If administrators from different departments need to manage Elastic Compute Service (ECS) resources, use resource groups to group ECS instances with related resources like disks, images, security groups, keys, and vSwitches. This prevents administrators from viewing or managing each other's resources and enables horizontal permission management.
Security risks
In the default permission model, a RAM user granted ECS management permissions (for example, AliyunECSFullAccess) can fully manage all ECS instances and their associated resources within the Alibaba Cloud account. This flat authorization model poses critical security risks as your business scales and teams expand:
Risk of permission abuse and operational errors: An administrator from Department A can easily view, modify, or even delete core production servers that belong to Department B. Whether malicious or accidental, the consequences can be disastrous.
Lack of the principle of least privilege: A RAM user has permissions that far exceed their job requirements. This directly violates the principle of least privilege. This principle is a core component of a defense-in-depth strategy and ensures that any user, program, or process has only the minimum permissions needed to perform its task.
Audit and compliance challenges: When all operations are mixed together, it is difficult to clearly track and audit which department or project made changes to resources. This creates significant challenges for meeting compliance requirements.
Best practices
Use resource groups and identity-based RAM policies to create logical management boundaries within your Alibaba Cloud account. The following scenario, which involves two departments (DepartmentA and DepartmentB), demonstrates how to implement horizontal permission management.
Scenario: Create separate ECS administrators for Department A and Department B. Each administrator must manage only their own department's resources.
Create resource groups
Log on with an Alibaba Cloud account or a RAM identity (such as a RAM user or RAM role) with permissions to manage resource groups.
Go to the Resource Group console. Click Create Resource Group, fill in the required information, and then click OK.
Resource Group Identifier: Enter "DepartmentA".
Resource Group Name: Enter "Department A Resource Group".
Repeat these steps to create a resource group with the identifier "DepartmentB".
Create RAM users
Go to the RAM console. In the left-side navigation pane, choose .
Click Create User and enter the information as prompted.
Logon Name/Display Name: Enter "AdminA".
Access Mode: Select Console Access and configure a password policy.
Click OK and complete the security verification.
Repeat these steps to create the user AdminB.
Grant permissions to the resource groups
Return to the Resource Group console.
Find the DepartmentA resource group and click Manage Permission in the Actions column.
Click Grant Permission.
Resource Scope: This defaults to the current resource group, DepartmentA.
Principal: Select RAM User and select the AdminA user that you just created from the list.
Policy: In the search box, enter ecs. Select the
AliyunECSFullAccessandAliyunBSSFullAccesssystem policies.Click Add Authorization.
Repeat these steps to grant permissions to the AdminB user for the DepartmentB resource group.
Verify the isolation
Log out of your current account. Then, separately log on to the Alibaba Cloud Management Console as AdminA and AdminB.
After you log on as AdminA: Create a custom instance. For the resource group, select Department A Resource Group.
Go to the ECS console - Instances. You will see only the ECS instances created in the DepartmentA resource group.
After you log on as AdminB: You will find a similar, completely isolated result. All operations are restricted to the DepartmentB resource group.