DocsICP FilingConsole
Documentation
Home Page Resource Access Management Use Cases Tutorials Fine-grained authorization with resource groups and tags Control RAM user access to specific ECS instances

Use resource groups to restrict RAM users to managing specific ECS instances

Updated at:
Copy as MD
Product
My Favorites

Combine Alibaba Cloud RAM with resource groups to restrict a RAM user to managing only specific ECS instances.

Procedure

This example grants RAM user Alice permission to manage only ECS instance i-001 by adding the instance to a resource group and scoping permissions to that group.

Note

The ECS instance continues to operate normally during the authorization process.

Complete these steps as an account administrator.

If you already have a RAM user and a resource group, you can skip Step 1 and start from Step 2 to add the ECS instance to the resource group and grant permissions to the RAM user.

  1. In the RAM console, create a RAM user named Alice.

    For more information, see Create a RAM user.

  2. In the Resource Management console, create a resource group named ECS-Admin.

    For more information, see Create a resource group.

  3. In the Resource Management console, add the ECS instance i-001 to the resource group ECS-Admin.

    Add an ECS instance to a resource group in either of the following ways:

    To add multiple ECS instances to the same resource group, go to the resource search page in the Resource Center console, select the target instances, and then click Transfer Resource Group to move them in a single operation. For more information, see Transfer resources across resource groups.

  4. In the RAM console, grant permissions to the RAM user Alice.

    Set Authorized Scope to ECS-Admin, set Principal to Alice, and select the AliyunECSFullAccess system policy. For more information, see Grant permissions to a RAM user.

    Note

    As a security best practice, follow the principle of least privilege. Create a custom policy that grants only the required permissions to minimize the risk of excessive access.

Verify the results

  1. Log on to the ECS console as the RAM user Alice.

    For more information, see Log on to the Alibaba Cloud Management Console as a RAM user.

  2. In the left-side navigation pane, choose Instances & Images > Instance.

  3. In the upper-left corner of the top menu bar, select the region where your instance is located.

  4. In the resource group drop-down list in the upper-left corner of the top menu bar, select the resource group ECS-Admin.

    Important

    The RAM user must select the correct resource group to view instances in that group. Otherwise, the instance list appears empty.

  5. In the instance list, verify that you can manage the ECS instance i-001.

FAQ

Why does an insufficient tag permissions error appear after I select a resource group?

If a RAM user is granted only the AliyunECSFullAccess system policy, an error message that indicates insufficient tag permissions may appear after the RAM user selects a resource group on the instance list page of the ECS console. The ECS console calls the Alibaba Cloud Tag Service API operation to query global tag information, but AliyunECSFullAccess contains only ECS permissions (ecs:*) and does not contain the tag:ListTagResources permission that Tag Service requires.

To resolve this issue, the account administrator must grant the RAM user one of the following permissions:

  • The AliyunResourceDirectoryReadOnlyAccess system policy.

  • A custom policy that grants only the tag:ListTagResources operation permission. Attach the custom policy to the RAM user or to the user group to which the RAM user belongs.

After either authorization is complete, the error message no longer appears, and the RAM user can continue to verify and manage the ECS instances in the resource group.

Related topics

  • Move resources associated with an ECS instance to the same resource group, either manually or by using the automatic resource transfer feature of Resource Management. Automatic transfer currently supports only cloud disks, elastic network interfaces (ENIs), and Elastic IP addresses (EIPs). For more information, see Transfer associated resources with a primary resource.

  • To provision the resources and configure the permissions with Terraform, run the sample code in Terraform Explorer. Terraform Explorer

Previous：Manage permissions with resource groupsNext：Use tags to control access to ECS instances