You can use resource groups, tags, or ARNs in RAM to restrict a RAM user to managing only specific ECS instances.
Use resource groups (recommended)
A resource group is a feature on Alibaba Cloud for managing resources in groups. You can create a resource group, add specific ECS instances to it, and then grant a RAM user permissions scoped to that resource group. The RAM user can then manage only the ECS instances within the assigned group. This method supports system policies for simpler implementation and custom policies for fine-grained control. It is also highly scalable: to grant access to new resources, simply add them to the resource group without re-authorization.
For detailed instructions, see Control access to ECS instances for a RAM user by using resource groups.
After you grant permissions with this method, the RAM user must select the corresponding resource group in the ECS console to view the authorized ECS instances. If no resource group is selected, no ECS instances are displayed.
Use tags
A tag is an identifier for cloud resources that helps you categorize, search for, and aggregate them. You can attach a tag to an ECS instance and then create a custom policy to control a RAM user's access based on that tag. This method does not support system policies — you must specify tags within the Condition element of a custom policy. It offers flexibility and fine-grained control, but requires knowledge of custom policy creation.
For detailed instructions, see Manage specified ECS instances by using tags.
After you grant permissions with this method, the RAM user must select the corresponding tags in the ECS console to view the authorized ECS instances. If no tags are selected, no ECS instances are displayed.
Use ARNs
You can grant a RAM user permissions to manage specific ECS instances by specifying the ARN for each instance in a policy. This method supports both system and custom policies. This approach requires you to authorize each RAM user individually, making it best suited for simple use cases with a small number of RAM users and ECS instances.
For detailed instructions, see Manage ECS permissions by using RAM.
After you grant permissions with this method, the RAM user can see all ECS instances under the Alibaba Cloud account but can manage only the authorized instances.
FAQ
A RAM user is granted management permissions for ECS (through the AliyunECSFullAccess system policy or a custom policy where Action is ecs:*) and can manage ECS instances, but cannot remotely connect to an ECS instance by using Workbench. What should I do?
After you grant a RAM user management permissions for ECS, the user can remotely connect to ECS instances only by using VNC. To enable Workbench connections, add a permission statement where Action is ecs-workbench:* to the custom policy. For more information, see Create a custom policy.
Related documents
These methods also apply to other resources beyond ECS instances. Before you proceed, ensure the target resource supports the intended authorization method.
-
Cloud services that support authorization by resource group: Services that work with Resource Group.
-
Services that support tag-based authorization: Log on to the Resource Management console. On the Resource Types Supported by Tag tab, view the resource types that have Support in their Tag RAM Support column.
-
Services that support RAM user-level authorization: Services that work with RAM.