This topic describes the types of Elasticsearch resources that can be authorized. You can grant different permissions to different users.

Resource types and ARNs

The following table lists the resource types supported by Elasticsearch and relevant Alibaba Cloud Resource Names (ARNs).
Resource type ARN
instances acs:elasticsearch:$regionId:$accountId:instances/*
instances acs:elasticsearch:$regionId:$accountId:instances/$instanceId
vpc acs:elasticsearch:$regionId:$accountId:vpc/*
vswitch acs:elasticsearch:$regionId:$accountId:vswitch/*
tags acs:elasticsearch:$regionId:$accountId:tags/*
  • $regionId: The region ID of your Elasticsearch cluster. This field can be replaced with an asterisk (*).
  • $accountId: The ID of your Alibaba Cloud account. This field can be replaced with an asterisk (*).
  • $instanceId: The ID of your Elasticsearch cluster. This field can be replaced with an asterisk (*).

For more information about how to grant permissions on Elasticsearch resources, see the examples in Create a custom policy.

Permissions to access Elasticsearch clusters

Note The following ARNs are shortened. For information about their full names, see Resource types and ARNs.
  • Actions on Elasticsearch clusters
    Action Description ARN
    elasticsearch:CreateInstance Creates an Elasticsearch cluster. instances/*
    elasticsearch:ListInstance Queries Elasticsearch clusters. instances/*
    elasticsearch:DescribeInstance Queries the description of an Elasticsearch cluster. instances/* or instances/$instanceId
    elasticsearch:DeleteInstance Deletes an Elasticsearch cluster. instances/* or instances/$instanceId
    elasticsearch:RestartInstance Restarts an Elasticsearch cluster. instances/* or instances/$instanceId
    elasticsearch:UpdateInstance Updates an Elasticsearch cluster. instances/* or instances/$instanceId
  • Actions on plug-ins
    Action Description ARN
    elasticsearch:ListPlugin Queries plug-ins. instances/$instanceId
    elasticsearch:InstallSystemPlugin Installs a system plug-in. instances/$instanceId
    elasticsearch:UninstallPlugin Uninstalls a plug-in. instances/$instanceId
  • Actions on networks
    Action Description ARN
    elasticsearch:UpdatePublicNetwork Specifies whether to allow access from public IP addresses. instances/$instanceId
    elasticsearch:UpdatePublicIps Modifies the whitelist of public IP addresses. instances/$instanceId
    elasticsearch:UpdateWhiteIps Modifies the whitelist of private IP addresses. instances/$instanceId
    elasticsearch:UpdateKibanaIps Modifies the Kibana whitelist. instances/$instanceId
  • Actions on Logstash
    Action Description ARN
    elasticsearch:ListPipelineIds Queries Logstash pipelines. instances/$instanceId
  • Actions on dictionaries
    Action Description ARN
    elasticsearch:UpdateDict Modifies the IK analyzer and synonym dictionary. instances/$instanceId

Permissions to access tags

Action Description ARN
elasticsearch:ListTags Queries tags. tags/$instanceId
elasticsearch:CreateTags Creates or updates a tag. tags/$instanceId
elasticsearch:RemoveTags Removes a tag. tags/$instanceId

For more information about how to create a custom policy for tags, see Grant permissions on tags to a RAM user.

Permissions to access CloudMonitor

Note The following ARNs are shortened by using an asterisk (*).
Action Description ARN
cms:ListProductOfActiveAlert Queries services with CloudMonitor activated. *
cms:ListAlarm Queries a specific or all alerting rule settings. *
cms:QueryMetricList Queries the metric data of a specific cluster over a period of time. *

Permissions to query VPCs and VSwitches on the Elasticsearch buy page

Note The following ARNs are shortened. For information about their full names, see Resource types and ARNs.
Action Description ARN
DescribeVpcs Queries VPCs. vpc/*
DescribeVswitches Queries VSwitches. vswitch/*

Permissions to perform intelligent O&M

Note The following ARNs are shortened. For information about their full names, see Resource types and ARNs.
Action Description ARN
elasticsearch:OpenDiagnosis Enables an intelligent health diagnostic. instances/* or instances/$instanceId
elasticsearch:CloseDiagnosis Disables an intelligent health diagnostic. instances/* or instances/$instanceId
elasticsearch:UpdateDiagnosisSettings Updates health diagnostic settings. instances/* or instances/$instanceId
elasticsearch:DescribeDiagnosisSettings Queries health diagnostic settings. instances/* or instances/$instanceId
elasticsearch:ListInstanceIndices Queries cluster indexes. instances/* or instances/$instanceId
elasticsearch:DiagnoseInstance Starts an intelligent health diagnostic. instances/* or instances/$instanceId
elasticsearch:ListDiagnoseReportIds Queries diagnostic report IDs. instances/* or instances/$instanceId
elasticsearch:DescribeDiagnoseReport Queries the details of a diagnostic report. instances/* or instances/$instanceId
elasticsearch:ListDiagnoseReport Queries diagnostic reports. instances/* or instances/$instanceId

Supported regions

China/District Region Region ID
China China (Shanghai) cn-shanghai
China (Shenzhen) cn-shenzhen
China (Qingdao) cn-qingdao
China (Zhangjiakou-Beijing Winter Olympic) cn-zhangjiakou
China (Beijing) cn-beijing
China (Hangzhou) cn-hangzhou
China (Hong Kong) cn-hongkong
Asia Pacific Singapore ap-southeast-1
Malaysia (Kuala Lumpur) ap-southeast-3
Japan (Tokyo) ap-northeast-1
Australia (Sydney) ap-southeast-2
Indonesia (Jakarta) ap-southeast-5
Europe & Americas US (Silicon Valley) us-west-1
Germany (Frankfurt) eu-central-1
US (Virginia) us-east-1
Middle East & India India (Mumbai) ap-south-1