Authorize an instance with a resource group

Procedure

If an Elasticsearch instance is in the default resource group, selecting a custom resource group during authorization does not grant access to the instance, because it remains in the default group.

First, grant the RAM user account-level permissions with a custom policy. Then, create a resource group, move the instance into it, and grant the RAM user permissions scoped to that resource group.

Step 1: Grant permissions with a custom policy

1. Log on to the RAM console as a RAM administrator.

2. Create a custom policy.

   For more information, see Create a custom policy. Use the following example to configure the policy:

   {
       "Statement": [
           {
               "Action": [
                   "elasticsearch:*"
               ],
               "Effect": "Allow",
               "Resource": "acs:elasticsearch:*:<yourAccountId>:instances/<yourInstanceId>"
           },
           {
               "Action": [
                   "elasticsearch:ListCollectors"
               ],
               "Effect": "Allow",
               "Resource": "acs:elasticsearch:*:<yourAccountId>:collectors/*"
           },
           {
               "Action": [
                   "elasticsearch:ListInstance",
                   "elasticsearch:ListSnapshotReposByInstanceId"
               ],
               "Effect": "Allow",
               "Resource": "acs:elasticsearch:*:<yourAccountId>:instances/*"
           },
           {
               "Effect": "Allow",
               "Action": [
                   "cms:ListAlarm",
                   "cms:DescribeActiveMetricRuleList",
                   "cms:QueryMetricList"
               ],
               "Resource": "*"
           },
           {
               "Action": [
                   "elasticsearch:ListTags"
               ],
               "Effect": "Allow",
               "Resource": "acs:elasticsearch:*:*:tags/*"
           },
           {
               "Action": [
                   "elasticsearch:GetEmonProjectList"
               ],
               "Effect": "Allow",
               "Resource": "acs:elasticsearch:*:*:emonProjects/*"
           },
           {
               "Action": [
                   "elasticsearch:getEmonUserConfig"
               ],
               "Effect": "Allow",
               "Resource": "acs:elasticsearch:*:*:emonUserConfig/*"
           },
          {
          "Action": "ims:*",
          "Effect": "Allow",
          "Resource": "acs:ims::<yourAccountId>:application/*"
          }
       ],
       "Version": "1"
   }

   When you use the example, replace the following variables.

   Parameter	Description
   <yourAccountId>	Specify your Alibaba Cloud account ID. Wildcard characters* are not supported. To obtain the ID, hover over the profile picture in the upper-right corner of the console to view your Account ID.
   <yourInstanceId>	The ID of the instance to authorize. Wildcard characters such as * are not supported. To obtain the instance ID, see View basic instance information.

   The Alibaba Cloud Elasticsearch console integrates with services such as Beats collectors, CloudMonitor, and tags. To ensure that the RAM user passes permission checks when managing an instance in a specific resource group, configure a custom policy at the account level.

   Note

   After you configure the permissions, the RAM user can also access the instance directly at the following URLs:

   • https://elasticsearch.console.aliyun.com/{regionId}/instances/{instanceId}/base

   • https://elasticsearch.console.aliyun.com/{regionId}/logstashes/{instanceId}/base

3. Create a RAM user.

   For more information, see Create a RAM user.

4. Grant the RAM user permissions by using the custom policy at the account level.

   For more information, see Grant permissions to a RAM user. When you grant the permissions, set Resource Range to Account, and in the Policies section, select the custom policy that you created.

(Optional) Step 2: Create a resource group and grant permissions

1. Log on to the Resource Management console.

2. Create a resource group.

   For more information, see Create a resource group.

3. Transfer the target instance from the default resource group to the custom resource group.

   For more information, see Transfer resources across resource groups.

4. Grant the RAM user permissions to manage Alibaba Cloud Elasticsearch within the specified resource group.

   For more information, see Grant permissions on a resource group. On the Grant Permission page, set Principal to the custom RAM user, and in the Policies section, select the AliyunElasticsearchFullAccess system policy.

   Note

   After authorization, the principal has the specified permissions on all resources in that resource group.

Step 3: Verify the policy

1. Log on to the Alibaba Cloud Elasticsearch console as the RAM user.

2. In the left-side navigation pane, click Elasticsearch Clusters.

3. In the top menu bar, select the region and the custom resource group. You can now view the list of instances in the selected region and resource group.