This topic describes how to create, authorize, and bind an instance RAM role in the RAM and ECS consoles.
Prerequisites
- The RAM service is activated. For more information, see Activate RAM.
- The network type of the ECS instance to which you want to bind a RAM role is VPC.
- A RAM user is authorized to use the instance RAM role if you use the RAM user to perform operations in this topic. For more information, see Authorize a RAM user to manage an instance RAM role.
Background information
- A RAM role can be bound to one instance at a time.
- If you want to access the APIs of other Alibaba Cloud services from applications within an ECS instance that is bound with an instance RAM role, you must obtain a temporary authorization token for the instance RAM role by using the instance metadata. For more information, see Obtain a temporary authorization token.
Procedure
Step 1: Create an instance RAM role
Perform the following operations to create an instance RAM role in the RAM console:

Step 2: Authorize the instance RAM role
Perform the following operations to attach a system policy or custom policy to the instance RAM role in the RAM console:
- Log on to the RAM console by using an Alibaba Cloud account.
- (Optional) Create a custom policy if you do not want to use a system policy. For more information, see Implement access control by using RAM.
- In the left-side navigation pane, click RAM Roles.
- In the RAM Role Name column, click the name of the target RAM role.
- On the Permissions tab, click Input and Attach.
- Select System Policy or Custom Policy.
- Enter the policy name.
- Click OK.
- Click Close.
Step 3: Bind the instance RAM role
Perform the following operations to bind the instance RAM role to an ECS instance in the ECS console:
- Log on to the ECS console.
- In the left-side navigation pane, choose .
- In the top navigation bar, select a region.
- Find the ECS instance and choose .
- In the Bind/Unbind RAM Role dialog box, select the created instance RAM role from the RAM Role drop-down list and click OK.
Alternatively, you can select the created instance RAM role from the RAM Role drop-down list in the System Configurations step when you create an ECS instance. For more information, see Create an instance by using the wizard.