If you have purchased Alibaba Cloud Elasticsearch instances and multiple RAM users in your organization, such as operations engineers, developers, or data analysts, need to use these instances, you can create a policy that allows specific users to use only specific features. This improves the security and availability of your system. You can also create multiple user groups and attach different policies to them to manage user permissions in batches.
Policy description
Resource Access Management (RAM) is a service that Alibaba Cloud provides to control access to your resources. For more information, see What is RAM.
Policies are divided into system policies and custom policies:
-
System policies
System policy name
Description
AliyunElasticsearchReadOnlyAccess
Grants read-only access to Alibaba Cloud Elasticsearch or Logstash. This policy is suitable for read-only users.
AliyunElasticsearchFullAccess
Grants the permissions to manage Alibaba Cloud Elasticsearch, Logstash, or Beats. This policy is suitable for administrators.
-
Custom policies
If the system policies do not meet your requirements, create a custom policy that meets your requirements. For more information, see Create a custom policy.
Prerequisites
A RAM user is created. For more information, see Create a RAM user.
Procedure
-
Log on to the RAM console as a RAM administrator.
-
In the left-side navigation pane, choose .
-
On the Users page, find the RAM user that you want to manage and click Add Permissions in the Actions column.
You can also select multiple RAM users and click Add Permissions below the user list to grant permissions to the RAM users at a time.
-
In the Grant Permission panel, add permissions to the RAM user.
-
Select a resource scope.
-
Account level: The permissions take effect within the current Alibaba Cloud account.
-
Resource group level: The permissions take effect within the specified resource group.
Important
Authorization at the resource group level takes effect only if the cloud service and the resource type support resource groups. For more information, see Services that work with Resource Group. For an example of resource group authorization, see Control RAM user access to specific ECS instances.
-
-
Select a principal.
A principal is the RAM user to which you want to add permissions. The system automatically selects the current RAM user.
-
Select policies.
A policy is a set of access permissions. Policies are divided into the following two types. You can select multiple policies at a time.
-
System policy: created by Alibaba Cloud. Alibaba Cloud maintains the versions of system policies. You can only use system policies and cannot modify them. For more information, see Services that support RAM.
Note
The system automatically identifies high-risk system policies, such as AdministratorAccess and AliyunRAMFullAccess. When you grant permissions, avoid granting unnecessary high-risk policies.
-
Custom policy: managed by users. You maintain the versions of custom policies. You can create, update, and delete custom policies. For more information, see Create a custom policy.
-
-
Click Grant permissions.
-
-
Click Close.
The permissions take effect immediately after the authorization is complete. You can log on to the Alibaba Cloud Elasticsearch console as the RAM user to verify that the permissions are granted.
Note-
If a RAM user no longer requires the granted permissions, you can remove the permissions. For more information, see Revoke permissions from a RAM user.
-
For more information, see Manage RAM user permissions.
-