Create a Team

Teams and resource ownership

The relationship is as follows:

Alibaba Cloud UID
└── ResourceGroupID
    └── Team (Team ID, subscription plan)
        ├── API key
        ├── Template
        ├── Sandbox
        └── Volume

Resource groups handle resource grouping and RAM authorization within an Alibaba Cloud account. Teams provide a finer-grained workspace inside a resource group, used to isolate different businesses, projects, or environments.

• Resource ownership: API keys, templates, sandboxes, and volumes all belong to a specific Team, and inherit that Team's resource group and subscription plan.

• Resource isolation: A resource group can contain multiple Teams. Resources in different Teams are isolated from each other and cannot be used across Teams.

• Access entry: The console first filters Teams by resource group, then lists the resources under the selected Team. When you use the SDK, the API key determines the current Team.

• Permission control: RAM users can be granted Team management permissions at the account or resource group scope, and permissions can be further restricted to specific Teams. A RAM user can only view and operate the Teams and resources within the granted scope.

Resource groups and Teams form a two-level hierarchy and cannot replace each other. Typically, plan resource groups by organization or permission boundary first, and then divide Teams by business, project, or environment. For example, create a production Team and a testing Team under the same resource group.

RAM authorization

On top of resource group authorization, you can further restrict a RAM user's permissions to specific Teams. Examples:

• Isolate production and testing environments: Create a production Team and a testing Team under the same resource group. Production operators manage only the production Team, while developers use only the testing Team.

• Isolate different projects: Use a dedicated Team per project. Grant project members access only to their Team so that they cannot reach resources in other projects.

• Limit the scope of external collaboration: Create a dedicated Team for external partners and grant access only to that Team, so they cannot view or operate internal Teams.

• Set up read-only auditing: Grant auditors read-only permissions on specific Teams. They can view resources but cannot create, modify, or delete them.

When you apply precise authorization, grant only the permissions required for the target Team and its sub-resources based on actual responsibilities. Do not grant access to all Teams under the account when it is not needed. For RAM policy configuration and Team-level Resource examples, see Configure RAM User Permissions.

Prerequisites

• Function Compute and FC Agent Sandbox are activated.

• Your Alibaba Cloud account or RAM user has permission to manage Teams.

• If you need a custom resource group, the resource group has been created and the corresponding RAM authorization is in place.

Create a Team

Get the Team ID

Open the Team selector, click Manage Team, and view or copy the Team ID from the Team list.

The Team ID is the stable identifier of a Team. It is mainly used in the following scenarios:

• Creating, querying, or deleting volumes through the FCSandbox POP API.

• Configuring Team-level CPU and memory quotas.

• Troubleshooting resource ownership for API keys, sandboxes, templates, or volumes.

For day-to-day sandbox creation with the E2B SDK, you only need to pass the API key bound to the Team. The Team ID is not required.

Next steps

1. Create an Create an API Key for the Team.

2. Use the API key to create a template or sandbox through the E2B SDK.

3. If you need persistent storage, create a volume for the Team:

   • Create an OSS Volume

   • Create an AgenticFS Volume

FAQ