Learn key terms used in Resource Management, including resource directories, resource groups, resource sharing, and tags.
Resource Directory
|
Term |
Description |
|
management account |
An Alibaba Cloud account that has passed enterprise verification and enabled a resource directory. The management account is the super administrator with full permissions over the resource directory, all folders, and all members. Each resource directory has exactly one management account. Security best practices:
Note
A management account does not belong to the resource directory and is not subject to its access control policies. |
|
Root folder |
The top-level folder in a resource directory. All other folders are organized in a hierarchy beneath it. |
|
folder |
An organizational unit that can represent a branch, line of business, or project. Folders can contain members and subfolders, forming a tree structure. |
|
member |
An account within a resource directory. Members are either resource accounts (created in the directory to isolate project or application resources) or cloud accounts (existing Alibaba Cloud accounts invited to join).
|
|
RDPath |
The path that identifies the location of a folder or member within a resource directory. An RDPath consists of the resource directory ID, all parent folder IDs, and the entity ID. Formats:
To view an RDPath, see View the basic information of a folder or View the detailed information of a member. |
|
access control policy |
Defines permission boundaries for folders or members in a resource directory. Access control policies do not grant permissions — they only restrict what permissions RAM can grant. You must still use RAM to grant the required permissions to member accounts. For more information about access control policies, see Overview. |
|
trusted service |
An Alibaba Cloud service integrated with Resource Directory that can access the directory's structure and member information. Use the management account or a delegated administrator account to manage the trusted service across your organization. For example, Cloud Config integration lets you view resources of all members, their configuration history, and compliance statuses across the directory. For more information about trusted services, see Overview of trusted services. |
|
delegated administrator account |
A member designated by the management account to manage a specific trusted service on behalf of the organization. The delegated administrator can access resource directory information (structure and members) within the trusted service and manage related business. This separates organization management (handled by the management account) from service-specific management, improving security. For information about how to add or remove a delegated administrator account, see Manage delegated administrator accounts. |
Resource Group
|
Term |
Description |
|
resource group |
Resource groups let you organize Alibaba Cloud resources by project or application, simplifying permission management across your account. |
Resource Sharing
|
Term |
Description |
|
resource share |
A resource share is an instance of the Resource Sharing service. It is also a resource and has a unique ID and an Alibaba Cloud Resource Name (ARN). A resource share consists of a resource owner, principals, and shared resources. |
|
resource owner |
A resource owner initiates resource sharing and owns shared resources. |
|
principal |
A principal is invited to use the resources of resource owners and has specific operation permissions on the shared resources. Note
The operation permissions of each principal on the shared resources are determined by the Alibaba Cloud service to which the resources belong. For example, the operation permissions of principals on the shared vSwitches in a VPC are determined based on the VPC service. For more information, see Permissions related to VPC sharing. |
|
shared resource |
A shared resource is a resource of an Alibaba Cloud service. For more information about the types of resources that can be shared, see Supported services for Resource Sharing. |
|
resource sharing |
Resource sharing allows you to share your resources with all members in your resource directory, all members in a specific folder in your resource directory, or a specific member in your resource directory. For more information, see Enable resource sharing within a resource directory. |
Tag
|
Term |
Description |
|
key-value pair |
A tag is a key-value pair. |
|
predefined tag |
A predefined tag is created in advance and available across all regions. Predefined tags persist even when not attached to resources. Create them during tag planning and attach them during implementation. For more information, see Create a tag. |
|
system tag |
System tags are read-only tags that represent standard data relationships. For example, when a cluster is associated with an Elastic Compute Service (ECS) instance, the system adds the cluster ID as a system tag to help determine the instance's attribution. For more information, see View system tags and resources. |
|
createdby tag |
A createdby tag is a system tag automatically added to resources to identify resource creators, analyze costs and bills, and manage resource costs efficiently. For more information, see Createdby tags. |
|
tag policy |
Tag policies define required tags for resources to standardize tagging. Compliant tags improve cost allocation, access control, and automated O&M efficiency. Two modes are supported: single-account and resource directory. For more information, see Overview of tag policies. |