Elasticsearch authorizable resources

Background information

Custom policies

You can create a custom permission policy in the Resource Access Management (RAM) console or by calling the RAM API operation CreatePolicy. In the custom policy, specify the policy content based on the JSON template. Set the Action and Resource parameters to the values provided in the List of authorizable resources section of this topic. For more information, see Create a custom access policy and Elements of an access policy.

{
  "Statement": [
  {
    "Effect": "Allow",
    "Action": [
                "elasticsearch:[Elasticsearch RAM Action]",
                "elasticsearch:ListInstance"
            ],
    "Resource": [
                "[Elasticsearch RAM Action Resource]",
                "acs:elasticsearch:cn-hangzhou:133071096032****:instances/es-cn-2r42b7uyg003k****"
            ]
  }
  ],
  "Version": "1"
}

List of authorizable resources

Elasticsearch

• Instance management

  Action	Resource	Description
  elasticsearch:CreateInstance	acs:elasticsearch:<yourRegionId>:<yourAccountId>:instances/*	Create an instance.
  elasticsearch:ListInstance		View the details of all instances.
  elasticsearch:DescribeInstance	acs:elasticsearch:<yourRegionId>:<yourAccountId>:instances/<yourInstanceId>	Query the details of a specific instance.
  elasticsearch:EstimatedRestartTime		Get the estimated restart time for an instance.
  elasticsearch:RestartInstance		Restart a specific instance.
  elasticsearch:UpdateInstanceChargeType		Convert a pay-as-you-go instance to a subscription instance.
  elasticsearch:UpdateDescription		Update the name of a specific instance.
  elasticsearch:DeleteInstance		Release a specific pay-as-you-go Alibaba Cloud Elasticsearch instance.
  elasticsearch:CancelDeletion		Resume a released and frozen Elasticsearch instance.
  elasticsearch:RenewInstance		Renew a subscription instance.
  elasticsearch:ActivateZones		Resume a deactivated zone.
  elasticsearch:DeactivateZones		If multiple zones are available, deactivate some zones. The nodes in the deactivated zones are migrated to other zones.
  elasticsearch:UpdateReadWritePolicy		Enable or disable the write high availability (HA) feature for an instance.
  elasticsearch:InterruptElasticsearchTask		Interrupt an ongoing change to an instance.
  elasticsearch:ResumeElasticsearchTask		Resume an interrupted task on an instance.
  elasticsearch:DescribeElasticsearchHealth		Get the health status of a specific instance.
  elasticsearch:GetElastictask		Get the auto scaling rules for a cluster.
  elasticsearch:ModifyElastictask		Update the auto scaling rules for an instance.
  elasticsearch:ListInstanceIndices		Get the index list of an instance.
  elasticsearch:MigrateToOtherZone		Migrate nodes from a source zone to a destination zone.
  elasticsearch:MoveResourceGroup		Move an instance to a specific resource group.
  elasticsearch:ModifyInstanceMaintainTime		Change and enable the maintenance window for an instance.
  elasticsearch:ListShardRecoveries		View the progress of ongoing and completed shard recovery tasks.

• Tag management

  Action	Resource	Description
  elasticsearch:ListTags	acs:elasticsearch:<yourRegionId>:<yourAccountId>:tags/<yourInstanceId>	Query all visible user tags.
  elasticsearch:CreateTags		Create or update tags.
  elasticsearch:RemoveTags		Remove tags.
  elasticsearch:ListTagResources	acs:elasticsearch:<yourRegionId>:<yourAccountId>:tags/* acs:elasticsearch:<yourRegionId>:<yourAccountId>:tags/<yourInstanceId>	Query visible resource-tag relationships.

• Data migration

  Action	Resource	Description
  elasticsearch:ListDataTasks	acs:elasticsearch:<yourRegionId>:<yourAccountId>:instances/<yourInstanceId>	View information about data migration tasks.
  elasticsearch:CancelTask		Cancel a data migration task.
  elasticsearch:CreateDataTasks		Create an index migration task to migrate data from a selected instance to the current instance.
  elasticsearch:DeleteDataTask		Delete an index migration task.
  elasticsearch:GetClusterDataInformation	acs:elasticsearch:<yourRegionId>:<yourAccountId>:instances/* acs:elasticsearch:<yourRegionId>:<yourAccountId>:instances/<yourInstanceId>	Get the data information of an instance.

• Instance upgrade or downgrade

  Action	Resource	Description
  elasticsearch:UpgradeEngineVersion	acs:elasticsearch:<yourRegionId>:<yourAccountId>:instances/<yourInstanceId>	Upgrade the instance version or kernel patch version.
  elasticsearch:UpdateInstance		Change the instance configuration.
  elasticsearch:DowngradeInstance		Before a scale-in, check whether data on specific nodes of an instance can be migrated. Before a scale-in, perform a data migration task. Check whether specific nodes of an instance can be scaled in. Perform a node scale-in operation for an instance.

• Cluster configuration

  Action	Resource	Description
  elasticsearch:UpdateInstanceSettings	acs:elasticsearch:<yourRegionId>:<yourAccountId>:instances/<yourInstanceId>	Update the YML parameter settings for a specific instance.
  elasticsearch:UpdateHotIkDicts		You can hot-update the IK tokenizer plugin for an instance, applying changes to both the main IK tokenizer dictionary and the IK stop words dictionary.
  elasticsearch:UpdateSynonymsDicts		Update the synonym dictionary of an instance.
  elasticsearch:UpdateDict		Perform a cold update on the IK analysis plugin of an instance. This includes the main IK dictionary and the IK stopword dictionary.
  elasticsearch:UpdateAliwsDict		Update the dictionary file for the AliNLP analysis plugin (analysis-aliws).
  elasticsearch:ListDictInformation		When you add a dictionary file from your OSS bucket, get and verify the details of the file.
  elasticsearch:UpdateAdvancedSetting		Change the Garbage Collector configuration for a specific instance.
  elasticsearch:DescribeTemplates		Get the scenario-specific configuration templates for an instance.
  elasticsearch:UpdateExtendConfig		Modify the scenario-specific configuration templates for an instance.
  elasticsearch:UpdateTemplate		Modify the content of the scenario-specific configuration templates for an instance.
  elasticsearch:RecommendTemplates		Get the recommended scenario-specific configuration templates.
  elasticsearch:ListDicts		View the details of dictionaries of a specific type and the signed public URLs for downloading them.

• Index management

  Action	Resource	Description
  elasticsearch:CreateIndexTemplate	acs:elasticsearch:<yourRegionId>:<yourAccountId>:instances/<yourInstanceId>	Create an index template.
  elasticsearch:DeleteIndexTemplate		Delete an index template.
  elasticsearch:UpdateIndexTemplate		Update the component settings of an index template.
  elasticsearch:DescribeIndexTemplate		Get the component settings of an index template.
  elasticsearch:ListIndexTemplates		View the list of index templates.
  elasticsearch:DescribeILMPolicy		Query the details of a specific index lifecycle management (ILM) policy.
  elasticsearch:ListILMPolicies		View the list of existing ILM policies.
  elasticsearch:CreateILMPolicy		Create an ILM policy.
  elasticsearch:DeleteILMPolicy		Delete a specific ILM policy definition.
  elasticsearch:UpdateILMPolicy		Modify an ILM policy.
  elasticsearch:CreateDataStream		Create a data stream.
  elasticsearch:DeleteDataStream		Delete a data stream.
  elasticsearch:RolloverDataStream		Perform a rolling update on the matching index of a data stream.
  elasticsearch:ListDataStreams		View the list of data streams.
  elasticsearch:CloseManagedIndex		Disable the cloud hosting feature for an index in an Indexing Service instance.

• Plugin management

  Action	Resource	Description
  elasticsearch:ListPlugins	acs:elasticsearch:<yourRegionId>:<yourAccountId>:instances/<yourInstanceId>	View the list of plugins for a specific instance.
  elasticsearch:InstallSystemPlugin		Install a built-in system plugin.
  elasticsearch:UninstallPlugin		Uninstall an installed built-in plugin.
  elasticsearch:InstallUserPlugins		Install a custom user plugin that has been uploaded to the Elasticsearch console.

• Cluster monitoring and log query

  Action	Resource	Description
  elasticsearch:GetEmonMonitorData	acs:elasticsearch:<yourRegionId>:<yourAccountId>:emonProjects/<yourProjectId>	Get Grafana monitoring data.
  elasticsearch:GetEmonGrafanaDashboards		Get the list of Grafana dashboards.
  elasticsearch:GetEmonGrafanaAlerts		Get the list of Grafana alerts.
  elasticsearch:PostEmonTryAlarmRule	acs:elasticsearch:<yourRegionId>:<yourAccountId>:emonProjects/*	Send a test alert message.
  elasticsearch:GetEmonAlarmGroupList		Get the list of alert contact groups.
  elasticsearch:ListSearchLogs	acs:elasticsearch:<yourRegionId>:<yourAccountId>:instances/<yourInstanceId>	View instance logs.

• Security settings

  Action	Resource	Action Description
  elasticsearch:TriggerNetwork	acs:elasticsearch:<yourRegionId>:<yourAccountId>:instances/<yourInstanceId>	Enable or disable public or private network access for an Elasticsearch or Kibana instance.
  elasticsearch:UpdatePrivateNetworkWhiteIps		Update the VPC private access whitelist for a specific instance.
  elasticsearch:UpdatePublicWhiteIps		Update the public access whitelist for a specific instance.
  elasticsearch:UpdatePublicNetwork		Enable or disable the public endpoint for a specific instance.
  elasticsearch:UpdateWhiteIps		Update the VPC private access whitelist for an instance.
  elasticsearch:ModifyWhiteIps		Update the access whitelist for a specific instance.
  elasticsearch:UpdateAdminPassword		Update the password for the elastic account of a specific instance.
  elasticsearch:OpenHttps		Enable the HTTPS protocol.
  elasticsearch:CloseHttps		Disable the HTTPS protocol.
  elasticsearch:AddConnectableCluster		Configure network intercommunication for an instance.
  elasticsearch:DeleteConnectedCluster		Remove an interconnected instance.
  elasticsearch:DescribeConnectableClusters		Get the list of instances that can communicate with the current instance. This does not include instances that are already connected.
  elasticsearch:ListConnectedClusters		Get the list of instances that are already interconnected with the current instance.
  elasticsearch:DeleteVpcEndpoint		Delete an endpoint in the service VPC.
  elasticsearch:ListVpcEndpoints		View the status of endpoints in the service VPC.

• Data backup

  Action	Resource	Action Description
  elasticsearch:CreateSnapshot	acs:elasticsearch:<yourRegionId>:<yourAccountId>:instances/<yourInstanceId>	Manually create a snapshot backup for an instance.
  elasticsearch:AddSnapshotRepo	acs:elasticsearch:<yourRegionId>:<yourAccountId>:instances/*	When you configure a cross-cluster OSS repository, create a reference repository.
  elasticsearch:DeleteSnapshotRepo		Delete a cross-cluster OSS reference repository.
  elasticsearch:ListSnapshotReposByInstanceId		Get the list of cross-cluster OSS repository settings for the current instance.
  elasticsearch:ListAlternativeSnapshotRepos	acs:elasticsearch:<yourRegionId>:<yourAccountId>:snapshotrepository/*	Get the OSS reference repositories that can be added to the current instance.
  elasticsearch:DescribeSnapshotSetting	acs:elasticsearch:<yourRegionId>:<yourAccountId>:instances/<yourInstanceId>	Get the data backup configuration for a specific instance.
  elasticsearch:UpdateSnapshotSetting		Update the data backup configuration for a specific instance.

• Artificial intelligence for IT operations

  Action	Resource	Description
  elasticsearch:OpenDiagnosis	acs:elasticsearch:<yourRegionId>:<yourAccountId>:instances/* acs:elasticsearch:<yourRegionId>:<yourAccountId>:instances/<yourInstanceId>	Enable artificial intelligence for IT operations (AIOps).
  elasticsearch:CloseDiagnosis		Disable AIOps.
  elasticsearch:UpdateDiagnosisSettings		Update AIOps scenario settings.
  elasticsearch:DiagnoseInstance		Run an immediate diagnosis on an instance.
  elasticsearch:ListDiagnoseReport		View historical AIOps reports.
  elasticsearch:ListDiagnoseReportIds		View the IDs of historical AIOps reports.
  elasticsearch:ListDiagnoseIndices		View the diagnostic indexes for health diagnosis in the AIOps module of a specific instance.
  elasticsearch:DescribeDiagnoseReport		Get historical AIOps reports.
  elasticsearch:DescribeDiagnosisSettings		Get AIOps scenario settings.

Kibana

Logstash

• Instance management

  Action	Resource	Action description
  elasticsearch:CreateLogstash	acs:elasticsearch:<yourRegionId>:<yourAccountId>:logstashes/* acs:elasticsearch:<yourRegionId>:<yourAccountId>:logstashes/<yourInstanceId>	Create a Logstash instance.
  elasticsearch:ListLogstash		View the details of all or specific Logstash instances.
  elasticsearch:DescribeLogstash	acs:elasticsearch:<yourRegionId>:<yourAccountId>:logstashes/<yourInstanceId>	Query the details of a specific Logstash instance.
  elasticsearch:UpdateLogstash		Modify some information about a specific Logstash instance, such as the number of nodes, quota, name, and disk size.
  elasticsearch:RenewLogstash		Renew a Logstash instance.
  elasticsearch:RestartLogstash		Restart a specific Logstash instance.
  elasticsearch:EstimatedLogstashRestartTime		Get the estimated restart time for a Logstash instance.
  elasticsearch:UpdateLogstashDescription		Modify the name of a specific Logstash instance.
  elasticsearch:UpdateLogstashChargeType		Convert a pay-as-you-go Logstash instance to a subscription instance.
  elasticsearch:DeleteLogstash		Release a specific pay-as-you-go Logstash instance.
  elasticsearch:CancelLogstashDeletion		Resume a released and frozen Logstash instance.

• Cluster configuration

  Action	Resource	Description
  elasticsearch:UpdateLogstashSettings	acs:elasticsearch:<yourRegionId>:<yourAccountId>:logstashes/<yourInstanceId>	Update the configuration of a specific Logstash instance.
  elasticsearch:ListExtendfiles		View the extension file configuration of a specific Logstash instance.
  elasticsearch:UpdateExtendfiles		Update the extension file configuration of a specific Logstash instance.

• Plugin management

  Action	Resource	Description
  elasticsearch:ListPlugin	acs:elasticsearch:<yourRegionId>:<yourAccountId>:logstashes/<yourInstanceId>	View the list of plugins.
  elasticsearch:InstallSystemPlugin		Install a built-in system plugin.
  elasticsearch:UninstallSystemPlugin		Uninstall a built-in system plugin.

• Cluster monitoring and log query

  Action	Resource	Description
  elasticsearch:ListAvailableEsInstanceIds	acs:elasticsearch:<yourRegionId>:<yourAccountId>:logstashes/<yourInstanceId>	When you configure X-Pack monitoring for a Logstash instance, view the list of available Elasticsearch instances that support X-Pack monitoring.
  elasticsearch:ValidateConnection		In the monitoring and alerting configuration of a Logstash instance, verify the connectivity to the Elasticsearch instance that provides X-Pack monitoring.
  elasticsearch:UpdateXpackMonitorConfig		Update the X-Pack monitoring and alerting configuration for a Logstash instance.
  elasticsearch:DescribeXpackMonitorConfig		Get the X-Pack monitoring configuration for a Logstash instance.
  elasticsearch:ListLogstashLog		View the logs of a Logstash instance.

• Change task management

  Action	Resource	Action Description
  elasticsearch:InterruptLogstashTask	acs:elasticsearch:<yourRegionId>:<yourAccountId>:logstashes/<yourInstanceId>	Interrupt an instance change task.
  elasticsearch:ResumeLogstashTask		Resume an interrupted instance change task.

• Pipeline management

  Action	Resource	Description
  elasticsearch:CreatePipelines	acs:elasticsearch:<yourRegionId>:<yourAccountId>:logstashes/<yourInstanceId>	Create a pipeline.
  elasticsearch:ListPipeline		View the list of pipelines.
  elasticsearch:DescribePipeline		View a pipeline configuration.
  elasticsearch:UpdatePipelines		Update a pipeline configuration.
  elasticsearch:RunPipelines		Immediately deploy a pipeline.
  elasticsearch:StopPipelines		Stop a running pipeline.
  elasticsearch:UpdatePipelineManagementConfig		Update the pipeline management method.
  elasticsearch:DescribePipelineManagementConfig		Get the pipeline management configuration.
  elasticsearch:ListPipelineIds		When you configure Kibana pipeline management, test the connectivity between Logstash and Kibana, and get the list of pipeline IDs created on the target Kibana.
  elasticsearch:DeletePipelines		Delete a pipeline.

Beats

Access control

Underlying Cloud Monitor

Purchase page VPC and vSwitch

Parameter descriptions