainName	GetMainDomainName	get	All Resources *	None	None
alidns:DescribeDomains	DescribeDomains	get	All Resources *	None	None
alidns:DescribeDnsGtmMonitorAvailableConfig	DescribeDnsGtmMonitorAvailableConfig	get	All Resources *	None	None
alidns:ExecuteGtmRecoveryPlan	ExecuteGtmRecoveryPlan	WRITE	All Resources *	None	None
alidns:DescribeDnsGtmAddrAttributeInfo	DescribeDnsGtmAddrAttributeInfo	get	All Resources *	None	None
alidns:AddGtmAddressPool	AddGtmAddressPool	create	gtminstance acs:alidns::{#accountId}:gtminstance/{#gtminstanceId}	None	None
alidns:DescribeGtmInstance	DescribeGtmInstance	get	gtminstance acs:alidns::{#accountId}:gtminstance/{#instanceId}	None	None
alidns:DescribeDomainLogs	DescribeDomainLogs	get	All Resources *	None	None
alidns:DescribeDnsGtmInstanceAddressPools	DescribeDnsGtmInstanceAddressPools	get	gtmInstance acs:alidns::{#accountId}:gtmInstance/{#gtmInstanceId}	None	None
alidns:DeleteGtmRecoveryPlan	DeleteGtmRecoveryPlan	delete	All Resources *	None	None
alidns:DescribeGtmAccessStrategies	DescribeGtmAccessStrategies	get	gtminstance acs:alidns::{#accountId}:gtminstance/{#instanceId}	None	None
alidns:AddGtmMonitor	AddGtmMonitor	create	gtminstance acs:alidns::{#accountId}:gtminstance/{#gtminstanceId}	None	None
alidns:DescribeDnsGtmLogs	DescribeDnsGtmLogs	get	gtmInstance acs:alidns::{#accountId}:gtmInstance/{#gtmInstanceId}	None	None
alidns:AddGtmRecoveryPlan	AddGtmRecoveryPlan	create	All Resources *	None	None
alidns:DescribeDomainNs	DescribeDomainNs	get	domain acs:alidns::{#accountId}:domain/{#DomainName}	None	None
alidns:DeleteDnsCacheDomain	DeleteDnsCacheDomain	delete	CacheDomain acs:alidns::{#accountId}:dnscache/{#DomainName}	None	None
alidns:BindInstanceDomains	BindInstanceDomains	WRITE	All Resources *	None	None
alidns:UpdateDomainRecordRemark	UpdateDomainRecordRemark	update	Domain acs:alidns::{#accountId}:domain/{#DomainName}	None	None
alidns:DescribeSubDomainRecords	DescribeSubDomainRecords	get	Domain acs:alidns::{#accountId}:domain/{#DomainName}	None	None
alidns:DescribeTags	DescribeTags	get	All Resources *	None	None
alidns:DeleteCustomLines	DeleteCustomLines	delete	domain acs:alidns::{#accountId}:domain/{#domainName}	None	None
alidns:UpdateDnsGtmMonitor	UpdateDnsGtmMonitor	update	MonitorConfig acs:alidns:*:{#accountId}:gtminstance/{#InstanceId}	None	None
alidns:DeleteDnsGtmAccessStrategy	DeleteDnsGtmAccessStrategy	delete	gtmInstance acs:alidns::{#accountId}:gtmInstance/{#gtmInstanceId}	None	None
alidns:DeleteGtmAddressPool	DeleteGtmAddressPool	delete	gtminstance acs:alidns::{#accountId}:gtminstance/{#instanceId}	None	None
alidns:DescribeGtmRecoveryPlans	DescribeGtmRecoveryPlans	get	All Resources *	None	None
alidns:UpdateGtmAddressPool	UpdateGtmAddressPool	update	gtminstance acs:alidns::{#accountId}:gtminstance/{#instanceId}	None	None
alidns:RollbackGtmRecoveryPlan	RollbackGtmRecoveryPlan	WRITE	All Resources *	None	None
alidns:AddDnsCacheDomain	AddDnsCacheDomain	create	CacheDomain acs:alidns::{#accountId}:dnscache/*	None	None
alidns:PreviewGtmRecoveryPlan	PreviewGtmRecoveryPlan	get	All Resources *	None	None
alidns:UpdateGtmMonitor	UpdateGtmMonitor	update	gtmInstance acs:alidns::{#accountId}:gtmInstance/{#gtmInstanceId}	None	None
alidns:AddGtmAccessStrategy	AddGtmAccessStrategy	create	gtminstance acs:alidns::{#accountId}:gtminstance/{#gtminstanceId}	None	None
alidns:UpdateDnsGtmInstanceGlobalConfig	UpdateDnsGtmInstanceGlobalConfig	update	gtmInstance acs:alidns::{#accountId}:gtmInstance/{#gtmInstanceId}	None	None
alidns:AddDnsGtmAddressPool	AddDnsGtmAddressPool	create	gtmInstance acs:alidns::{#accountId}:gtmInstance/{#gtmInstanceId}	None	None
alidns:DescribeGtmInstanceAddressPool	DescribeGtmInstanceAddressPool	get	GtmInstance acs:alidns::{#accountId}:gtminstance/{#instanceId}	None	None
alidns:SetDomainDnssecStatus	SetDomainDnssecStatus	update	Domain acs:alidns::{#accountId}:domain/{#DomainName}	None	None
alidns:DescribeDnsGtmAccessStrategy	DescribeDnsGtmAccessStrategy	get	gtmInstance acs:alidns::{#accountId}:gtmInstance/{#gtmInstanceId}	None	None
alidns:DescribeDnsProductInstance	DescribeDnsProductInstance	get	instance acs:alidns::{#accountId}:instance/{#instanceId}	None	None
alidns:DescribeGtmAvailableAlertGroup	DescribeGtmAvailableAlertGroup	get	All Resources *	None	None
alidns:CopyGtmConfig	CopyGtmConfig	WRITE	All Resources *	None	None
alidns:DescribeGtmInstances	DescribeGtmInstances	get	All Resources *	None	None
alidns:SetDomainRecordStatus	SetDomainRecordStatus	update	Domain acs:alidns::{#accountId}:domain/{#DomainName}	None	None
alidns:DescribeDnsProductInstances	DescribeDnsProductInstances	get	Instance acs:alidns::{#accountId}:instance/	None	None
alidns:DescribeDohAccountStatistics	DescribeDohAccountStatistics	get	All Resources *	None	None
alidns:DeleteDomainRecord	DeleteDomainRecord	delete	domain acs:alidns::{#accountId}:domain/{#domainName}	None	None
alidns:DescribeDnsGtmInstanceStatus	DescribeDnsGtmInstanceStatus	get	gtmInstance acs:alidns::{#accountId}:gtmInstance/{#gtmInstanceId}	None	None
alidns:DescribeTransferDomains	DescribeTransferDomains	get	All Resources *	None	None
alidns:DescribeGtmInstanceSystemCname	DescribeGtmInstanceSystemCname	get	GtmInstance acs:alidns::{#accountId}:gtminstance/{#instanceId}	None	None
alidns:SetGtmMonitorStatus	SetGtmMonitorStatus	update	gtmInstance acs:alidns::{#accountId}:gtminstance/{#instanceId}	None	None
alidns:DescribeDomainStatistics	DescribeDomainStatistics	get	Domain acs:alidns::{#accountId}:domain/{#DomainName}	None	None
alidns:UpdateDomainGroup	UpdateDomainGroup	update	group acs:alidns::{#accountId}:group/{#groupId}	None	None
alidns:DescribeDnsGtmAddressPoolAvailableConfig	DescribeDnsGtmAddressPoolAvailableConfig	get	gtmInstance acs:alidns::{#accountId}:gtmInstance/{#gtmInstanceId}	None	None
alidns:DeleteSubDomainRecords	DeleteSubDomainRecords	delete	domain acs:alidns::{#accountId}:domain/{#domainName}	None	None
alidns:SwitchDnsGtmInstanceStrategyMode	SwitchDnsGtmInstanceStrategyMode	WRITE	gtmInstance acs:alidns::{#accountId}:gtmInstance/{#gtmInstanceId}	None	None
alidns:DescribeInstanceDomains	DescribeInstanceDomains	get	instance acs:alidns::{#accountId}:instance/{#instanceId}	None	None
alidns:UpdateGtmInstanceGlobalConfig	UpdateGtmInstanceGlobalConfig	update	gtmInstance acs:alidns::{#accountId}:gtminstance/{#instanceId}	None	None
alidns:RetrieveDomain	RetrieveDomain	none	All Resources *	None	None
alidns:TransferDomain	TransferDomain	WRITE	All Resources *	None	None
alidns:DescribeCustomLines	DescribeCustomLines	get	domain acs:alidns::{#accountId}:domain/{#domainName}	None	None
alidns:AddDnsGtmMonitor	AddDnsGtmMonitor	create	gtmInstance acs:alidns::{#accountId}:gtmInstance/{#gtmInstanceId}	None	None
alidns:ListTagResources	ListTagResources	get	All Resources *	None	None
alidns:DescribeDnsGtmAccessStrategyAvailableConfig	DescribeDnsGtmAccessStrategyAvailableConfig	get	gtmInstance acs:alidns::{#accountId}:gtmInstance/{#gtmInstanceId}	None	None
alidns:UpdateDnsGtmAddressPool	UpdateDnsGtmAddressPool	update	gtmInstance acs:alidns::{#accountId}:gtmInstance/{#gtmInstanceId}	None	None
alidns:DescribeSupportLines	DescribeSupportLines	get	All Resources *	None	None
alidns:ModifyHichinaDomainDNS	ModifyHichinaDomainDNS	update	Domain acs:alidns::{#accountId}:domain/{#DomainName}	None	None
alidns:DeleteDnsGtmAddressPool	DeleteDnsGtmAddressPool	delete	gtmInstance acs:alidns::{#accountId}:gtmInstance/{#gtmInstanceId}	None	None
alidns:UpdateGtmAccessStrategy	UpdateGtmAccessStrategy	update	gtmInstance acs:alidns::{#accountId}:gtminstance/{#instanceId}	None	None
alidns:DescribeDomainRecords	DescribeDomainRecords	get	Domain acs:alidns::{#accountId}:domain/{#DomainName}	None	None
alidns:DescribeBatchResultCount	DescribeBatchResultCount	get	All Resources *	None	None
alidns:DescribeRecordStatisticsSummary	DescribeRecordStatisticsSummary	get	Domain acs:alidns::{#accountId}:domain/{#DomainName}	None	None
alidns:DescribeDnsGtmInstanceSystemCname	DescribeDnsGtmInstanceSystemCname	get	gtmInstance acs:alidns::{#accountId}:gtmInstance/{#gtmInstanceId}	None	None
alidns:DescribeDomainRecordInfo	DescribeDomainRecordInfo	get	Domain acs:alidns::{#accountId}:domain/{#DomainName}	None	None
alidns:DescribeDomainDnssecInfo	DescribeDomainDnssecInfo	get	domain acs:alidns::{#accountId}:domain/{#domainName}	None	None
alidns:DescribeDnsGtmInstance	DescribeDnsGtmInstance	get	gtmInstance acs:alidns::{#accountId}:gtmInstance/{#gtmInstanceId}	None	None
alidns:DescribeCustomLine	DescribeCustomLine	get	Domain acs:alidns:*:{#accountId}:domain/{#DomainName}	None	None
alidns:DescribeGtmAccessStrategy	DescribeGtmAccessStrategy	get	All Resources *	None	None
alidns:DescribeGtmLogs	DescribeGtmLogs	get	All Resources *	None	None
alidns:DeleteDomainGroup	DeleteDomainGroup	delete	group acs:alidns::{#accountId}:group/{#groupId}	None	None
alidns:DescribeDohSubDomainStatistics	DescribeDohSubDomainStatistics	get	All Resources *	None	None
alidns:DescribeDohDomainStatisticsSummary	DescribeDohDomainStatisticsSummary	get	All Resources *	None	None
alidns:DescribeDohUserInfo	DescribeDohUserInfo	get	All Resources *	None	None
alidns:DescribeDomainStatisticsSummary	DescribeDomainStatisticsSummary	get	All Resources *	None	None
alidns:AddDomainBackup	AddDomainBackup	create	domain acs:alidns::{#accountId}:domain/{#domainId}	None	None
alidns:DescribeDnsGtmAvailableAlertGroup	DescribeDnsGtmAvailableAlertGroup	get	All Resources *	None	None
alidns:DescribeGtmMonitorConfig	DescribeGtmMonitorConfig	get	gtmInstance acs:alidns::{#accountId}:gtminstance/{#instanceId}	None	None
alidns:AddDomainRecord	AddDomainRecord	create	domain acs:alidns::{#accountId}:domain/{#domainName}	None	None
alidns:DeleteDomain	DeleteDomain	delete	domain acs:alidns::{#accountId}:domain/{#domainName}	None	None
alidns:UpdateDnsGtmAccessStrategy	UpdateDnsGtmAccessStrategy	update	gtmInstance acs:alidns::{#accountId}:gtmInstance/{#gtmInstanceId}	None	None
alidns:UpdateDomainRemark	UpdateDomainRemark	update	Domain acs:alidns::{#accountId}:domain/{#DomainName}	None	None
alidns:AddDomain	AddDomain	create	All Resources *	None	None
alidns:DescribeGtmRecoveryPlan	DescribeGtmRecoveryPlan	get	All Resources *	None	None
alidns:DescribeDNSSLBSubDomains	DescribeDNSSLBSubDomains	get	domain acs:alidns::{#accountId}:domain/{#domainId}	None	None
alidns:DescribeGtmInstanceAddressPools	DescribeGtmInstanceAddressPools	get	GtmInstance acs:alidns::{#accountId}:gtminstance/{#instanceId}	None	None
alidns:AddDomainGroup	AddDomainGroup	create	All Resources *	None	None
alidns:DescribeRecordLogs	DescribeRecordLogs	get	Domain acs:alidns:*:{#accountId}:domain/{#DomainName}	None	None
alidns:DescribeRecordResolveStatisticsSummary	DescribeRecordResolveStatisticsSummary		Domain acs:alidns:*:{#accountId}:domain/{#DomainName}	None	None
alidns:SetDNSSLBStatus	SetDNSSLBStatus	update	domain acs:alidns::{#accountId}:domain/{#domainId}	None	None
alidns:DescribeGtmInstanceStatus	DescribeGtmInstanceStatus	get	GtmInstance acs:alidns::{#accountId}:gtminstance/{#instanceId}	None	None
alidns:AddCustomLine	AddCustomLine	create	domain acs:alidns::{#accountId}:domain/{#domainId}	None	None
alidns:UntagResources	UntagResources		All Resources *	None	None
alidns:UpdateDNSSLBWeight	UpdateDNSSLBWeight	update	Domain acs:alidns::{#accountId}:domain/{#DomainName}	None	None
alidns:UpdateDnsCacheDomain	UpdateDnsCacheDomain	update	CacheDomain acs:alidns::{#accountId}:dnscache/{#DomainName}	None	None
alidns:DescribeDnsGtmInstances	DescribeDnsGtmInstances	get	All Resources *	None	None
alidns:OperateBatchDomain	OperateBatchDomain	WRITE	All Resources *	None	None
alidns:DescribeGtmAccessStrategyAvailableConfig	DescribeGtmAccessStrategyAvailableConfig	get	GtmInstance acs:alidns::{#accountId}:gtminstance/{#instanceId}	None	None
alidns:SetDnsGtmAccessMode	SetDnsGtmAccessMode	update	AccessStrategy acs:alidns:*:{#accountId}:gtminstance/{#InstanceId}	None	None
alidns:DeleteGtmAccessStrategy	DeleteGtmAccessStrategy	delete	GtmInstance acs:alidns::{#accountId}:gtminstance/{#instanceId}	None	None
alidns:DescribeDnsGtmMonitorConfig	DescribeDnsGtmMonitorConfig	get	gtmInstance acs:alidns::{#accountId}:gtmInstance/{#gtmInstanceId}	None	None
alidns:SetGtmAccessMode	SetGtmAccessMode	update	gtmInstance acs:alidns::{#accountId}:gtminstance/{#instanceId}	None	None
alidns:DescribeDomainGroups	DescribeDomainGroups	get	All Resources *	None	None
alidns:SetDnsGtmMonitorStatus	SetDnsGtmMonitorStatus	update	MonitorConfig acs:alidns:*:{#accountId}:gtminstance/{#InstanceId}	None	None
alidns:GetTxtRecordForVerify	GetTxtRecordForVerify	get	All Resources *	None	None
alidns:AddDnsGtmAccessStrategy	AddDnsGtmAccessStrategy	create	gtmInstance acs:alidns::{#accountId}:gtmInstance/{#gtmInstanceId}	None	None
alidns:MoveDomainResourceGroup	MoveDomainResourceGroup	WRITE	Domain acs:alidns::{#accountId}:domain/{#DomainName}	None	None
alidns:DescribeDomainInfo	DescribeDomainInfo	get	All Resources *	None	None
alidns:UpdateGtmRecoveryPlan	UpdateGtmRecoveryPlan	update	All Resources *	None	None
alidns:ChangeDomainGroup	ChangeDomainGroup	update	domain acs:alidns::{#accountId}:domain/{#domainName} group acs:alidns::{#accountId}:group/{#groupId}	None	None
alidns:DescribeBatchResultDetail	DescribeBatchResultDetail	get	All Resources *	None	None
alidns:DescribeDomainResolveStatisticsSummary	DescribeDomainResolveStatisticsSummary		All Resources *	None	None
alidns:UpdateDnsCacheDomainRemark	UpdateDnsCacheDomainRemark	update	CacheDomain acs:alidns::{#accountId}:dnscache/{#DomainName}	None	None
alidns:DescribeRecordStatistics	DescribeRecordStatistics	get	Domain acs:alidns:*:{#accountId}:domain/{#DomainName}	None	None
alidns:DescribeDohSubDomainStatisticsSummary	DescribeDohSubDomainStatisticsSummary	get	All Resources *	None	None
alidns:UpdateDomainRecord	UpdateDomainRecord	update	domain acs:alidns::{#accountId}:domain/{#domainId}	None	None
alidns:DescribeGtmRecoveryPlanAvailableConfig	DescribeGtmRecoveryPlanAvailableConfig	get	All Resources *	None	None
alidns:DescribeGtmMonitorAvailableConfig	DescribeGtmMonitorAvailableConfig	get	All Resources *	None	None
alidns:UpdateCustomLine	UpdateCustomLine	update	Domain acs:alidns:*:{#accountId}:domain/{#DomainName}	None	None
alidns:DescribeDnsGtmInstanceAddressPool	DescribeDnsGtmInstanceAddressPool	get	gtmInstance acs:alidns::{#accountId}:gtmInstance/{#gtmInstanceId}	None	None
alidns:DescribeDnsCacheDomains	DescribeDnsCacheDomains	get	CacheDomain acs:alidns::{#accountId}:dnscache/*	None	None
alidns:DescribeDnsGtmAccessStrategies	DescribeDnsGtmAccessStrategies	get	gtmInstance acs:alidns::{#accountId}:gtmInstance/{#gtmInstanceId}	None	None
alidns:TagResources	TagResources		All Resources *	None	None
alidns:DescribeDohDomainStatistics	DescribeDohDomainStatistics	get	All Resources *	alidns:test	None
alidns:UnbindInstanceDomains	UnbindInstanceDomains	WRITE	Instance acs:alidns::{#accountId}:instance/{#InstanceId} Domain acs:alidns::{#accountId}:domain/{#DomainName}	None	None

Resource

Alidns defines the values that you can use in the Resource. You can attach the policy to a RAM user or a RAM role so that the RAM user or the RAM role can perform a specific operation on a specific resource. The ARN is the unique identifier of the resource on Alibaba Cloud. Take note of the following items:

{#}indicates a variable. {#} must be replaced with an actual value. For example, {#ramcode} must be replaced with the actual code of an Alibaba Cloud service in RAM.
An asterisk (*) is used as a wildcard. Examples:
- {#resourceType} is set to *, all resources are specified.
- {#regionId} is set to *, all regions are specified.
- {#accountId} is set to *, all Alibaba Cloud accounts are specified.

Resource type	ARN
cloudGtmAddressPool	acs:alidns::{#accountId}:cloudGtmAddressPool/{#addressPoolId}
domain	acs:alidns::{#accountId}:domain/*
GtmInstance	acs:alidns::{#accountId}:gtminstance/{#instanceId}
gtmInstance	acs:alidns::{#accountId}:gtmInstance/*
GtmInstance	acs:alidns:*:{#accountId}:gtminstance/{#InstanceId}
gtminstance	acs:alidns::{#accountId}:gtminstance/*
gtminstance	acs:alidns::{#accountId}:gtminstance/{#gtminstanceId}
cloudGtmAddress	acs:alidns::{#accountId}:cloudGtmAddress/*
Domain	acs:alidns:*:{#accountId}:domain/{#DomainName}
GtmInstance	acs:alidns::{#accountId}:gtminstance/*
gtminstance	acs:alidns::{#accountId}:gtminstance/{#instanceId}
Domain	acs:alidns::{#accountId}:domain/*
gtmInstance	acs:alidns::{#accountId}:gtmInstance/{#gtmInstanceId}
cloudGtmMonitorTemplate	acs:alidns::{#accountId}:cloudGtmMonitorTemplate/*
Domain	acs:alidns::{#accountId}:flushcache/
domain	acs:alidns::{#accountId}:domain/{#domainId}
domain	acs:alidns::{#accountId}:domain/{#DomainName}
CacheDomain	acs:alidns::{#accountId}:dnscache/{#DomainName}
instance	acs:alidns::{#accountId}:instance/{#instanceId}
Domain	acs:alidns::{#accountId}:domain/{#DomainName}
Fusion	acs:alidns::{#accountId}:fusion/*
domain	acs:alidns::{#accountId}:domain/{#domainName}
MonitorConfig	acs:alidns:*:{#accountId}:gtminstance/{#InstanceId}
cloudGtmMonitorTemplate	acs:alidns::{#accountId}:cloudGtmMonitorTemplate/{#templateId}
cloudGtmAddress	acs:alidns::{#accountId}:cloudGtmAddress/{#addressId}
CacheDomain	acs:alidns::{#accountId}:dnscache/*
cloudGtmAddress	acs:alidns::{#accountId}:*
gtmInstnace	acs:alidns::{#accountId}:gtmInstnace/
Instance	acs:alidns::{#accountId}:instance/
doh	acs:alidns::{#accountId}:doh/*
Domain	acs:alidns::{#accountId}:domain/
gtmInstance	acs:alidns::{#accountId}:gtminstance/{#instanceId}
Instance	acs:alidns:*:{#accountId}:instance/{#InstanceId}
group	acs:alidns::{#accountId}:group/{#groupId}
cloudGtmAddress	acs:alidns::{#accountId}:/
Domain	acs:alidns::{#accountId}:doh/
cloudGtmAddressPool	acs:alidns::{#accountId}:cloudGtmAddressPool/{#addressId}
Domain	acs:eiam:{#regionId}:{#accountId}:flushcache/*
group	acs:alidns::{#accountId}:group/*
AccessStrategy	acs:alidns:*:{#accountId}:gtminstance/{#InstanceId}
group	acs:alidns::{#accountId}:group/
domain	acs:alidns::{#accountId}:domain/{#$domainName}
domain	acs:alidns::{#accountId}:domain/
instance	acs:alidns::{#accountId}:instance/*
PdnsAppKey	acs:pubdns::{#accountId}:*

Condition

Alidns does not define service-specific condition keys. For more information about common condition keys that are defined by Alibaba Cloud, see Generic Condition Keyword.

What to do next

You can create a custom policy and attach the policy to a RAM user, RAM user group, or RAM role. For more information, see the following topics: