Resource Access Management:Control access based on IP address

Step 1: Create the IP-based policy

First, create a custom RAM policy that includes the IP address condition.

1. Log on to the RAM console as a RAM administrator.

2. In the left-side navigation pane, choose Permissions > Policies.

3. Click Create Policy.

4. On the Create Policy page, click the JSON Editor tab.

5. Copy and paste the following policy document into the editor. Replace the example IP addresses with the trusted IP addresses or CIDR blocks for your environment.

{
  "Statement": [
    {
      "Action": "ecs:*",
      "Effect": "Allow",
      "Resource": "*",
      "Condition": {
        "IpAddress": {
          "acs:SourceIp": [
            "192.0.2.0/24",
            "203.0.113.2"
          ]
        }
      }
    }
  ],
  "Version": "1"
}

This policy grants full access (ecs:*) to all ECS resources (Resource: *), but only if the request's source IP matches one of the values specified in the acs:SourceIp condition.

6. Click OK.

7. Enter a Name for your policy (such as Allow-ECS-Access-From-Trusted-IPs) and click OK.

For more information, see Create a custom policy.

Step 2: Create a RAM user

Next, create a RAM user who will be subject to this IP restriction.

1. In the left-side navigation pane, choose Identities > Users.

2. Click Create User.

3. Enter a username and select an access mode (such as Console Access). Follow the prompts to complete user creation. For more information, see Create a RAM user.

Step 3: Attach the policy and verify access

Finally, attach the policy to the RAM user and test that the restriction works as expected.

1. On the Users page, find the user you just created and click Attach Policy in the Actions column.

2. On the Attach Policy panel, find and select the IP-based policy you created in Step 1 (such as Allow-ECS-Access-From-Trusted-IPs).

3. Click OK, then click Close.

4. Verify the policy:

   • Log on to the Alibaba Cloud Management Console as the new RAM user from a computer with an IP address that is on the allowed list (such as 192.0.2.10). Attempt to view your ECS instances. The request should succeed.

   • Log off, and then log on again as the same RAM user from a computer with an IP address that is not on the allowed list. Attempt to view your ECS instances. The request should be denied with a "permission denied" error.

For more information, see Grant permissions to a RAM user.