权限策略通用结构
权限策略支持JSON格式,其通用结构如下:
{
"Version": "1",
"Statement": [
{
"Effect": "",
"Action": "",
"Resource": "",
"Condition": {
"": {
"": [
""
]
}
}
}
]
}
各字段含义如下:
- Effect:权限策略效果。取值:Allow(允许)、Deny(拒绝)。
- Action:授予允许或拒绝权限的具体操作。具体信息,请参见操作(Action)。
- Resource:受操作影响的具体对象,您可以使用资源ARN来描述指定资源。具体信息,请参见资源(Resource)。
- Condition:指授权生效的条件。可选字段。具体信息,请参见条件(Condition)。
- Condition_operator:条件运算符,不同类型的条件对应不同的条件运算符。具体信息,请参见权限策略基本元素。
- Condition_key:条件关键字。
- Condition_value:条件关键字对应的值。
操作(Action)
下表是负载均衡(SLB)定义的操作,这些操作可以在RAM权限策略语句的Action
元素中使用,用来授予执行该操作的权限。下面对表中的具体项提供说明:
- 操作:是指具体的权限点。
- API:是指操作对应的API接口。
- 访问级别:是指每个操作的访问级别,取值为写入(Write)、读取(Read)或列出(List)。
- 资源类型:是指操作中支持授权的资源类型。具体说明如下:
- 对于必选的资源类型,用背景高亮的方式表示。
- 对于不支持资源级授权的操作,用
全部资源
表示。
- 条件关键字:是指云产品自身定义的条件关键字。该列不体现适用于任何操作的通用条件关键字。
- 关联操作:是指成功执行操作所需要的其他权限。操作者必须同时具备关联操作的权限,操作才能成功。
操作 | API | 访问级别 | 资源类型 | 条件关键字 | 关联操作 |
---|---|---|---|---|---|
slb:AddAccessControlListEntry | AddAccessControlListEntry | Write | aclacs:slb:{#regionId}:{#accountId}:acl/{#aclId} | slb:tagslb:AclName | 无 |
slb:AddBackendServers | AddBackendServers | Write | LoadBalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#LoadBalancerId}Instanceacs:ecs:{#regionId}:{#accountId}:instance/{#InstanceId} | 无 | 无 |
slb:AddListenerWhiteListItem | AddListenerWhiteListItem | Write | loadbalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#loadbalancerId} | slb:tag | 无 |
slb:AddVServerGroupBackendServers | AddVServerGroupBackendServers | Write | Instanceacs:ecs:{#regionId}:{#accountId}:instance/{#InstanceId}LoadBalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#LoadBalancerId} | 无 | 无 |
slb:CreateAccessControlList | CreateAccessControlList | Write | AccessControlListacs:slb:{#regionId}:{#accountId}:acl/* | 无 | 无 |
slb:CreateDomainExtension | CreateDomainExtension | Write | loadbalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#loadbalancerId} | slb:tag | 无 |
slb:CreateLoadBalancer | CreateLoadBalancer | Write | LoadBalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/* | slb:AddressType | 无 |
slb:CreateLoadBalancerHTTPListener | CreateLoadBalancerHTTPListener | Write | aclacs:slb:{#regionId}:{#accountId}:acl/{#aclId}loadbalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#loadbalancerId} | slb:tag | 无 |
slb:CreateLoadBalancerHTTPSListener | CreateLoadBalancerHTTPSListener | Write | aclacs:slb:{#regionId}:{#accountId}:acl/{#aclId}certificateacs:slb:{#regionId}:{#accountId}:certificate/{#certificateId}loadbalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#loadbalancerId} | slb:tag | 无 |
slb:CreateLoadBalancerTCPListener | CreateLoadBalancerTCPListener | Write | AccessControlListacs:slb:{#regionId}:{#accountId}:acl/{#AclId}LoadBalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#LoadBalancerId} | slb:tag | 无 |
slb:CreateLoadBalancerUDPListener | CreateLoadBalancerUDPListener | Write | aclacs:slb:{#regionId}:{#accountId}:acl/{#aclId}loadbalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#loadbalancerId} | slb:tag | 无 |
slb:CreateMasterSlaveServerGroup | CreateMasterSlaveServerGroup | Write | Instanceacs:ecs:{#regionId}:{#accountId}:instance/{#InstanceId}LoadBalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#LoadBalancerId} | slb:tag | 无 |
slb:CreateRules | CreateRules | Write | loadbalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#loadbalancerId} | slb:tag | 无 |
slb:CreateTLSCipherPolicy | CreateTLSCipherPolicy | Read | TLSPolicyacs:slb:{#regionId}:{#accountId}:tlspolicy/* | 无 | 无 |
slb:CreateVServerGroup | CreateVServerGroup | Write | Instanceacs:ecs:{#regionId}:{#accountId}:instance/{#InstanceId}LoadBalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#LoadBalancerId} | slb:tag | 无 |
slb:DeleteAccessControlList | DeleteAccessControlList | Write | aclacs:slb:{#regionId}:{#accountId}:acl/{#aclId} | slb:tagslb:AclName | 无 |
slb:DeleteAccessLogsDownloadAttribute | DeleteAccessLogsDownloadAttribute | Write | LoadBalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#LoadBalancerId} | 无 | 无 |
slb:DeleteCACertificate | DeleteCACertificate | Write | certificateacs:slb:{#regionId}:{#accountId}:certificate/{#certificateId} | slb:tag | 无 |
slb:DeleteDomainExtension | DeleteDomainExtension | Write | loadbalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#loadbalancerId} | slb:tag | 无 |
slb:DeleteLoadBalancer | DeleteLoadBalancer | Write | loadbalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#loadbalancerId} | slb:tag | 无 |
slb:DeleteLoadBalancerListener | DeleteLoadBalancerListener | Write | loadbalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#loadbalancerId} | slb:tag | 无 |
slb:DeleteMasterSlaveServerGroup | DeleteMasterSlaveServerGroup | Write | loadbalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#loadbalancerId} | slb:tag | 无 |
slb:DeleteRules | DeleteRules | Write | loadbalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#loadbalancerId} | slb:tag | 无 |
slb:DeleteServerCertificate | DeleteServerCertificate | Write | certificateacs:slb:{#regionId}:{#accountId}:certificate/{#certificateId} | slb:tag | 无 |
slb:DeleteTLSCipherPolicy | DeleteTLSCipherPolicy | Write | TLSPolicyacs:slb:{#regionId}:{#accountId}:tlspolicy/{#TLSCipherPolicyId} | 无 | 无 |
slb:DeleteVServerGroup | DeleteVServerGroup | Write | loadbalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#loadbalancerId} | slb:tag | 无 |
slb:DescribeAccessControlListAttribute | DescribeAccessControlListAttribute | Read | aclacs:slb:{#regionId}:{#accountId}:acl/{#aclId} | slb:tag | 无 |
slb:DescribeAccessControlLists | DescribeAccessControlLists | List | AccessControlListacs:slb:{#regionId}:{#accountId}:acl/* | slb:tag | 无 |
slb:DescribeAccessLogsDownloadAttribute | DescribeAccessLogsDownloadAttribute | Read | loadbalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/* | 无 | 无 |
slb:DescribeCACertificates | DescribeCACertificates | List | CaCertificateacs:slb:{#regionId}:{#accountId}:certificate/* | slb:tag | 无 |
slb:DescribeDomainExtensionAttribute | DescribeDomainExtensionAttribute | Read | loadbalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#loadbalancerId} | slb:tag | 无 |
slb:DescribeDomainExtensions | DescribeDomainExtensions | Read | loadbalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#loadbalancerId} | slb:tag | 无 |
slb:DescribeHealthStatus | DescribeHealthStatus | Read | loadbalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#loadbalancerId} | slb:tag | 无 |
slb:DescribeHighDefinationMonitor | DescribeHighDefinationMonitor | Read | LoadBalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/* | 无 | 无 |
slb:DescribeListenerAccessControlAttribute | DescribeListenerAccessControlAttribute | Read | loadbalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#loadbalancerId} | slb:tag | 无 |
slb:DescribeLoadBalancerAttribute | DescribeLoadBalancerAttribute | Read | loadbalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#loadbalancerId} | slb:tag | 无 |
slb:DescribeLoadBalancerHTTPListenerAttribute | DescribeLoadBalancerHTTPListenerAttribute | Read | loadbalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#loadbalancerId} | slb:tag | 无 |
slb:DescribeLoadBalancerHTTPSListenerAttribute | DescribeLoadBalancerHTTPSListenerAttribute | Read | loadbalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#loadbalancerId} | slb:tag | 无 |
slb:DescribeLoadBalancerListeners | DescribeLoadBalancerListeners | Read | LoadBalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#LoadBalancerId} | 无 | 无 |
slb:DescribeLoadBalancerTCPListenerAttribute | DescribeLoadBalancerTCPListenerAttribute | Read | loadbalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#loadbalancerId} | slb:tag | 无 |
slb:DescribeLoadBalancerUDPListenerAttribute | DescribeLoadBalancerUDPListenerAttribute | Read | loadbalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#loadbalancerId} | slb:tag | 无 |
slb:DescribeLoadBalancers | DescribeLoadBalancers | Read | LoadBalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#LoadBalancerId} | 无 | 无 |
slb:DescribeMasterSlaveServerGroupAttribute | DescribeMasterSlaveServerGroupAttribute | Read | loadbalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#loadbalancerId} | slb:tag | 无 |
slb:DescribeMasterSlaveServerGroups | DescribeMasterSlaveServerGroups | Read | loadbalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#loadbalancerId} | slb:tag | 无 |
slb:DescribeRuleAttribute | DescribeRuleAttribute | Read | loadbalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#loadbalancerId} | slb:tag | 无 |
slb:DescribeRules | DescribeRules | Read | loadbalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#loadbalancerId} | slb:tag | 无 |
slb:DescribeServerCertificates | DescribeServerCertificates | List | ServerCertificateacs:slb:{#regionId}:{#AccountId}:certificate/* | slb:tag | 无 |
slb:DescribeVServerGroupAttribute | DescribeVServerGroupAttribute | Read | loadbalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#loadbalancerId} | slb:tag | 无 |
slb:DescribeVServerGroups | DescribeVServerGroups | Read | loadbalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#loadbalancerId} | slb:tag | 无 |
slb:EnableHighDefinationMonitor | EnableHighDefinationMonitor | Write | LoadBalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/* | 无 | 无 |
slb:ListTLSCipherPolicies | ListTLSCipherPolicies | List | TLSPolicyacs:slb:{#regionId}:{#AccountId}:tlspolicy/* | 无 | 无 |
slb:ListTagResources | ListTagResources | Read | aclacs:slb:{#regionId}:{#accountId}:acl/{#aclId}loadbalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#loadbalancerId}ServerCertificateacs:slb:{#regionId}:{#AccountId}:certificate/{#ServerCertificateId}CaCertificateacs:slb:{#regionId}:{#AccountId}:certificate/{#CaCertificateId} | slb:tag | 无 |
slb:ModifyHighDefinationMonitor | ModifyHighDefinationMonitor | Write | LoadBalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/* | 无 | 无 |
slb:ModifyLoadBalancerInstanceChargeType | ModifyLoadBalancerInstanceChargeType | Read | LoadBalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#loadbalancerId} | 无 | 无 |
slb:ModifyLoadBalancerInstanceSpec | ModifyLoadBalancerInstanceSpec | Write | loadbalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#loadbalancerId} | slb:tag | 无 |
slb:ModifyLoadBalancerInternetSpec | ModifyLoadBalancerInternetSpec | Write | loadbalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#loadbalancerId} | slb:tag | 无 |
slb:ModifyLoadBalancerPayType | ModifyLoadBalancerPayType | Write | loadbalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#loadbalancerId} | 无 | 无 |
slb:ModifyVServerGroupBackendServers | ModifyVServerGroupBackendServers | Write | instanceacs:ecs:{#regionId}:{#accountId}:instance/{#instanceId}loadbalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#loadbalancerId} | slb:tag | 无 |
slb:MoveResourceGroup | MoveResourceGroup | Write | AccessControlListacs:slb:{#regionId}:{#accountId}:acl/{#AclId}ServerCertificateacs:slb:{#regionId}:{#accountId}:certificate/{#ServerCertificateId}LoadBalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#loadbalancerId} | 无 | 无 |
slb:RemoveAccessControlListEntry | RemoveAccessControlListEntry | Write | aclacs:slb:{#regionId}:{#accountId}:acl/{#aclId} | slb:tagslb:AclName | 无 |
slb:RemoveBackendServers | RemoveBackendServers | Write | loadbalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#loadbalancerId} | ecs:tagslb:tag | 无 |
slb:RemoveListenerWhiteListItem | RemoveListenerWhiteListItem | Write | loadbalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#loadbalancerId} | slb:tag | 无 |
slb:RemoveVServerGroupBackendServers | RemoveVServerGroupBackendServers | Write | instanceacs:ecs:{#regionId}:{#accountId}:instance/{#instanceId}loadbalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#loadbalancerId} | slb:tag | 无 |
slb:SetAccessControlListAttribute | SetAccessControlListAttribute | Write | aclacs:slb:{#regionId}:{#accountId}:acl/{#aclId} | slb:tagslb:AclName | 无 |
slb:SetAccessLogsDownloadAttribute | SetAccessLogsDownloadAttribute | Write | LoadBalanceracs:slb:{#regionId}:{#AccountId}:loadbalancer/{#LoadBalancerId} | 无 | 无 |
slb:SetBackendServers | SetBackendServers | Write | instanceacs:ecs:{#regionId}:{#accountId}:instance/{#instanceId}loadbalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#loadbalancerId} | ecs:tagslb:tag | 无 |
slb:SetCACertificateName | SetCACertificateName | Write | certificateacs:slb:{#regionId}:{#accountId}:certificate/{#certificateId} | slb:tag | 无 |
slb:SetDomainExtensionAttribute | SetDomainExtensionAttribute | Write | loadbalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#loadbalancerId} | slb:tag | 无 |
slb:SetListenerAccessControlStatus | SetListenerAccessControlStatus | Write | loadbalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#loadbalancerId} | 无 | 无 |
slb:SetLoadBalancerDeleteProtection | SetLoadBalancerDeleteProtection | Write | loadbalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#loadbalancerId} | slb:tag | 无 |
slb:SetLoadBalancerHTTPListenerAttribute | SetLoadBalancerHTTPListenerAttribute | Write | aclacs:slb:{#regionId}:{#accountId}:acl/{#aclId}loadbalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#loadbalancerId} | slb:tag | 无 |
slb:SetLoadBalancerHTTPSListenerAttribute | SetLoadBalancerHTTPSListenerAttribute | Write | aclacs:slb:{#regionId}:{#accountId}:acl/{#aclId}certificateacs:slb:{#regionId}:{#accountId}:certificate/{#certificateId}loadbalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#loadbalancerId} | slb:tag | 无 |
slb:SetLoadBalancerModificationProtection | SetLoadBalancerModificationProtection | Write | loadbalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#loadbalancerId} | slb:tag | 无 |
slb:SetLoadBalancerName | SetLoadBalancerName | Write | loadbalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#loadbalancerId} | slb:tag | 无 |
slb:SetLoadBalancerStatus | SetLoadBalancerStatus | Write | loadbalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#loadbalancerId} | slb:tag | 无 |
slb:SetLoadBalancerTCPListenerAttribute | SetLoadBalancerTCPListenerAttribute | Write | aclacs:slb:{#regionId}:{#accountId}:acl/{#aclId}loadbalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#loadbalancerId} | slb:tag | 无 |
slb:SetLoadBalancerUDPListenerAttribute | SetLoadBalancerUDPListenerAttribute | Write | aclacs:slb:{#regionId}:{#accountId}:acl/{#aclId}loadbalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#loadbalancerId} | slb:tag | 无 |
slb:SetRule | SetRule | Write | loadbalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#loadbalancerId} | slb:tag | 无 |
slb:SetServerCertificateName | SetServerCertificateName | Write | certificateacs:slb:{#regionId}:{#accountId}:certificate/{#certificateId} | slb:tag | 无 |
slb:SetTLSCipherPolicyAttribute | SetTLSCipherPolicyAttribute | Read | TLSPolicyacs:slb:{#regionId}:{#accountId}:tlspolicy/{#InstanceId} | 无 | 无 |
slb:SetVServerGroupAttribute | SetVServerGroupAttribute | Write | loadbalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#loadbalancerId} | slb:tag | 无 |
slb:StartLoadBalancerListener | StartLoadBalancerListener | Write | loadbalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#loadbalancerId} | slb:tag | 无 |
slb:StopLoadBalancerListener | StopLoadBalancerListener | Write | loadbalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#loadbalancerId} | slb:tag | 无 |
slb:TagResources | TagResources | Write | aclacs:slb:{#regionId}:{#accountId}:acl/{#aclId}certificateacs:slb:{#regionId}:{#accountId}:certificate/{#certificateId}loadbalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#loadbalancerId} | slb:tag | 无 |
slb:UntagResources | UntagResources | Write | aclacs:slb:{#regionId}:{#accountId}:acl/{#aclId}certificateacs:slb:{#regionId}:{#accountId}:certificate/{#certificateId}loadbalanceracs:slb:{#regionId}:{#accountId}:loadbalancer/{#loadbalancerId} | slb:tag | 无 |
slb:UploadCACertificate | UploadCACertificate | Write | CaCertificateacs:slb:{#regionId}:{#AccountId}:certificate/* | 无 | 无 |
slb:UploadServerCertificate | UploadServerCertificate | Write | certificateacs:slb:{#regionId}:{#accountId}:certificate/* | 无 | 无 |
资源(Resource)
下表是负载均衡(SLB)定义的资源,这些资源可以在RAM权限策略语句的Resource
元素中使用,用来授予对该资源执行具体操作的权限。 其中,资源ARN是资源在阿里云上的唯一标识。具体说明如下:
{#}
为变量标识,需要您替换为实际值。例如:{#ramcode}
需要您替换为实际的云服务RAM代码。-
*
表示全部。例如:{#resourceType}
为*
时:表示全部资源。{#regionId}
为*
时:表示全部地域。{#accountId}
为*
时:表示全部阿里云账号。
资源类型 | 资源ARN |
---|---|
AccessControlList | acs:slb:{#regionId}:{#accountId}:accesscontrollist/{#AclId} |
LoadBalancer | acs:slb:{#regionId}:{#accountId}:loadbalancer/{#LoadBalancerId} |
TLSPolicy | acs:slb:{#regionId}:{#accountId}:tlspolicy/{#InstanceId} |
ServerCertificate | acs:slb:{#regionId}:{#accountId}:servercertificate/{#ServerCertificateId} |
CaCertificate | acs:slb:{#regionId}:{#accountId}:cacertificate/{#CaCertificateId} |
条件(Condition)
下表是负载均衡(SLB)定义的产品级条件关键字,这些条件关键字可以在RAM权限策略语句的Condition
元素中使用,用来描述授予权限的条件。以下仅列举产品级的条件关键字,阿里云定义的通用条件关键字也同样适用负载均衡(SLB)。其中,数据类型决定了您可以使用哪些条件运算符将请求中的值与权限策略语句中的值进行比较。您必须使用与数据类型匹配的条件运算符,否则无法匹配策略语句,授权行为无效。数据类型与条件运算符的对应关系,请参见条件操作类型。
条件关键字 | 描述 | 类型 |
---|---|---|
slb:tag | SLB的标签,自2023年05月01日起不再维护,推荐使用全局条件键acs:RequestTag、acs:ResourceTag | String |
slb:AddressType | 传统型负载均衡的网络地址类型 | String |
slb:AclName | 访问控制策略组名称,示例值:test1 | String |
相关操作
您可以创建自定义权限策略,并将权限策略授予RAM用户、RAM用户组或RAM角色。具体操作如下:
- 创建自定义权限策略
- 为RAM用户授权
- 为RAM用户组授权
- 为RAM角色授权
内容没看懂? 不太想学习?想快速解决? 有偿解决: 联系专家
阿里云企业补贴进行中: 马上申请
腾讯云限时活动1折起,即将结束: 马上收藏
同尘科技为腾讯云授权服务中心。
购买腾讯云产品享受折上折,更有现金返利:同意关联,立享优惠
转转请注明出处:https://www.yunxiaoer.com/169936.html