Function Compute：Policies and sample policies

In RAM, a policy is a set of permissions that are described based on the policy syntax and structure. A policy accurately describes the authorized resource set, action set, and authorization conditions. The policies for Function Compute include the following types:

• System policies: the policies that are created by Alibaba Cloud. You can use these policies, but cannot modify them. Alibaba Cloud maintains the version updates of the policies.

• Custom policies: the policies that you can create, update, and delete. You maintain the version updates of these policies.

The system policies include the following types:

• System policies for Function Compute

  Policy	Description
  AliyunFCReadOnlyAccess	The read-only permissions on all Function Compute resources.
  AliyunFCInvocationAccess	The permissions to invoke all functions.
  AliyunFCFullAccess	The permissions to manage all Function Compute resources.

  Note

  The permissions to manage all Function Compute resources defined in the AliyunFCFullAccess policy include the permissions to invoke all functions defined in the AliyunFCInvocationAccess policy and the read-only permissions on all Function Compute resources defined in the AliyunFCReadOnlyAccess policy. After you attach the AliyunFCFullAccess policy to a RAM user, you do not need to attach the AliyunFCInvocationAccess or AliyunFCReadOnlyAccess policy to the RAM user.

• System policies for other Alibaba Cloud services

  Alibaba Cloud service	System policies
  Log Service	AliyunLogReadOnlyAccess: the read-only permissions on all Log Service resources. AliyunLogFullAccess: the permissions to manage all Log Service resources. Note To access Log Service as a RAM user, you need to attach only the AliyunLogReadOnlyAccess policy to the RAM user based on the principle of least privilege.
  Object Storage Service (OSS)	AliyunOSSReadOnlyAccess: the read-only permissions on all OSS resources. AliyunOSSFullAccess: the permissions to manage all OSS resources.
  CloudMonitor	AliyunCloudMonitorReadOnlyAccess: the read-only permissions on all CloudMonitor resources.
  SSL Certificates Service	AliyunYundunCertReadOnlyAccess: the read-only permissions on all SSL Certificates Service resources.
  Virtual Private Cloud	AliyunVPCReadOnlyAccess: the read-only permissions on all VPC resources.
  Elastic Compute Service (ECS)	AliyunECSReadOnlyAccess: the read-only permissions on all ECS resources.
  Resource Access Management (RAM)	AliyunRAMReadOnlyAccess: the read-only permissions on all RAM resources, including the permissions to view users, groups, and authorization information. AliyunRAMFullAccess: the permissions to manage all RAM resources, including the permissions to manage users and grant permissions. Note If you attach only the AliyunRAMReadOnlyAccess policy to a RAM user, you can only obtain the list of roles in the console as the RAM user. If you need to perform other operations as the RAM user, you must attach the AliyunRAMFullAccess policy to the RAM user.
  Application Real-Time Monitoring Service	AliyunARMSReadOnlyAccess: the read-only permissions on ARMS resources. AliyunARMSFullAccess: the permission to manage ARMS resources. Note To access ARMS as a RAM user, you need to attach only the AliyunARMSReadOnlyAccess policy to the RAM user based on the principle of least privilege.
  Simple Message Queue (formerly MNS)	AliyunMNSReadOnlyAccess: the read-only permissions on all Simple Message Queue (formerly MNS) resources. AliyunMNSFullAccess: the permissions to manage all Simple Message Queue (formerly MNS) resources. Note To access Simple Message Queue (formerly MNS) as a RAM user, you need to attach only the AliyunMNSReadOnlyAccess policy to the RAM user based on the principle of least privilege.
  EventBridge	AliyunEventBridgeReadOnlyAccess: the read-only permissions on all EventBridge resources. AliyunEventBridgeFullAccess: the permissions to manage all EventBridge resources. Note To access EventBridge as a RAM user, you need to attach only the AliyunEventBridgeReadOnlyAccess policy to the RAM user based on the principle of least privilege.
  Message Queue for Apache RocketMQ	AliyunMQReadOnlyAccess: the read-only permissions on all Message Queue for Apache RocketMQ resources. AliyunMQFullAccess: the permissions to manage all Message Queue for Apache RocketMQ resources. Note To access Message Queue for Apache RocketMQ as a RAM user, you need to attach only the AliyunMQReadOnlyAccess policy to the RAM user based on the principle of least privilege.
  Container Registry	AliyunContainerRegistryReadOnlyAccess: the read-only permissions on all Container Registry resources. AliyunContainerRegistryFullAccess: the permissions to manage all Container Registry resources. Note To access Container Registry as a RAM user, you need to attach only the AliyunContainerRegistryReadOnlyAccess policy to the RAM user based on the principle of least privilege.
  File Storage NAS	AliyunNASReadOnlyAccess: the read-only permissions on all NAS resources. AliyunNASFullAccess: the permissions to manage all NAS resources. Note To access NAS as a RAM user, you need to attach only the AliyunNASReadOnlyAccess policy to the RAM user based on the principle of least privilege.
  ApsaraDB RDS	AliyunRDSReadOnlyAccess: the read-only permissions on all ApsaraDB RDS resources. AliyunRDSFullAccess: the permissions to manage all ApsaraDB RDS resources. Note To access ApsaraDB RDS as a RAM user, you need to attach only the AliyunRDSReadOnlyAccess policy to the RAM user based on the principle of least privilege.
  Apsara Devops	AliyunRDCReadOnlyAccess: the read-only permissions on Apsara DevOps RDC resources. AliyunRDCFullAccess: the permissions to manage the Apsara DevOps RDC resources. Note To access ApsaraDB RDS as a RAM user, you need to attach only the AliyunRDCReadOnlyAccess policy to the RAM user based on the principle of least privilege.

 {
        "Statement": [
            {
                "Action": [
                    "ram:PassRole"
                ],
                "Effect": "Allow",
                "Resource": "*"
            }
        ],
        "Version": "1"
    }

You can use the preceding actions and resources to define the following custom policy that is used to grant the permissions to invoke the demo function in the test service in the China (Hangzhou) region.

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "fc:InvokeFunction"
            ],
            "Resource": "acs:fc:cn-hangzhou:*:services/test/functions/demo",
            "Effect": "Allow"
        }
    ]
}