What are resource groups?
A resource group is a collection of resources for the Internet of Things (IoT) Platform. By organizing resources into groups, you can grant Resource Access Management (RAM) users permissions to view and operate specific IoT Platform resources, such as Enterprise instances. This enables resource isolation among RAM users.
Why use resource groups
You can use Resource Access Management (RAM) to grant RAM users permissions to access IoT Platform resources. However, RAM permissions are global. For example, if you grant a RAM user permission to query instance information, that RAM user can query information about all instances under your Alibaba Cloud account.
However, RAM authorization alone cannot restrict a RAM user to accessing only specific instances or isolate resources among different RAM users. For example, you cannot configure RAM User A to access only Instance 1 and RAM User B to access only Instance 2. To meet these requirements, IoT Platform is integrated with the Resource Management platform. This integration lets you manage resource groups so that RAM users can view and operate only their authorized instance resources.
Permissions that are granted to a RAM user in RAM are global and apply to all resources, including those within a resource group. To achieve resource isolation for RAM users, do not grant permissions directly in RAM. Instead, grant permissions by managing resource groups.
IoT Platform resource isolation
IoT Platform supports resource isolation for RAM users on Enterprise instances using resource groups.
In the Resource Management console, you can create a resource group and then add principals and custom authorization policies to the group. When you purchase an Enterprise instance, you can assign it to a resource group. This way, RAM users can view and operate only the Enterprise instances within their authorized resource groups.