Prohibit a RAM user from creating Linux instances with root as the initial logon user-Elastic Compute Service(ECS)-阿里云帮助中心

Use RAM access policies to enforce ecs-user as the initial logon user for Linux ECS instances instead of root.

Limitations

Windows instances do not support creating non-administrator users during instance creation. Do not apply these access policies to Windows instances.
Some Linux images do not support ecs-user creation. See Public image release notes for unsupported image versions.

Procedure

This example prohibits a RAM user named Alice from creating Linux instances with root as the initial logon user.

Create a RAM user named Alice in the RAM console.
See Create a RAM user.

Create an access policy named ecs-root-user-control in the RAM console. Add the following policy content in the script editor.

Note

This policy denies setting the logon username to root when creating an ECS instance and denies resetting root logon credentials by replacing the system disk.

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "ecs:RunInstances",
                "ecs:CreateInstance",
                "ecs:CreateOrder",
                "ecs:ReplaceSystemDisk",
                "ecs:AttachDisk",
                "ecs:InvokeCommand"
            ],
            "Resource": "*",
            "Condition": {
                "Bool": {
                    "ecs:LoginAsNonRoot": [
                        "false"
                    ]
                }
            },
            "Effect": "Deny"
        }
    ]
}

Create another access policy named ecs-admin. Add the following policy content in the script editor.

Note

This policy grants permissions to purchase, manage, and view ECS instances, simulating an ECS administrator. Modify the policy as needed.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ecs:*",
        "ecs-workbench:*",
        "vpc:CheckCanAllocateVpcPrivateIpAddress",
        "vpc:DescribeVpcs",
        "vpc:DescribeVSwitches",
        "bss:ModifyAgreementRecord",
        "bss:DescribeOrderList",
        "bss:DescribeOrderDetail",
        "bss:PayOrder",
        "bss:CancelOrder"
      ],
      "Resource": "*"
    }
  ]
}

Grant permissions to the RAM user Alice in the RAM console.
Set Authorization Scope to Account. Select the RAM user Alice as the principal. Select the custom policies ecs-root-user-control and ecs-admin. See Grant permissions to a RAM user.

Verify the results

Log on to the Alibaba Cloud Management Console as the RAM user Alice.

See Log on to the Alibaba Cloud console as a RAM user.

Verification item 1: Create an ECS instance with root as the logon user

Go to the instance purchase page.
Click the Custom Launch tab.
Select the billing method, region, instance type, image, and other configurations. Set the logon username to root. See Create an instance using the wizard.
Set Logon Credentials to Custom Password, and set the logon password.
Confirm the order. A message appears indicating that instance creation failed.

Verification item 2: Replace the system disk of an existing ECS instance to reset the root user credentials

Go to the Replace Operating System page.
1. Go to ECS console - Instances.
2. In the top navigation bar, select the region where the target ECS instance is located.
3. Go to the instance details page. Click All Operations, and then search for and click Replace System Disk.
Perform a precheck before replacing the operating system.
1. In the Replace System Disk dialog box, select Replace a system disk.
2. The system automatically performs a precheck, which takes about 10 seconds.
  - If the Precheck column shows , the precheck succeeded.
  - If the Precheck column shows , the precheck failed. Fix the issue as instructed and retry.
3. Read the notes about replacing the operating system. Select I am aware of the preceding risks and want to continue, and click Continue to Replace Operating System.
In the Replace System Disk dialog box, configure the new operating system and set the root user credentials.
In the Security Settings section, click the Custom Password tab, select the root user, and then set the logon password and confirm password.
Review the cost details and click Stop Instances and Continue. A message appears indicating that the operation failed.