在RAM使用者調用API前，需要阿里雲帳號通過建立授權策略對RAM使用者進行授權。
資源授權
預設情況下，RAM使用者沒有許可權通過調用API去建立、修改阿里雲資源。RAM使用者調用API時，需要先建立一個授權策略，然後將這個授權策略關聯給對應的RAM使用者以完成資源授權。
在建立授權策略時，您可以通過資源描述符ARN（Alibaba Cloud Resource Name）指定要授權的資源。ARN是阿里雲為每個資源定義的一個全域的阿里雲資源名稱。ARN格式如下：
acs:service-name:region:account-id:resource-relative-idARN欄位含義如下：
- acs：Alibaba Cloud Service的首字母縮寫，表示阿里雲的公用雲平台。
- service-name：阿里雲服務的名稱，例如：ECS、OSS、ROS等。
region：地區資訊。如果不支援該項，可以使用萬用字元星號（
*）來代替。- account-id：阿里雲帳號ID，例如：123456789012****。
- resource-relative-id：具體的資源描述，不同的阿里雲服務的資源描述也不同。更多資訊，請參見各阿里雲服務的開發文檔。
例如：
acs:oss:*:123456789012****:sample_bucket/file1.txt表示OSS服務中對象名稱是sample_bucket/file1.txt的資源，對象的所有者UID為123456789012****。
可授權的Resource Orchestration Service資源類型
| 資源類型 | 授權策略中的資源描述方法 |
| Stack | acs:ros:$regionid:$accountid:stack/$stackid |
| acs:ros:$regionid:$accountid:stack/* | |
| Template | acs:ros:$regionid:$accountid:template/$templateid |
| acs:ros:$regionid:$accountid:template/* | |
| StackGroup | acs:ros:$regionid:$accountid:stack_group/* |
可授權的Resource Orchestration Service介面
- 資源棧相關介面
API Action 資源描述 PreviewStack ros:PreviewStack acs:ros:cn-hangzhou:$accountid:stack/* CreateStack ros:CreateStack cs:ros:cn-hangzhou:$accountid:stack/* ContinueCreateStack ros:ContinueCreateStack acs:ros:cn-hangzhou:$accountid:stack/$stackid SetDeletionProtection ros:SetDeletionProtection acs:ros:cn-hangzhou:$accountid:stack/$stackid UpdateStack ros:UpdateStack acs:ros:cn-hangzhou:$accountid:stack/$stackid CancelUpdateStack ros:CancelUpdateStack acs:ros:cn-hangzhou:$accountid:stack/$stackid GetStack ros:GetStack acs:ros:cn-hangzhou:$accountid:stack/$stackid ListStacks ros:ListStacks acs:ros:cn-hangzhou:$accountid:stack/* ListStackEvents ros:ListStackEvents acs:ros:cn-hangzhou:$accountid:stack/$stackid ListStackOperationRisks ros:ListStackOperationRisks acs:ros:cn-hangzhou:$accountid:stack/$stackid DeleteStack ros:DeleteStack acs:ros:cn-hangzhou:$accountid:stack/$stackid CreateChangeSet ros:CreateChangeSet - 當ChangeSetType取值為CREATE時：acs:ros:cn-hangzhou:$accountid:stack/*
- 當ChangeSetType取值為UPDATE時：acs:ros:cn-hangzhou:$accountid:stack/$stackid
- 當ChangeSetType取值為IMPORT時：acs:ros:cn-hangzhou:$accountid:stack/*
ExecuteChangeSet ros:ExecuteChangeSet acs:ros:cn-hangzhou:$accountid:stack/$stackid GetChangeSet ros:GetChangeSet acs:ros:cn-hangzhou:$accountid:stack/$stackid ListChangeSets ros:ListChangeSets acs:ros:cn-hangzhou:$accountid:stack/$stackid DeleteChangeSet ros:DeleteChangeSet acs:ros:cn-hangzhou:$accountid:stack/$stackid - 資源相關介面
API Action 資源描述 GetResourceTypeTemplate ros:GetResourceTypeTemplate 不鑒權 ListStackResources ros:ListStackResources acs:ros:cn-hangzhou:$accountid:stack/$stackid GetStackResource ros:GetStackResource acs:ros:cn-hangzhou:$accountid:stack/$stackid GetResourceType ros:GetResourceType 不鑒權 ListResourceTypes ros:ListResourceTypes 不鑒權 MoveResourceGroup ros:MoveResourceGroup - 當ResourceType取值為stack時：acs:ros:cn-hangzhou:$accountid:stack/*
- 當ResourceType取值為stackgroup時：acs:ros:cn-hangzhou:$accountid:stack_group/*
- 當ResourceType取值為template時：acs:ros:cn-hangzhou:$accountid:template/*
- 資源棧組相關介面
API Action 資源描述 CreateStackGroup ros:CreateStackGroup acs:ros:cn-hangzhou:$accountid:stack_group/* UpdateStackGroup ros:UpdateStackGroup acs:ros:cn-hangzhou:$accountid:stack_group/* GetStackGroup ros:GetStackGroup acs:ros:cn-hangzhou:$accountid:stack_group/* ListStackGroups ros:ListStackGroups acs:ros:cn-hangzhou:$accountid:stack_group/* DeleteStackGroup ros:DeleteStackGroup acs:ros:cn-hangzhou:$accountid:stack_group/* CreateStackInstances ros:CreateStackInstances acs:ros:cn-hangzhou:$accountid:stack_instance/* UpdateStackInstances ros:UpdateStackInstances acs:ros:cn-hangzhou:$accountid:stack_instance/* GetStackInstance ros:GetStackInstance acs:ros:cn-hangzhou:$accountid:stack_instance/* ListStackInstances ros:ListStackInstances acs:ros:cn-hangzhou:$accountid:stack_instance/* DeleteStackInstances ros:DeleteStackInstances acs:ros:cn-hangzhou:$accountid:stack_instance/* GetStackGroupOperation ros:GetStackGroupOperation acs:ros:cn-hangzhou:$accountid:stack_group_operation/* ListStackGroupOperations ros:ListStackGroupOperations acs:ros:cn-hangzhou:$accountid:stack_group_operation/* ListStackGroupOperationResults ros:ListStackGroupOperationResults acs:ros:cn-hangzhou:$accountid:stack_group_operation/* StopStackGroupOperation ros:StopStackGroupOperation acs:ros:cn-hangzhou:$accountid:stack_group_operation/* - 模板相關介面
API Action 資源描述 GenerateTemplatePolicy ros:GenerateTemplatePolicy acs:ros:cn-hangzhou:$accountid:template/$templateid 說明 如果指定參數TemplateId，則需要鑒權。CreateTemplate ros:CreateTemplate acs:ros:cn-hangzhou:$accountid:template/* ValidateTemplate ros:ValidateTemplate 不鑒權 UpdateTemplate ros:UpdateTemplate acs:ros:cn-hangzhou:$accountid:template/$templateid GetTemplate ros:GetTemplate - acs:ros:cn-hangzhou:$accountid:stack/$stackid
- acs:ros:$regionid:$accountid:stack_group/*
- acs:ros:cn-hangzhou:$accountid:template/$templateid
GetTemplateEstimateCost ros:GetTemplateEstimateCost acs:ros:cn-hangzhou:$accountid:* GetTemplateSummary ros:GetTemplateSummary acs:ros:cn-hangzhou:$accountid:template/$templateid 說明 如果指定參數TemplateId，則需要鑒權。ListTemplates ros:ListTemplates acs:ros:cn-hangzhou:$accountid:template/* ListTemplateVersions ros:ListTemplateVersions acs:ros:cn-hangzhou:$accountid:template/$templateid SetTemplatePermission ros:SetTemplatePermission acs:ros:cn-hangzhou:$accountid:* DeleteTemplate ros:DeleteTemplate acs:ros:cn-hangzhou:$accountid:template/$templateid - 標籤相關介面
API Action 資源描述 ListTagResources ros:ListTagResources acs:ros:cn-hangzhou:$accountid:tag/* ListTagKeys ros:ListTagKeys acs:ros:cn-hangzhou:$accountid:tag/* ListTagValues ros:ListTagValues acs:ros:cn-hangzhou:$accountid:tag/* UntagResources ros:UntagResources acs:ros:cn-hangzhou:$accountid:tag/* - 其他介面
API Action 資源描述 DescribeRegions ros:DescribeRegions 不鑒權 SignalResource ros:SignalResource acs:ros:cn-hangzhou:$accountid:stack/$stackid GetStackPolicy ros:GetStackPolicy acs:ros:cn-hangzhou:$accountid:stack/$stackid SetStackPolicy ros:SetStackPolicy acs:ros:cn-hangzhou:$accountid:stack/$stackid