RAM authorization - Smart Access Gateway - Alibaba Cloud Documentation Center

Resource Access Management (RAM) is a service provided by Alibaba Cloud to manage user identities and resource access permissions. You can use RAM to prevent RAM users from sharing the AccessKey pairs of your Alibaba Cloud account. You can also use RAM to grant minimum permissions to RAM users. RAM uses policies to define permissions.

This topic describes the elements, such as Action, Resource, and Condition, which are defined by Smartag. You can use the elements to create policies in RAM. The code (RamCode) in RAM that is used to indicate Smartag is smartag. You can grant permissions on Smartag at the RESOURCE.

General structure of a policy

Policies can be stored as JSON files. The following code provides an example on the general structure of a policy:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

The following list describes the fields in the policy:

Effect: specifies the authorization effect. Valid values: Allow, Deny.
Action: specifies one or more API operations that are allowed or denied. For more information, see the Action section of this topic.
Resource: specifies one or more resources to which the policy applies. You can use an Alibaba Cloud Resource Name (ARN) to specify a resource. For more information, see the Resource section of this topic.
Condition: specifies one or more conditions that are required for the policy to take effect. This is an optional field. For more information, see the Condition section of this topic.
- Condition_operator: specifies the conditional operators. Different types of conditions support different conditional operators. For more information, see Policy elements.
- Condition_key: specifies the condition keys.
- Condition_value: specifies the condition values.

Action

Smartag defines the values that you can use in the Action element of a policy statement. The following table describes the values.

Operation: the value that you can use in the Action element to specify the operation on a resource.
API operation: the API operation that you can call to perform the operation.
Access level: the access level of each operation. The levels are read, write, and list.
Resource type: the type of the resource on which you can authorize the RAM user or the RAM role to perform the operation. Take note of the following items:
- The required resource types are displayed in bold characters.
- If the permissions cannot be granted at the resource level, All Resources is used in the Resource type column of the operation.
Condition key: the condition keys that are defined by the Alibaba Cloud service. The Condition key column does not list the common condition keys that are defined by Alibaba Cloud. For more information about the common condition keys, see Generic Condition Keyword.
Associated operation: other operations that the RAM user or the RAM role must have permissions to perform to complete the operation. To complete the operation, the RAM user or the RAM role must have the permissions to perform the associated operations.

Actions	API operation	Access level	Resource type	Condition key	Associated operation
smartag:UpdateSmartAccessGatewayBgpRoute	UpdateSmartAccessGatewayBgpRoute	Write	All Resources *	None	None
smartag:DisableSmartAccessGatewayUser	DisableSmartAccessGatewayUser	Write	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:DescribeGrantSagRules	DescribeGrantSagRules	get	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:MoveResourceGroup	MoveResourceGroup	Write	All Resources *	None	None
smartag:DeleteFlowLog	DeleteFlowLog	delete	FlowLog acs:smartag:{#regionId}:{#accountId}:flowlog/{#FlowLogId}	None	None
smartag:GetSmartAccessGatewayUseLimit	GetSmartAccessGatewayUseLimit	get	All Resources *	None	None
smartag:DescribeSagCurrentDns	DescribeSagCurrentDns	get	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:ModifySagHa	ModifySagHa	update	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:RevokeSagInstanceFromCcn	RevokeSagInstanceFromCcn	Write	CloudConnectNetwork acs:smartag:{#regionId}:{#accountId}:ccn/{#CcnInstanceId} SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:AddSnatEntry	AddSnatEntry	Write	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:DeleteSagExpressConnectInterface	DeleteSagExpressConnectInterface	delete	All Resources *	None	None
smartag:DescribeSmartAccessGateways	DescribeSmartAccessGateways	get	All Resources *	None	None
smartag:GrantInstanceToCbn	GrantInstanceToCbn	Write	CloudConnectNetwork acs:smartag:{#regionId}:{#accountId}:ccn/{#CcnInstanceId}	None	None
smartag:DescribeSmartAccessGatewayClientUsers	DescribeSmartAccessGatewayClientUsers	get	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:CreateEnterpriseCode	CreateEnterpriseCode	create	EnterpriseCode acs:smartag:{#regionId}:{#accountId}:enterprisecode/*	None	None
smartag:RevokeInstanceFromVbr	RevokeInstanceFromVbr	Write	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:DescribeSagRouteProtocolBgp	DescribeSagRouteProtocolBgp	get	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:ModifyQos	ModifyQos	update	Qos acs:smartag:{#regionId}:{#accountId}:qos/{#QosId}	None	None
smartag:DescribeSagLanList	DescribeSagLanList	get	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:DescribeSagManagementPort	DescribeSagManagementPort	get	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:AddSmartAccessGatewayDnsForward	AddSmartAccessGatewayDnsForward	Write	All Resources *	None	None
smartag:DescribeBindableSmartAccessGateways	DescribeBindableSmartAccessGateways	get	CloudConnectNetwork acs:smartag:{#regionId}:{#accountId}:ccn/{#CcnId} SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:DescribeSnatEntries	DescribeSnatEntries	get	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:DescribeSagVbrRelations	DescribeSagVbrRelations	get	All Resources *	None	None
smartag:GetCloudConnectNetworkUseLimit	GetCloudConnectNetworkUseLimit	get	All Resources *	None	None
smartag:UpgradeSmartAccessGatewaySoftware	UpgradeSmartAccessGatewaySoftware	Write	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:ModifySagUserDns	ModifySagUserDns	Write	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:DescribeSagDropTopN	DescribeSagDropTopN	get	All Resources *	None	None
smartag:DescribeSmartAccessGatewayHa	DescribeSmartAccessGatewayHa	get	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:DescribeSagWanList	DescribeSagWanList	get	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:DescribeGrantSagVbrRules	DescribeGrantSagVbrRules	get	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:RevokeInstanceFromCbn	RevokeInstanceFromCbn	Write	CloudConnectNetwork acs:smartag:{#regionId}:{#accountId}:ccn/{#CcnInstanceId}	None	None
smartag:ModifySagWan	ModifySagWan	update	All Resources *	None	None
smartag:DeleteEnterpriseCode	DeleteEnterpriseCode	delete	EnterpriseCode acs:smartag:{#regionId}:{#accountId}:enterprisecode/{#EnterpriseCode}	None	None
smartag:DeleteSmartAccessGatewayClientUser	DeleteSmartAccessGatewayClientUser	Write	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:DescribeSmartAccessGatewayVersions	DescribeSmartAccessGatewayVersions	get	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:DeleteRouteDistributionStrategy	DeleteRouteDistributionStrategy	delete	All Resources *	None	None
smartag:ModifySagLan	ModifySagLan	Write	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:DescribeSagPortList	DescribeSagPortList	list	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:DescribeDeviceAutoUpgradePolicy	DescribeDeviceAutoUpgradePolicy	get	All Resources *	None	None
smartag:ModifyACL	ModifyACL	update	Acl acs:smartag:{#regionId}:{#accountId}:acl/{#AclId}	None	None
smartag:DeleteCloudConnectNetwork	DeleteCloudConnectNetwork	delete	CloudConnectNetwork acs:smartag:{#regionId}:{#accountId}:ccn/{#CcnId}	None	None
smartag:DescribeSagRouteProtocolOspf	DescribeSagRouteProtocolOspf	get	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:DescribeGrantRules	DescribeGrantRules	get	All Resources *	None	None
smartag:DescribeSagRouteList	DescribeSagRouteList	get	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:KickOutClients	KickOutClients	Write	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:UpdateSmartAGEnterpriseCode	UpdateSmartAGEnterpriseCode	update	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:DescribeSAGDeviceInfo	DescribeSAGDeviceInfo	get	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:CreateQos	CreateQos	create	Qos acs:smartag:{#regionId}:{#accountId}:qos/*	None	None
smartag:ModifySAGAdminPassword	ModifySAGAdminPassword	Write	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:CreateSagExpressConnectInterface	CreateSagExpressConnectInterface	create	All Resources *	None	None
smartag:ActivateSmartAccessGateway	ActivateSmartAccessGateway	Write	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:ModifySagPortRouteProtocol	ModifySagPortRouteProtocol	Write	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:BindSerialNumber	BindSerialNumber	update	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:DescribeHealthChecks	DescribeHealthChecks	get	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:ModifySmartAccessGatewayClientUser	ModifySmartAccessGatewayClientUser	Write	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:DeleteSnatEntry	DeleteSnatEntry	Write	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:DeleteQosCar	DeleteQosCar	delete	Qos acs:smartag:{#regionId}:{#accountId}:qos/{#QosId}	None	None
smartag:DescribeQosPolicies	DescribeQosPolicies	get	Qos acs:smartag:{#regionId}:{#accountId}:qos/{#QosId}	None	None
smartag:UnbindSerialNumber	UnbindSerialNumber	Write	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:DescribeHealthCheckAttribute	DescribeHealthCheckAttribute	get	All Resources *	None	None
smartag:UpdateSmartAccessGatewayWanSnat	UpdateSmartAccessGatewayWanSnat	Write	All Resources *	None	None
smartag:UpdateEnterpriseCode	UpdateEnterpriseCode	update	EnterpriseCode acs:smartag:{#regionId}:{#accountId}:enterprisecode/{#EnterpriseCode}	None	None
smartag:ModifyDeviceAutoUpgradePolicy	ModifyDeviceAutoUpgradePolicy	update	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:ViewSmartAccessGatewayDnsForwards	ViewSmartAccessGatewayDnsForwards	get	All Resources *	None	None
smartag:DissociateSmartAGFromApplicationBandwidthPackage	DissociateSmartAGFromApplicationBandwidthPackage	Write	All Resources *	None	None
smartag:EnableSmartAGDpiMonitor	EnableSmartAGDpiMonitor	update	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:UpdateProbeTask	UpdateProbeTask	Write	All Resources *	None	None
smartag:CreateFlowLog	CreateFlowLog	create	FlowLog acs:smartag:{#regionId}:{#accountId}:flowlog/*	None	None
smartag:EnableSmartAccessGatewayUser	EnableSmartAccessGatewayUser	update	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:ListAccessPointNetworkQualities	ListAccessPointNetworkQualities	list	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:DowngradeSmartAccessGateway	DowngradeSmartAccessGateway	Write	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:DeleteProbeTask	DeleteProbeTask	Write	ProbeTask acs:smartag:{#regionId}:{#accountId}:probetask/{#ProbeTaskId}	None	None
smartag:ModifyCloudConnectNetwork	ModifyCloudConnectNetwork	update	CloudConnectNetwork acs:smartag:{#regionId}:{#accountId}:ccn/{#CcnId}	None	None
smartag:UnbindSmartAccessGateway	UnbindSmartAccessGateway	Write	CloudConnectNetwork acs:smartag:{#regionId}:{#accountId}:ccn/{#CcnId} SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:ModifyFlowLogAttribute	ModifyFlowLogAttribute	update	All Resources *	None	None
smartag:ModifyHealthCheck	ModifyHealthCheck	update	All Resources *	None	None
smartag:DisassociateFlowLog	DisassociateFlowLog	Write	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:RoamClientUser	RoamClientUser	Write	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:AssociateSmartAGWithApplicationBandwidthPackage	AssociateSmartAGWithApplicationBandwidthPackage	Write	All Resources *	None	None
smartag:DisassociateQos	DisassociateQos	update	Qos acs:smartag:{#regionId}:{#accountId}:qos/{#QosId} SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:DescribeUserOnlineClientStatistics	DescribeUserOnlineClientStatistics	get	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:GetAclAttribute	GetAclAttribute	get	Acl acs:smartag:{#regionId}:{#accountId}:acl/{#AclId}	None	None
smartag:DescribeUnbindFlowLogSags	DescribeUnbindFlowLogSags	get	All Resources *	None	None
smartag:DescribeRouteDistributionStrategies	DescribeRouteDistributionStrategies	get	All Resources *	None	None
smartag:DescribeSagGlobalRouteProtocol	DescribeSagGlobalRouteProtocol	get	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:DescribeSagWanSnat	DescribeSagWanSnat	get	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:BindVbr	BindVbr	Write	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:ListAvailableServiceAddress	ListAvailableServiceAddress	list	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAgId}	None	None
smartag:DescribeUserFlowStatistics	DescribeUserFlowStatistics	get	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:CreateACL	CreateACL	create	Acl acs:smartag:{#regionId}:{#accountId}:acl/*	None	None
smartag:DeleteSmartAccessGatewayDnsForward	DeleteSmartAccessGatewayDnsForward	Write	All Resources *	None	None
smartag:DescribeQoses	DescribeQoses	get	All Resources *	None	None
smartag:ViewSmartAccessGatewayBgpRoute	ViewSmartAccessGatewayBgpRoute	get	All Resources *	None	None
smartag:ModifySmartAccessGatewayUpBandwidth	ModifySmartAccessGatewayUpBandwidth	update	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:ViewSmartAccessGatewayWanSnat	ViewSmartAccessGatewayWanSnat	get	All Resources *	None	None
smartag:ViewSmartAccessGatewayOspfRoute	ViewSmartAccessGatewayOspfRoute	get	All Resources *	None	None
smartag:ListEnterpriseCode	ListEnterpriseCode	list	EnterpriseCode acs:smartag:{#regionId}:{#accountId}:enterprisecode/*	None	None
smartag:DescribeUserOnlineClients	DescribeUserOnlineClients	get	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:UpdateSmartAccessGatewayGlobalRouteProtocol	UpdateSmartAccessGatewayGlobalRouteProtocol	Write	All Resources *	None	None
smartag:ModifySagWifi	ModifySagWifi	Write	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:DisassociateACL	DisassociateACL	delete	All Resources *	None	None
smartag:ModifySagWanSnat	ModifySagWanSnat	Write	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:DeleteDnatEntry	DeleteDnatEntry	Write	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:ListSmartAGByAccessPoint	ListSmartAGByAccessPoint	get	All Resources *	None	None
smartag:DeleteQosPolicy	DeleteQosPolicy	delete	Qos acs:smartag:{#regionId}:{#accountId}:qos/{#QosId}	None	None
smartag:ResetSmartAccessGatewayClientUserPassword	ResetSmartAccessGatewayClientUserPassword	Write	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:DescribeACLAttribute	DescribeACLAttribute	get	Acl acs:smartag:{#regionId}:{#accountId}:acl/{#AclId}	None	None
smartag:ModifySagRouteProtocolBgp	ModifySagRouteProtocolBgp	update	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:CreateServiceAddress	CreateServiceAddress	Write	All Resources *	None	None
smartag:UpdateSmartAccessGatewayVersion	UpdateSmartAccessGatewayVersion	update	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:DescribeCloudConnectNetworks	DescribeCloudConnectNetworks	get	All Resources *	None	None
smartag:DeleteACL	DeleteACL	delete	Acl acs:smartag:{#regionId}:{#accountId}:acl/{#AclId}	None	None
smartag:CreateProbeTask	CreateProbeTask	Write	ProbeTask acs:smartag:{#regionId}:{#accountId}:probetask/* SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAgId}	None	None
smartag:DisableSmartAGDpiMonitor	DisableSmartAGDpiMonitor	update	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:CreateSmartAccessGateway	CreateSmartAccessGateway	create	All Resources *	None	None
smartag:DeleteACLRule	DeleteACLRule	delete	Acl acs:smartag:{#regionId}:{#accountId}:acl/{#AclId}	None	None
smartag:UpdateSmartAccessGatewayAdminPassword	UpdateSmartAccessGatewayAdminPassword	Write	All Resources *	None	None
smartag:UpdateSmartAccessGatewayDns	UpdateSmartAccessGatewayDns	Write	All Resources *	None	None
smartag:AssociateACL	AssociateACL	create	All Resources *	None	None
smartag:DescribeSmartAccessGatewayAttribute	DescribeSmartAccessGatewayAttribute	get	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:UpdateSmartAGUserAccelerateConfig	UpdateSmartAGUserAccelerateConfig	Write	All Resources *	None	None
smartag:DescribeDnatEntries	DescribeDnatEntries	get	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:CreateSmartAccessGatewayClientUser	CreateSmartAccessGatewayClientUser	Write	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:ViewSmartAccessGatewayGlobalRouteProtocol	ViewSmartAccessGatewayGlobalRouteProtocol	get	All Resources *	None	None
smartag:DeleteQos	DeleteQos	delete	Qos acs:smartag:{#regionId}:{#accountId}:qos/{#QosId}	None	None
smartag:ListAccessPoints	ListAccessPoints	get	All Resources *	None	None
smartag:UpdateSmartAccessGatewayDnsForward	UpdateSmartAccessGatewayDnsForward	Write	All Resources *	None	None
smartag:DescribeFlowLogSags	DescribeFlowLogSags	get	FlowLog acs:smartag:{#regionId}:{#accountId}:flowlog/{#FlowLogId}	None	None
smartag:DescribeSagOnlineClientStatistics	DescribeSagOnlineClientStatistics	get	All Resources *	None	None
smartag:ActiveFlowLog	ActiveFlowLog	Write	FlowLog acs:smartag:{#regionId}:{#accountId}:flowlog/{#flowlogId}	None	None
smartag:AssociateQos	AssociateQos	update	Qos acs:smartag:{#regionId}:{#accountId}:qos/{#QosId} SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:DiagnoseSmartAccessGateway	DiagnoseSmartAccessGateway	Write	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:CreateSagStaticRoute	CreateSagStaticRoute	create	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:DescribeSagTrafficTopN	DescribeSagTrafficTopN	get	All Resources *	None	None
smartag:DowngradeSmartAccessGatewaySoftware	DowngradeSmartAccessGatewaySoftware	Write	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:ModifySagPortRole	ModifySagPortRole	Write	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:RebootSmartAccessGateway	RebootSmartAccessGateway	Write	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:CreateSmartAccessGatewaySoftware	CreateSmartAccessGatewaySoftware	create	All Resources *	None	None
smartag:ProbeAccessPointNetworkQuality	ProbeAccessPointNetworkQuality	Write	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:ModifyClientUserDNS	ModifyClientUserDNS	update	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:GetSmartAGDpiAttribute	GetSmartAGDpiAttribute	get	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:DeleteSagStaticRoute	DeleteSagStaticRoute	delete	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:ModifySagManagementPort	ModifySagManagementPort	Write	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:DescribeSagWifi	DescribeSagWifi	get	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:CreateQosPolicy	CreateQosPolicy	create	Qos acs:smartag:{#regionId}:{#accountId}:qos/{#QosId}	None	None
smartag:GetQosAttribute	GetQosAttribute	get	All Resources *	None	None
smartag:UpdateSmartAGDpiAttribute	UpdateSmartAGDpiAttribute	update	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:DiscribeSmartAccessGatewayDiagnosisReport	DiscribeSmartAccessGatewayDiagnosisReport	get	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:ModifyQosCar	ModifyQosCar	update	Qos acs:smartag:{#regionId}:{#accountId}:qos/{#QosId}	None	None
smartag:DeleteServiceAddress	DeleteServiceAddress	Write	All Resources *	None	None
smartag:UpdateSmartAGAccessPoint	UpdateSmartAGAccessPoint	update	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:ModifyACLRule	ModifyACLRule	update	Acl acs:smartag:{#regionId}:{#accountId}:acl/{#AclId}	None	None
smartag:ViewSmartAccessGatewayRoutes	ViewSmartAccessGatewayRoutes	get	All Resources *	None	None
smartag:ListProbeTask	ListProbeTask	list	All Resources *	None	None
smartag:ModifyQosPolicy	ModifyQosPolicy	update	Qos acs:smartag:{#regionId}:{#accountId}:qos/{#QosId}	None	None
smartag:DescribeSagUserDns	DescribeSagUserDns	get	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:BindSmartAccessGateway	BindSmartAccessGateway	Write	CloudConnectNetwork acs:smartag:{#regionId}:{#accountId}:ccn/{#CcnId}	None	None
smartag:ModifySagExpressConnectInterface	ModifySagExpressConnectInterface	update	All Resources *	None	None
smartag:CreateQosCar	CreateQosCar	create	Qos acs:smartag:{#regionId}:{#accountId}:qos/{#QosId}	None	None
smartag:ClearSagRouteableAddress	ClearSagRouteableAddress	delete	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:AssociateFlowLog	AssociateFlowLog	Write	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId} FlowLog acs:smartag:{#regionId}:{#accountId}:flowlog/{#FlowLogId}	None	None
smartag:DescribeQosCars	DescribeQosCars	get	Qos acs:smartag:{#regionId}:{#accountId}:qos/{#QosId}	None	None
smartag:DescribeSagWan4G	DescribeSagWan4G	get	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:ModifySagRemoteAccess	ModifySagRemoteAccess	update	All Resources *	None	None
smartag:ModifyRouteDistributionStrategy	ModifyRouteDistributionStrategy	update	All Resources *	None	None
smartag:DescribeSagPortRouteProtocolList	DescribeSagPortRouteProtocolList	get	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:SynchronizeSmartAGWebConfig	SynchronizeSmartAGWebConfig	Write	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:ModifySagStaticRoute	ModifySagStaticRoute	update	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:AddDnatEntry	AddDnatEntry	Write	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:SetAdvancedMonitorState	SetAdvancedMonitorState	Write	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAgId}	None	None
smartag:DescribeSagHa	DescribeSagHa	get	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:DescribeSagStaticRouteList	DescribeSagStaticRouteList	get	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:UnbindVbr	UnbindVbr	Write	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:CreateCloudConnectNetwork	CreateCloudConnectNetwork	create	CloudConnectNetwork acs:smartag:{#regionId}:{#accountId}:ccn/*	None	None
smartag:DescribeClientUserDNS	DescribeClientUserDNS	get	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:UpgradeSmartAccessGateway	UpgradeSmartAccessGateway	Write	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:GetAdvancedMonitorState	GetAdvancedMonitorState	get	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAgId}	None	None
smartag:ModifySagRouteProtocolOspf	ModifySagRouteProtocolOspf	update	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:DeleteSmartAccessGateway	DeleteSmartAccessGateway	delete	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:ModifySmartAccessGateway	ModifySmartAccessGateway	update	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:DescribeACLs	DescribeACLs	get	All Resources *	None	None
smartag:DescribeFlowLogs	DescribeFlowLogs	get	All Resources *	None	None
smartag:DescribeSagExpressConnectInterfaceList	DescribeSagExpressConnectInterfaceList	get	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:UpdateSmartAccessGatewayPortRouteProtocol	UpdateSmartAccessGatewayPortRouteProtocol	Write	All Resources *	None	None
smartag:AddACLRule	AddACLRule	create	Acl acs:smartag:{#regionId}:{#accountId}:acl/{#AclId}	None	None
smartag:GrantSagInstanceToCcn	GrantSagInstanceToCcn	Write	CloudConnectNetwork acs:smartag:{#regionId}:{#accountId}:ccn/{#CcnInstanceId} SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:GrantSagInstanceToVbr	GrantSagInstanceToVbr	Write	All Resources *	None	None
smartag:ListDpiConfigError	ListDpiConfigError	get	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:ListSmartAGApiUnsupportedFeature	ListSmartAGApiUnsupportedFeature	get	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:ViewSmartAccessGatewayDns	ViewSmartAccessGatewayDns	get	All Resources *	None	None
smartag:DeactiveFlowLog	DeactiveFlowLog	Write	FlowLog acs:smartag:{#regionId}:{#accountId}:flowlog/{#flowlogId}	None	None
smartag:DeleteHealthCheck	DeleteHealthCheck	delete	All Resources *	None	None
smartag:DescribeSagRemoteAccess	DescribeSagRemoteAccess	get	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:CreateHealthCheck	CreateHealthCheck	create	All Resources *	None	None
smartag:ClearSagCipher	ClearSagCipher	Write	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:UnlockSmartAccessGateway	UnlockSmartAccessGateway	Write	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None
smartag:ModifySagGlobalRouteProtocol	ModifySagGlobalRouteProtocol	Write	SmartAccessGateway acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}	None	None

Resource

Smartag defines the values that you can use in the Resource. You can attach the policy to a RAM user or a RAM role so that the RAM user or the RAM role can perform a specific operation on a specific resource. The ARN is the unique identifier of the resource on Alibaba Cloud. Take note of the following items:

{#}indicates a variable. {#} must be replaced with an actual value. For example, {#ramcode} must be replaced with the actual code of an Alibaba Cloud service in RAM.
An asterisk (*) is used as a wildcard. Examples:
- {#resourceType} is set to *, all resources are specified.
- {#regionId} is set to *, all regions are specified.
- {#accountId} is set to *, all Alibaba Cloud accounts are specified.

Resource type	ARN
SmartAccessGateway	acs:smartag:{#regionId}:{#accountId}:smartaccessgateway/{#SmartAgId}
SmartAccessGateway	acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}
CloudConnectNetwork	acs:smartag:{#regionId}:{#accountId}:ccn/{#CcnInstanceId}
IntelligentRouting	acs:smartag:{#regionId}:{#accountId}:intelligentrouting/{#intelligentroutingId}
FlowLog	acs:smartag:{#regionId}:{#accountId}:flowlog/{#FlowLogId}
SmartAccessGateway	acs:smartag:{#regionId}:{#accountId}:smartag/*
Acl	acs:smartag:{#regionId}:{#accountId}:acl/*
Acl	acs:smartag:{#regionId}:{#accountId}:acl/{#AclId}
CloudConnectNetwork	acs:smartag:{#regionId}:{#accountId}:ccn/*
CloudConnectNetwork	acs:smartag:{#regionId}:{#accountId}:ccn/{#CcnId}
FlowLog	acs:smartag:{#regionId}:{#accountId}:flowlog/*
Qos	acs:smartag:{#regionId}:{#accountId}:qos/*
Qos	acs:smartag:{#regionId}:{#accountId}:qos/{#QosId}
SmartAccessGateway	acs:smartag::{#accountId}:smartag/
IntelligentRouting	acs:smartag:{#regionId}:{#accountId}:intelligentrouting/*
ApplicationBandwidthPackage	acs:smartag:{#regionId}:{#accountId}:abwp/{#ApplicationBandwidthPackageId}
EnterpriseCode	acs:smartag:{#regionId}:{#accountId}:enterprisecode/*
IntelligentRouting	acs:smartag:{#regionId}:{#accountId}:intelligentrouting/{#IntelligentRoutingId}
EnterpriseCode	acs:smartag:{#regionId}:{#accountId}:enterprisecode/{#EnterpriseCode}
CloudConnectNetwork	acs:smartag:{#regionId}:{#accountId}:ccn/{#AssociatedCcnId}
SagExpressConnectInterface	acs:smartag:{#regionId}:{#accountId}:sagexpressconnectinterface/*
SmartAccessGateway	acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAgId}
ProbeTask	acs:smartag:{#regionId}:{#accountId}:probetask/{#ProbeTaskId}
SmartAGSmartag	acs:smartag:{#regionId}:{#accountId}:smartag/{#SmartAGId}
Qos	acs:smartag::{#accountId}:qos/
ApplicationBandwidthPackage	acs:smartag:{#regionId}:{#accountId}:abwp/*
CloudConnectNetwork	acs:smartag::{#accountId}:ccn/
ProbeTask	acs:smartag:{#regionId}:{#accountId}:probetask/*
SmartAGSmartag	acs:smartag:{#regionId}:{#accountId}:*
FlowLog	acs:smartag:{#regionId}:{#accountId}:flowlog/{#flowlogId}
IntelligentRouting	acs:smartag:{#regionId}:{#accountId}:IntelligentRouting/IntelligentRoutingId
SmartAccessGateway	acs:smartag:{#regionId}:{#accountId}:smartaccessgateway/*
ApplicationBandwidthPackage	acs:smartag:{#regionId}:{#accountId}:applicationbandwidthpackage/{#ApplicationBandwidthPackageId}
Acl	acs:smartag::{#accountId}:acl/
FlowLog	acs:smartag::{#accountId}:flowlog/
ApplicationAccelerationRule	acs:smartag:{#regionId}:{#accountId}:applicationaccelerationrule/{#ApplicationAccelerationRuleId}

Condition

Smartag defines the values that you can use in the Condition element of a policy statement. The following table describes the values. The following table describes the service-specific condition keys. The common condition keys that are defined by Alibaba Cloud also apply to Smartag. For more information about the common condition keys, see Generic Condition Keyword.

The data type determines the conditional operators that you can use to compare the value in a request with the value in a policy statement. You must use conditional operators that are supported by the data type. Otherwise, you cannot compare the value in the request with the value in the policy statement. In this case, the authorization is invalid. For more information about the conditional operators that are supported by each data type, see Policy elements.

Condition key	Description	Data type
acs:ResourceTag		String
acs:RequestTag		String

What to do next

You can create a custom policy and attach the policy to a RAM user, RAM user group, or RAM role. For more information, see the following topics: