RAM authorization - Function Compute - Alibaba Cloud Documentation Center

Resource Access Management (RAM) is a service provided by Alibaba Cloud to manage user identities and resource access permissions. You can use RAM to prevent RAM users from sharing the AccessKey pairs of your Alibaba Cloud account. You can also use RAM to grant minimum permissions to RAM users. RAM uses policies to define permissions.

This topic describes the elements, such as Action, Resource, and Condition, which are defined by FCV3. You can use the elements to create policies in RAM. The code (RamCode) in RAM that is used to indicate FCV3 is [{"popCode":"FC","ramCodes":["fc"]}]. You can grant permissions on FCV3 at the RESOURCE.

General structure of a policy

Policies can be stored as JSON files. The following code provides an example on the general structure of a policy:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

The following list describes the fields in the policy:

Effect: specifies the authorization effect. Valid values: Allow, Deny.
Action: specifies one or more API operations that are allowed or denied. For more information, see the Action section of this topic.
Resource: specifies one or more resources to which the policy applies. You can use an Alibaba Cloud Resource Name (ARN) to specify a resource. For more information, see the Resource section of this topic.
Condition: specifies one or more conditions that are required for the policy to take effect. This is an optional field. For more information, see the Condition section of this topic.
- Condition_operator: specifies the conditional operators. Different types of conditions support different conditional operators. For more information, see Policy elements.
- Condition_key: specifies the condition keys.
- Condition_value: specifies the condition values.

Action

FCV3 defines the values that you can use in the Action element of a policy statement. The following table describes the values.

Operation: the value that you can use in the Action element to specify the operation on a resource.
API operation: the API operation that you can call to perform the operation.
Access level: the access level of each operation. The levels are read, write, and list.
Resource type: the type of the resource on which you can authorize the RAM user or the RAM role to perform the operation. Take note of the following items:
- The required resource types are displayed in bold characters.
- If the permissions cannot be granted at the resource level, All Resources is used in the Resource type column of the operation.
Condition key: the condition keys that are defined by the Alibaba Cloud service. The Condition key column does not list the common condition keys that are defined by Alibaba Cloud. For more information about the common condition keys, see Generic Condition Keyword.
Associated operation: other operations that the RAM user or the RAM role must have permissions to perform to complete the operation. To complete the operation, the RAM user or the RAM role must have the permissions to perform the associated operations.

Actions	API operation	Access level	Resource type	Condition key	Associated operation
fc:ListLayers	ListLayers	list	All Resources *	None	None
fc:PutFunctionAsyncInvokeConfig	PutAsyncInvokeConfig	create	All Resources *	None	None
fc:GetConcurrencyConfig	GetConcurrencyConfig	get	All Resources *	None	None
fc:GetLayerVersion	GetLayerVersion	get	All Resources *	None	None
fc:DeleteCustomDomain	DeleteCustomDomain	delete	CustomDomain acs:fc:{#regionId}:{#accountId}:custom-domains/{#domainName}	None	None
fc:UpdateFunction	UpdateFunction	update	All Resources *	None	None
fc:ListTagResources	ListTagResources	list	All Resources *	None	None
fc:DeleteLayerVersion	DeleteLayerVersion	delete	All Resources *	None	None
fc:CreateTrigger	CreateTrigger	create	All Resources *	None	None
fc:PutLayerACL	PutLayerACL	update	All Resources *	None	None
fc:CreateAlias	CreateAlias	create	All Resources *	None	None
fc:GetFunction	GetFunction	get	All Resources *	None	None
fc:GetAsyncTask	GetAsyncTask	get	All Resources *	None	None
fc:DeleteProvisionConfig	DeleteProvisionConfig	delete	All Resources *	None	None
fc:DeleteTrigger	DeleteTrigger	delete	All Resources *	None	None
fc:GetFunctionCode	GetFunctionCode	get	All Resources *	None	None
fc:GetTrigger	GetTrigger	get	All Resources *	None	None
fc:DeleteVpcBinding	DeleteVpcBinding	delete	All Resources *	None	None
fc:ListTriggers	ListTriggers	list	All Resources *	None	None
fc:ListProvisionConfigs	ListProvisionConfigs	list	All Resources *	None	None
fc:StopAsyncTask	StopAsyncTask	update	All Resources *	None	None
fc:UpdateTrigger	UpdateTrigger	update	All Resources *	None	None
fc:CreateVpcBinding	CreateVpcBinding	create	All Resources *	None	None
fc:ListAliases	ListAliases	list	All Resources *	None	None
fc:DeleteAlias	DeleteAlias	delete	All Resources *	None	None
fc:GetLayerVersionByArn	GetLayerVersionByArn	get	All Resources *	None	None
fc:CreateFunction	CreateFunction	create	All Resources *	None	None
fc:DeleteConcurrencyConfig	DeleteConcurrencyConfig	delete	All Resources *	None	None
fc:GetAlias	GetAlias	get	All Resources *	None	None
fc:ListInstances	ListInstances	list	All Resources *	None	None
fc:DeleteFunctionAsyncInvokeConfig	DeleteAsyncInvokeConfig	delete	All Resources *	None	None
fc:DeleteFunction	DeleteFunction	delete	All Resources *	None	None
fc:ListVpcBindings	ListVpcBindings	list	All Resources *	None	None
fc:GetFunctionAsyncInvokeConfig	GetAsyncInvokeConfig	get	All Resources *	None	None
fc:UpdateAlias	UpdateAlias	update	All Resources *	None	None
fc:PublishFunctionVersion	PublishFunctionVersion	create	All Resources *	None	None
fc:ListFunctionAsyncInvokeConfigs	ListAsyncInvokeConfigs	list	All Resources *	None	None
fc:DeleteFunctionVersion	DeleteFunctionVersion	delete	All Resources *	None	None
fc:UpdateCustomDomain	UpdateCustomDomain	update	All Resources *	None	None
fc:PutConcurrencyConfig	PutConcurrencyConfig	create	All Resources *	None	None
fc:TagResources	TagResources	create	All Resources *	None	None
fc:GetCustomDomain	GetCustomDomain	get	All Resources *	None	None
fc:ListConcurrencyConfigs	ListConcurrencyConfigs	list	All Resources *	None	None
fc:ListAsyncTasks	ListAsyncTasks	list	All Resources *	None	None
fc:ListLayerVersions	ListLayerVersions	list	All Resources *	None	None
fc:PutProvisionConfig	PutProvisionConfig	create	All Resources *	None	None
fc:InvokeFunction	InvokeFunction	create	All Resources *	None	None
fc:ListCustomDomains	ListCustomDomains	list	All Resources *	None	None
fc:CreateLayerVersion	CreateLayerVersion	create	All Resources *	None	None
fc:GetProvisionConfig	GetProvisionConfig	get	All Resources *	None	None
fc:UntagResources	UntagResources	delete	All Resources *	None	None
fc:ListFunctionVersions	ListFunctionVersions	list	All Resources *	None	None
fc:ListFunctions	ListFunctions	list	All Resources *	None	None
fc:CreateCustomDomain	CreateCustomDomain	create	All Resources *	None	None

Resource

FCV3 defines the values that you can use in the Resource. You can attach the policy to a RAM user or a RAM role so that the RAM user or the RAM role can perform a specific operation on a specific resource. The ARN is the unique identifier of the resource on Alibaba Cloud. Take note of the following items:

{#}indicates a variable. {#} must be replaced with an actual value. For example, {#ramcode} must be replaced with the actual code of an Alibaba Cloud service in RAM.
An asterisk (*) is used as a wildcard. Examples:
- {#resourceType} is set to *, all resources are specified.
- {#regionId} is set to *, all regions are specified.
- {#accountId} is set to *, all Alibaba Cloud accounts are specified.

Resource type	ARN
CustomDomain	acs:fc:{#regionId}:{#accountId}:custom-domains/{#domainName}

Condition

FCV3 does not define service-specific condition keys. For more information about common condition keys that are defined by Alibaba Cloud, see Generic Condition Keyword.

What to do next

You can create a custom policy and attach the policy to a RAM user, RAM user group, or RAM role. For more information, see the following topics: