RAM authorization - Elastic Compute Service - Alibaba Cloud Documentation Center

Resource Access Management (RAM) is a service provided by Alibaba Cloud to manage user identities and resource access permissions. Using RAM helps you avoid sharing your Alibaba Cloud account keys with other users and allows you to grant users the least privilege access. RAM uses permission policies to define authorizations. This topic describes the general structure of a RAM policy, and the policy statement elements (Action, Resource, and Condition) defined by Elastic Block Storage for RAM permission policies. The RAM code (RamCode) for Elastic Block Storage is ebs , and the supported authorization granularity is RESOURCE .

General structure of a policy

Permission policies support JSON format with the following general structure:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

The following list describes the fields in the policy:

Version: Specifies the policy version number. It is fixed at 1.
Statement:
- Effect: Specifies the authorization result. Valid values: Allow and Deny.
- Action: Specifies one or more operations that are allowed or denied.
- Resource: Specifies the specific objects affected by the operations. You can use Alibaba Cloud Resource Names (ARNs) to describe specific resources.
- Condition: Specifies the conditions for the authorization to take effect. This field is optional.
  - Condition operator: Specifies the conditional operators. Different types of conditions support different conditional operators.
  - Condition_key: Specifies the condition keys.
  - Condition_value: Specifies the condition values.

Action

The following table lists the actions defined by Elastic Block Storage. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that support authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding ARN in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys that are applicable across all RAM-integrated services. For more information, see Common condition keys.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action	API	Access level	Resource type	Condition key	Dependent action
ebs:StartPairDrill	StartPairDrill	create	*DiskReplicaPair `acs:ebs:{#regionId}:{#accountId}:diskreplicapair/{#PairId}`	None	None
ebs:DescribeSolutionInstanceConfiguration	DescribeSolutionInstanceConfiguration	get	All Resource ``	None	None
ebs:QueryDedicatedBlockStorageClusterDiskThroughputStatus	QueryDedicatedBlockStorageClusterDiskThroughputStatus	get	All Resource ``	None	None
ebs:CreateDiskReplicaGroup	CreateDiskReplicaGroup	create	DiskReplicaGroup `acs:ebs:{#regionId}:{#accountId}:diskreplicagroup/`	None	None
ebs:UntagResources	UntagResources	delete	All Resource ``	None	None
ebs:UpdateEnterpriseSnapshotPolicy	UpdateEnterpriseSnapshotPolicy	update	*EnterpriseSnapshotPolicy `acs:ebs:{#regionId}:{#accountId}:enterprisesnapshotpolicy/{#EnterpriseSnapshotPolicyId}`	None	None
ebs:CreateEnterpriseSnapshotPolicy	CreateEnterpriseSnapshotPolicy	create	EnterpriseSnapshotPolicy `acs:ebs:{#regionId}:{#accountId}:enterprisesnapshotpolicy/`	None	None
ebs:FailoverDiskReplicaGroup	FailoverDiskReplicaGroup	update	*DiskReplicaGroup `acs:ebs:{#regionId}:{#accountId}:diskreplicagroup/{#ReplicaGroupId}`	None	None
ebs:ChangeResourceGroup	ChangeResourceGroup	update	DedicatedBlockStorageCluster `acs:ebs:{#regionId}:{#accountId}:dedicatedblockstoragecluster/{#dedicatedblockstorageclusterId}` DiskReplicaGroup `acs:ebs:{#regionId}:{#accountId}:diskreplicagroup/{#diskreplicagroupId}` DiskReplicaPair `acs:ebs:{#regionId}:{#accountId}:diskreplicapair/{#diskreplicapairId}` EnterpriseSnapshotPolicy `acs:ebs:{#regionId}:{#accountId}:enterprisesnapshotpolicy/{#EnterpriseSnapshotPolicyId}` *SolutionInstance `acs:ebs:{#regionId}:{#accountId}:solutioninstance/{#SolutionInstanceId}`	None	None
ebs:StartReplicaGroupDrill	StartReplicaGroupDrill	create	*DiskReplicaGroup `acs:ebs:{#regionId}:{#accountId}:diskreplicagroup/{#GroupId}`	None	None
ebs:CreateDedicatedBlockStorageCluster	CreateDedicatedBlockStorageCluster	create	DedicatedBlockStorageCluster `acs:ebs:{#regionId}:{#accountId}:dedicatedblockstoragecluster/`	None	ram:CreateServiceLinkedRole
ebs:StartDiskReplicaGroup	StartDiskReplicaGroup	update	*DiskReplicaGroup `acs:ebs:{#regionId}:{#accountId}:diskreplicagroup/{#ReplicaGroupId}`	None	None
ebs:ClearPairDrill	ClearPairDrill	delete	*DiskReplicaPair `acs:ebs:{#regionId}:{#accountId}:diskreplicapair/{#PairId}`	None	None
ebs:UnbindEnterpriseSnapshotPolicy	UnbindEnterpriseSnapshotPolicy	update	*EnterpriseSnapshotPolicy `acs:ebs:{#regionId}:{#accountId}:enterprisesnapshotpolicy/{#EnterpriseSnapshotPolicyId}`	None	None
ebs:StartDiskReplicaPair	StartDiskReplicaPair	update	*DiskReplicaPair `acs:ebs:{#regionId}:{#accountId}:diskreplicapair/{#ReplicaPairId}`	None	None
ebs:DescribeDiskMonitorData	DescribeDiskMonitorData	get	All Resource ``	None	None
ebs:CreateDiskReplicaPair	CreateDiskReplicaPair	create	DiskReplicaPair `acs:ebs:{#regionId}:{#accountId}:diskreplicapair/`	None	ram:CreateServiceLinkedRole
ebs:DescribeEvents	DescribeEvents	none	All Resource ``	None	None
ebs:AddDiskReplicaPair	AddDiskReplicaPair	create	*DiskReplicaGroup `acs:ebs:{#regionId}:{#accountId}:diskreplicagroup/{#ReplicaGroupId}`	None	None
ebs:ListTagResources	ListTagResources	list	All Resource ``	None	None
ebs:DescribeRegions	DescribeRegions	get	All Resource ``	None	None
ebs:DescribeDiskReplicaGroups	DescribeDiskReplicaGroups	list	DiskReplicaGroup `acs:ebs:{#regionId}:{#accountId}:diskreplicagroup/` *DiskReplicaGroup `acs:ebs:{#regionId}:{#accountId}:diskreplicagroup/{#ReplicaGroupId}`	None	None
ebs:ListReports	ListReports	list	All Resource ``	None	None
ebs:DeleteDiskReplicaPair	DeleteDiskReplicaPair	delete	*DiskReplicaPair `acs:ebs:{#regionId}:{#accountId}:diskreplicapair/{#ReplicaPairId}`	None	None
ebs:DescribeDiskReplicaPairProgress	DescribeDiskReplicaPairProgress	get	*DiskReplicaPair `acs:ebs:{#regionId}:{#accountId}:diskreplicapair/{#ReplicaPairId}`	None	None
ebs:DescribeDedicatedBlockStorageClusterDisks	DescribeDedicatedBlockStorageClusterDisks	get	*DedicatedBlockStorageCluster `acs:ebs:{#regionId}:{#accountId}:dedicatedblockstoragecluster/{#DedicatedBlockStorageClusterId}`	None	None
ebs:StopDiskReplicaPair	StopDiskReplicaPair	none	*DiskReplicaPair `acs:ebs:{#regionId}:{#accountId}:diskreplicapair/{#ReplicaPairId}`	None	None
ebs:ClearReplicaGroupDrill	ClearReplicaGroupDrill	delete	*DiskReplicaGroup `acs:ebs:{#regionId}:{#accountId}:diskreplicagroup/{#GroupId}`	None	None
ebs:ReprotectDiskReplicaGroup	ReprotectDiskReplicaGroup	update	*DiskReplicaGroup `acs:ebs:{#regionId}:{#accountId}:diskreplicagroup/{#ReplicaGroupId}`	None	None
ebs:DescribeDedicatedBlockStorageClusters	DescribeDedicatedBlockStorageClusters	get	DedicatedBlockStorageCluster `acs:ebs:{#regionId}:{#accountId}:dedicatedblockstoragecluster/` *DedicatedBlockStorageCluster `acs:ebs:{#regionId}:{#accountId}:dedicatedblockstoragecluster/{#DedicatedBlockStorageClusterId}`	None	None
ebs:ApplyLensService	ApplyLensService	update	All Resource ``	None	None
ebs:ModifyDedicatedBlockStorageClusterAttribute	ModifyDedicatedBlockStorageClusterAttribute	update	*DedicatedBlockStorageCluster `acs:ebs:{#regionId}:{#accountId}:dedicatedblockstoragecluster/{#DedicatedBlockStorageClusterId}`	None	None
ebs:CancelLensService	CancelLensService	update	All Resource ``	None	None
ebs:TagResources	TagResources	create	DedicatedBlockStorageCluster `acs:ebs:{#regionId}:{#accountId}:dedicatedblockstoragecluster/{#DedicatedBlockStorageClusterId}` DiskReplicaGroup `acs:ebs:{#regionId}:{#accountId}:diskreplicagroup/{#ReplicaGroupId}` DiskReplicaPair `acs:ebs:{#regionId}:{#accountId}:diskreplicapair/{#ReplicaPairId}` EnterpriseSnapshotPolicy `acs:ebs:{#regionId}:{#accountId}:enterprisesnapshotpolicy/{#EnterpriseSnapshotPolicyId}` *SolutionInstance `acs:ebs:{#regionId}:{#accountId}:solutioninstance/{#SolutionInstanceId}`	None	None
ebs:QueryDedicatedBlockStorageClusterInventoryData	QueryDedicatedBlockStorageClusterInventoryData	get	*DedicatedBlockStorageCluster `acs:ebs:{#regionId}:{#accountId}:dedicatedblockstoragecluster/{#DedicatedBlockStorageClusterId}`	None	None
ebs:DescribeMetricData	DescribeMetricData	list	All Resource ``	None	None
ebs:StopDiskReplicaGroup	StopDiskReplicaGroup	update	*DiskReplicaGroup `acs:ebs:{#regionId}:{#accountId}:diskreplicagroup/{#ReplicaGroupId}`	None	None
ebs:SetDedicatedBlockStorageClusterDiskThroughput	SetDedicatedBlockStorageClusterDiskThroughput	update	All Resource ``	None	None
ebs:FailoverDiskReplicaPair	FailoverDiskReplicaPair	update	*DiskReplicaPair `acs:ebs:{#regionId}:{#accountId}:diskreplicapair/{#ReplicaPairId}`	None	None
ebs:DescribePairDrills	DescribePairDrills	list	*DiskReplicaPair `acs:ebs:{#regionId}:{#accountId}:diskreplicapair/{#PairId}`	None	None
ebs:DescribeEnterpriseSnapshotPolicy	DescribeEnterpriseSnapshotPolicy	list	EnterpriseSnapshotPolicy `acs:ebs:{#regionId}:{#accountId}:enterprisesnapshotpolicy/{#EnterpriseSnapshotPolicyId}` EnterpriseSnapshotPolicy `acs:ebs:{#regionId}:{#accountId}:enterprisesnapshotpolicy/*`	None	None
ebs:BindEnterpriseSnapshotPolicy	BindEnterpriseSnapshotPolicy	update	*EnterpriseSnapshotPolicy `acs:ebs:{#regionId}:{#accountId}:enterprisesnapshotpolicy/{#EnterpriseSnapshotPolicyId}`	None	None
ebs:DescribeDiskMonitorDataList	DescribeDiskMonitorDataList	list	All Resource ``	None	None
ebs:RemoveDiskReplicaPair	RemoveDiskReplicaPair	update	*DiskReplicaGroup `acs:ebs:{#regionId}:{#accountId}:diskreplicagroup/{#ReplicaGroupId}`	None	None
ebs:DeleteDiskReplicaGroup	DeleteDiskReplicaGroup	delete	*DiskReplicaGroup `acs:ebs:{#regionId}:{#accountId}:diskreplicagroup/{#ReplicaGroupId}`	None	None
ebs:DescribeUserTagValues	DescribeUserTagValues	list	All Resource ``	None	None
ebs:DeleteEnterpriseSnapshotPolicy	DeleteEnterpriseSnapshotPolicy	delete	*EnterpriseSnapshotPolicy `acs:ebs:{#regionId}:{#accountId}:enterprisesnapshotpolicy/{#EnterpriseSnapshotPolicyId}`	None	None
ebs:GetReport	GetReport	get	All Resource ``	None	None
ebs:ModifyDiskReplicaPair	ModifyDiskReplicaPair	update	*DiskReplicaPair `acs:ebs:{#regionId}:{#accountId}:diskreplicapair/{#ReplicaPairId}`	None	None
ebs:DescribeLensMonitorDisks	DescribeLensMonitorDisks	list	All Resource ``	None	None
ebs:DescribeDiskEvents	DescribeDiskEvents	list	All Resource ``	None	None
ebs:DescribeUserTagKeys	DescribeUserTagKeys	list	All Resource ``	None	None
ebs:DescribeReplicaGroupDrills	DescribeReplicaGroupDrills	list	*DiskReplicaGroup `acs:ebs:{#regionId}:{#accountId}:diskreplicagroup/{#GroupId}`	None	None
ebs:ReprotectDiskReplicaPair	ReprotectDiskReplicaPair	update	*DiskReplicaPair `acs:ebs:{#regionId}:{#accountId}:diskreplicapair/{#ReplicaPairId}`	None	None
ebs:UpdateSolutionInstanceAttribute	UpdateSolutionInstanceAttribute	update	*SolutionInstance `acs:ebs:{#regionId}:{#accountId}:solutioninstance/{#SolutionInstanceId}`	None	None
ebs:DescribeLensServiceStatus	DescribeLensServiceStatus	get	All Resource ``	None	None
ebs:DescribeDiskReplicaPairs	DescribeDiskReplicaPairs	get	DiskReplicaPair `acs:ebs:{#regionId}:{#accountId}:diskreplicapair/` *DiskReplicaPair `acs:ebs:{#regionId}:{#accountId}:diskreplicapair/{#ReplicaPairId}`	None	None
ebs:ModifyDiskReplicaGroup	ModifyDiskReplicaGroup	update	*DiskReplicaGroup `acs:ebs:{#regionId}:{#accountId}:diskreplicagroup/{#ReplicaGroupId}`	None	None

Resource

The following table lists the resources defined by Elastic Block Storage. Specify them in the Resource element of RAM policy statements to grant permissions for specific operations. They are uniquely identified by ARNs. Format: acs:{#ramcode}:{#regionId}:{#accountId}:{#resourceType}:

acs: The initialism of Alibaba Cloud service, which indicates the public cloud of Alibaba Cloud.
{#ramcode}: The code used in RAM to indicate an Alibaba Cloud service.
{#regionId}: The region ID. If the resource covers all regions, set it to an asterisk (*).
{#accountId}: The ID of the Alibaba Cloud account. If the resource covers all Alibaba Cloud accounts, set it to an asterisk (*).
{#resourceType}: The service-defined resource identifier. It supports a hierarchical structure, which is similar to a file path. If the statement covers global resources, set it to an asterisk (*).

Resource type	ARN
DiskReplicaPair	acs:ebs:{#regionId}:{#accountId}:diskreplicapair/{#PairId} acs:ebs:{#regionId}:{#accountId}:diskreplicapair/{#ReplicaPairId} acs:ebs:{#regionId}:{#accountId}:diskreplicapair/{#diskreplicapairId} acs:ebs:{#regionId}:{#accountId}:diskreplicapair/*
Solution	acs:ebs:{#regionId}:{#accountId}:solution/*
DedicatedBlockStorageCluster	acs:ebs:{#regionId}:{#accountId}:dedicatedblockstoragecluster/* acs:ebs:{#regionId}:{#accountId}:dedicatedblockstoragecluster/{#DedicatedBlockStorageClusterId}
DiskReplicaGroup	acs:ebs:{#regionId}:{#accountId}:diskreplicagroup/* acs:ebs:{#regionId}:{#accountId}:diskreplicagroup/{#ReplicaGroupId} acs:ebs:{#regionId}:{#accountId}:diskreplicagroup/{#diskreplicagroupId} acs:ebs:{#regionId}:{#accountId}:diskreplicagroup/{#GroupId}
EnterpriseSnapshotPolicy	acs:ebs:{#regionId}:{#accountId}:enterprisesnapshotpolicy/{#EnterpriseSnapshotPolicyId} acs:ebs:{#regionId}:{#accountId}:enterprisesnapshotpolicy/*
SolutionInstance	acs:ebs:{#regionId}:{#accountId}:solutioninstance/{#SolutionInstanceId} acs:ebs:{#regionId}:{#accountId}:solutioninstance/*
Lens	acs:ebs:{#regionId}:{#accountId}:lens/*
App	acs:ebs:{#regionId}:{#accountId}:app/*
Disk	acs:ebs::{#accountId}:lens/*

Condition

Elastic Block Storage does not define product-level condition keys. However, you can use Alibaba Cloud common condition keys for access control. For more information, see Common condition keys.

How to create custom RAM policies?

You can create custom policies and grant them to RAM users, RAM user groups, or RAM roles. For instructions, see: