manage-vpc-vswitch-policy.yml

ROSTemplateFormatVersion: '2015-09-01'
Description:
  zh-cn: 创建RAM策略，授权管理指定区域VSwitch的查看、操作及绑定解绑路由表权限。
  en: Create a RAM policy to authorize the management of specified region VSwitches,
    including viewing, operating, and binding/unbinding route table permissions.
Parameters:
  Region:
    Type: String
    Label:
      en: Region ID
      zh-cn: 地域
    Description:
      en: You can create/delete/bind subnet route/unbind subnet route for the VSwitch
        in this Region, and only have the view permission for the VSwitch in other
        Regions.
      zh-cn: 可以对该地域下的VSwitch进行创建/删除/绑定子网路由/解绑子网路由的操作，对于其它地域的VSwitch只有查看权限。
    Default: cn-hangzhou
    AllowedValues:
    - cn-qingdao
    - cn-beijing
    - cn-zhangjiakou
    - cn-huhehaote
    - cn-hangzhou
    - cn-shanghai
    - cn-shenzhen
    - cn-hongkong
    - ap-northeast-1
    - ap-southeast-1
    - ap-southeast-2
    - ap-southeast-3
    - ap-southeast-5
    - ap-south-1
    - us-east-1
    - us-west-1
    - me-east-1
    - eu-central-1
    - cn-chengdu
    - eu-west-1
    - cn-heyuan
Resources:
  ManageSingleRegionVSwitchPolicy:
    Type: ALIYUN::RAM::ManagedPolicy
    Properties:
      PolicyDocument:
        Statement:
        - Action:
          - vpc:*Describe*
          - vpc:*VSwitch*
          - vpc:*RouteTable*
          Effect: Allow
          Resource:
          - Fn::Sub: acs:vpc:${Region}:*:*/*
        - Action:
          - ecs:*Describe*
          Effect: Allow
          Resource:
          - '*'
        Version: '1'
      PolicyName:
        Fn::Sub: ManageSingleRegionVSwitch-${ALIYUN::StackId}
Metadata:
  ALIYUN::ROS::Interface:
    ParameterGroups:
    - Parameters:
      - Region
      Label:
        default: RAM
    TemplateTags:
    - acs:example:安全:对VPC中VSwitch的管理授权