Permission configuration
Elastic Compute Agent supports RAM-based access control through system policies and custom policies. Alibaba Cloud account administrators use these policies to grant RAM users permissions for Elastic Compute Agent. This topic also covers the resource isolation mechanism for sessions, scheduled tasks, and IM channels.
Common scenarios
Elastic Compute Agent provides two system policies that cover most authorization requirements:
Full access — RAM users can activate the service, initiate sessions, create scheduled tasks, configure IM channels, and view quota and usage information.
Read-only access — RAM users can only view sessions, tasks, IM channels, quota, and usage information.
For fine-grained control, create custom policies based on the Action list for selective authorization. For details, see the Custom Policies section.
Full access policy
The AliyunECAgentFullAccess system policy grants RAM users complete permissions for Elastic Compute Agent, covering operations such as service activation, sessions, scheduled tasks, IM channel creation, quota, and usage management. Attach this policy to a RAM user to grant full Elastic Compute Agent permissions.
The following is the policy content. You can also use it to create an equivalent custom policy:
{
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ecagent:OpenAgentService",
"ecagent:DescribeAgentService",
"ecagent:ModifyAgentServiceAttribute",
"ecagent:DescribeAgentCreditUsage",
"ecagent:InvokeAgent",
"ecagent:CreateAgentSchedule",
"ecagent:DeleteAgentThread",
"ecagent:DeleteAgentSchedule",
"ecagent:DescribeAgentScheduleAttribute",
"ecagent:DescribeAgentSchedules",
"ecagent:DescribeAgentThreadAttribute",
"ecagent:DescribeAgentThreadMessages",
"ecagent:DescribeAgentThreads",
"ecagent:ModifyAgentScheduleAttribute",
"ecagent:ModifyAgentThreadAttribute",
"ecagent:StopAgent",
"appflow:CreateUserAuthConfig",
"appflow:ListUserAuthConfigs",
"appflow:CreateFlow",
"appflow:ListFlows",
"appflow:EnableFlow",
"appflow:DisableFlow",
"appflow:Validation"
],
"Resource": "*"
}
]
}IM channels integrate DingTalk, Lark, and WeCom with Elastic Compute Agent through AppFlow, so the full access policy includes appflow:*-related actions.
When creating custom policies, use the exact ecagent namespace prefix as shown in the policy examples. Using an incorrect namespace causes API authorization failures for RAM users.
Read-only access policy
The AliyunECAgentReadOnlyAccess system policy grants RAM users query-only permissions, including session queries, task queries, IM channel queries, and usage queries.
The following is the policy content. You can also use it to create an equivalent custom policy:
{
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ecagent:DescribeAgentService",
"ecagent:DescribeAgentCreditUsage",
"ecagent:DescribeAgentScheduleAttribute",
"ecagent:DescribeAgentSchedules",
"ecagent:DescribeAgentThreadAttribute",
"ecagent:DescribeAgentThreadMessages",
"ecagent:DescribeAgentThreads",
"appflow:ListUserAuthConfigs",
"appflow:ListFlows",
"appflow:Validation"
],
"Resource": "*"
}
]
}Custom policies
If the system policies do not meet your requirements, create custom policies based on the Action lists above for more granular permissions. The following example allows initiating sessions and querying session history, while prohibiting the creation of scheduled tasks:
{
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ecagent:OpenAgentService",
"ecagent:DescribeAgentService",
"ecagent:DescribeAgentCreditUsage",
"ecagent:InvokeAgent",
"ecagent:DescribeAgentThreadAttribute",
"ecagent:DescribeAgentThreadMessages",
"ecagent:DescribeAgentThreads"
],
"Resource": "*"
}
]
}Resource isolation
Elastic Compute Agent implements RAM user-level resource isolation. Sessions, scheduled tasks, and IM channels are treated as resources, and each RAM user can only access and operate their own resources.
Resource types
| Resource type | Description | Ownership |
| Session | Conversation records and context between users and the Agent | RAM user |
| Scheduled task | Periodic O&M tasks created by users | RAM user |
| IM channel | IM bot integration channels configured by users | RAM user |
Isolation mechanism
Session isolation — Each RAM user's session records and conversation context are independent. RAM user A cannot view or access RAM user B's session content.
Scheduled task isolation — Scheduled tasks created by each RAM user are only visible and operable by the creator.
IM channel isolation — IM channels configured by each RAM user are only visible to the creator. After the IM bot joins a group chat, it can only list the session information of the account to which the IM channel belongs.
Isolation rules
| Rule | Description |
| Resource ownership | Resources are exclusively owned by the RAM user who created them. |
| Access control | RAM users can only access and operate their own resources. Cross-user access is not allowed. |
| Permission inheritance | Resource operation permissions follow the RAM permission scope of the RAM user. |
| Resource deletion | Resources can only be deleted by the owning RAM user. Deletion is irreversible. |
FAQ
How can a RAM user obtain Elastic Compute Agent usage permissions?
The Alibaba Cloud account administrator grants one of the following permissions to the RAM user: use the AliyunECAgentFullAccess system policy for full access, or use the AliyunECAgentReadOnlyAccess system policy for read-only access. For details, see the Full Access Policy and Read-Only Access Policy sections of this document.
Can the Alibaba Cloud account administrator view sessions and tasks of RAM users?
In the current version, the Alibaba Cloud account administrator cannot directly view the sessions and scheduled tasks of RAM users. This capability will be supported after the multi-account resource sharing feature is launched.
Can different RAM users under the same Alibaba Cloud account share IM channels?
This is not currently supported. In the current version, IM channels are exclusively owned by the RAM user who created them. Sharing will be supported after the task and session sharing feature is launched.
What happens to resources under a RAM user after the RAM user is deleted?
After a RAM user is deleted, their scheduled tasks automatically stop executing, IM channels are automatically disconnected, and session records are automatically cleaned up upon expiration based on the session history retention period (90 days).