A RetroSearch Logo

Home - News ( United States | United Kingdom | Italy | Germany ) - Football scores

Search Query:

Showing content from https://www.alibabacloud.com/help/en/functioncompute/fc-2-0/security-and-compliance/policies below:

Policies and sample policies - Function Compute

Alibaba Cloud provides Resource Access Management (RAM) for you to manage permissions for Function Compute. When you use RAM, you do not need to share the AccessKey pair of your Alibaba Cloud account with other users. Instead, you can grant them only the minimal required permissions. An AccessKey pair includes an AccessKey ID and an AccessKey secret. This topic describes the policies for Function Compute, including system policies and custom policies. This topic also provides sample custom policies.

Type

In RAM, a policy is a set of permissions that are described based on the policy syntax and structure. A policy accurately describes the authorized resource set, action set, and authorization conditions. The policies for Function Compute include the following types:

System policies

Before you log on to the Function Compute console as a RAM user for the first time, you must attach a system policy for accessing Function Compute and system policies for accessing other Alibaba Cloud services to the RAM user by using your Alibaba Cloud account. You can access Alibaba Cloud services including Function Compute as the RAM user only after the system policies are attached to the RAM user.

The system policies include the following types:

Important

If you cannot update OSS event triggers as a RAM user after you grant permissions related to triggers, for example, attach the AliyunOSSFullAccess policy to the RAM user by using an Alibaba Cloud account, attach the following custom policy to the RAM user by using the Alibaba Cloud account. After the custom policy is attached, you can update the OSS event triggers as the RAM user.

 {
        "Statement": [
            {
                "Action": [
                    "ram:PassRole"
                ],
                "Effect": "Allow",
                "Resource": "*"
            }
        ],
        "Version": "1"
    }
Custom policies

In addition to the system policies, Function Compute supports custom policies that allow you to grant fine-grained permissions to RAM users. For more information about the elements of a policy, see Policy elements.

Resource

Action

Description

acs:fc:<region>:<account-id>:services/<serviceName>

fc:GetService

The specified service.

fc:UpdateService

fc:DeleteService

acs:fc:<region>:<account-id>:services/*

fc:CreateService

All services.

fc:ListServices

acs:fc:<region>:<account-id>:services/<serviceName>.<qualifier>

fc:GetService

The service of a specified version.

acs:fc:<region>:<account-id>:services/<serviceName>/functions/<functionName>

fc:GetFunction

The specified function in a specified service.

fc:UpdateFunction

fc:DeleteFunction

fc:InvokeFunction

acs:fc:<region>:<account-id>:services/<serviceName>/functions/*

fc:CreateFunction

All functions in a specified service.

fc:ListFunctions

acs:fc:<region>:<account-id>:services/<serviceName>.*/functions/<functionName>

fc:GetFunction

All functions in all versions of a specified service.

fc:UpdateFunction

fc:DeleteFunction

fc:InvokeFunction

fc:PutProvisionConfig

fc:GetProvisionConfig

fc:PutFunctionOnDemandConfig

fc:DeleteFunctionOnDemandConfig

fc:PutFunctionAsyncInvokeConfig

fc:DeleteFunctionAsyncInvokeConfig

fc:GetFunctionAsyncInvokeConfig

fc:GetFunctionOnDemandConfig

acs:fc:<region>:<account-id>:services/<serviceName>/functions/<functionName>/triggers/<triggerName>

fc:GetTrigger

The specified trigger of a specified function in a specified service.

fc:UpdateTrigger

fc:DeleteTrigger

acs:fc:<region>:<account-id>:services/<serviceName>/functions/<functionName>/triggers/*

fc:CreateTrigger

All triggers of a specified function in a specified service.

fc:ListTriggers

acs:fc:<region>:<account-id>:services/<serviceName>/versions

fc:PublishServiceVersion

All service versions.

fc:ListServiceVersions

acs:fc:<region>:<account-id>:services/<serviceName>/versions/<versionId>

fc:DeleteServiceVersion

The specified service version.

acs:fc:<region>:<account-id>:services/<serviceName>/aliases/*

fc:CreateAlias

All service aliases.

fc:ListAliases

acs:fc:<region>:<account-id>:services/<serviceName>/aliases/<aliasName>

fc:GetAlias

The specified service alias.

fc:UpdateAlias

fc:DeleteAlias

acs:fc:<region>:<account-id>:custom-domains/*

fc:CreateCustomDomain

All custom domain names.

fc:ListCustomDomains

acs:fc:<region>:<account-id>:custom-domains/<domainName>

fc:GetCustomDomain

The specified custom domain name.

fc:UpdateCustomDomain

fc:DeleteCustomDomain

acs:fc:<region>:<account-id>:tag

fc:TagResource

A single tag.

fc:GetResourceTags

fc:UnTagResource

acs:fc:<region>:<account-id>:tags/*

fc:ListTaggedResources

All tags.

acs:fc:<region>:<account-id>:account-settings/*

fc:GetAccountSettings

The settings of your account.

acs:fc:<region>:<account-id>:layerarn/<arn>

fc:GetLayerVersionByArn

All layers.

acs:fc:<region>:<account-id>:layers/*

fc:ListLayers

acs:fc:<region>:<account-id>:layers/<layerName>/versions/<versionId>

fc:PublishLayerAsPublic

acs:fc:<region>:<account-id>:layers/<layerName>/versions/*

fc:ListLayerVersions

All layer versions.

fc:CreateLayerVersion

acs:fc:<region>:<account-id>:layers/<layerName>/versions/<versionId>

fc:GetLayerVersion

fc:DeleteLayerVersion

acs:fc:<region>:<account-id>:on-demand-configs/*

fc:ListOnDemandConfigs

The on-demand configurations.

acs:fc:<region>:<account-id>:provision-configs/*

fc:ListProvisionConfigs

The provisioned configurations.

acs:fc:<region>:<account-id>:services/<serviceName>/binding

fc:DeleteVpcBinding

The VPC configuration.

acs:fc:<region>:<account-id>:services/<serviceName>/binding/*

fc:CreateVpcBinding

fc:ListVpcBindings

acs:fc:<region>:<account-id>:services/<serviceName>/functions/<functionName>/async-invoke-configs/*

fc:ListFunctionAsyncInvokeConfigs

The asynchronous invocation configurations.

acs:fc:<region>:<account-id>:services/<serviceName>/functions/<functionName>/code

fc:GetFunctionCode

All function code.

acs:fc:<region>:<account-id>:services/<serviceName>/functions/<functionName>/stateful-async-invocations/*

fc:ListStatefulAsyncInvocations

Asynchronous tasks

acs:fc:<region>:<account-id>:services/<serviceName>/functions/<functionName>/stateful-async-invocations/<invocationId>

fc:GetStatefulAsyncInvocation

fc:StopStatefulAsyncInvocation

You can use the preceding actions and resources to define the following custom policy that is used to grant the permissions to invoke the demo function in the test service in the China (Hangzhou) region.

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "fc:InvokeFunction"
            ],
            "Resource": "acs:fc:cn-hangzhou:*:services/test/functions/demo",
            "Effect": "Allow"
        }
    ]
}
Sample policies Custom policy with permissions to create and query services and create and invoke functions in Function Compute 
{
"Version":"1",
"Statement":[
{
"Action":[
"fc:CreateService",
"fc:GetService",
"fc:CreateFunction",
"fc:GetFunction",
"fc:InvokeFunction"
],
"Resource":"*",
"Effect":"Allow"
},
{
"Action":[
"ram:PassRole"
],
"Effect":"Allow",
"Resource":"*"
}
]
}
Custom policy used to grant the permissions to access logs 
{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "log:ListProject",
                "log:ListLogStore"
            ],
            "Resource": "acs:log:*:*:project/*"
        }
    ]
}
Custom policy used to grant the permissions to access OSS event triggers 
{
  "Statement": [
    {
      "Action": [
        "oss:ListBucket",
        "oss:GetBucketEventNotification",
        "oss:PutBucketEventNotification",
        "oss:DeleteBucketEventNotification"
      ],
      "Effect": "Allow",
      "Resource": "*"
    }
  ],
  "Version": "1"
}
Custom policy in which services that can access the Internet are not allowed to create 
{
  "Version": "1",
  "Statement": [
    {
      "Action": "fc:UpdateService",
      "Effect": "Deny",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "fc:EnableServiceInternetAccess": "true"
        }
      }
    },
    {
      "Action": "fc:CreateService",
      "Effect": "Deny",
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "fc:EnableServiceInternetAccess": "false"
        }
      }
    }
  ]
}
Custom policy in which services that cannot access Log Service are not allowed to create 
{
  "Version": "1",
  "Statement": [
    {
      "Action": "fc:UpdateService",
      "Effect": "Deny",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "fc:EnableServiceSLSLogging": "false"
        }
      }
    },
    {
      "Action": "fc:CreateService",
      "Effect": "Deny",
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "fc:EnableServiceSLSLogging": "true"
        }
      }
    }
  ]
}
Custom policy in which triggers that can be accessed over the Internet are not allowed to create 
{
  "Version": "1",
  "Statement": [
    {
      "Action": "fc:UpdateTrigger",
      "Effect": "Deny",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "fc:EnableHTTPTriggerAnonymous": "true"
        }
      }
    },
    {
      "Action": "fc:CreateTrigger",
      "Effect": "Deny",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "fc:EnableHTTPTriggerAnonymous": "true"
        }
      }
    }
  ]
}

RetroSearch is an open source project built by @garambo | Open a GitHub Issue

Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo

HTML: 3.2 | Encoding: UTF-8 | Version: 0.7.4