Elastic Container Instance:Grant permissions to a RAM user

Prerequisites

A RAM user is created. For information about how to create a RAM user, see Create a RAM user.

Permission description

You can attach a policy to a RAM user to grant specific permissions to the RAM user. The following table describes the permission policies that are related to Elastic Container Instance resources:

Procedure

1. Log on to the RAM console by using your Alibaba Cloud account.

2. Create a custom policy.

   1. In the left-side navigation pane, choose Permissions > Policies.

   2. On the Policies page, click Create Policy.

   3. Click the JSON tab, copy the following script to the code editor, and then click Next to edit policy information.

      {
          "Statement": [
              {
                  "Action": "ram:ListRoles",
                  "Effect": "Allow",
                  "Resource": "*"
              },
              {
                  "Action": "nas:DescribeFileSystems",
                  "Effect": "Allow",
                  "Resource": "*"
              },
              {
                  "Action": "oss:ListBuckets",
                  "Effect": "Allow",
                  "Resource": "*"
              },
              {
                  "Action": "vpc:DescribeCommonBandwidthPackages",
                  "Effect": "Allow",
                  "Resource": "*"
              },
              {
                  "Action": [
                      "cr:GetRepoList",
                      "cr:GetRepoTags",
                      "cr:GetImageManifest",
                      "cr:SearchRepo"
                  ],
                  "Effect": "Allow",
                  "Resource": "*"
              }
          ],
          "Version": "1"
      }

   4. Enter a policy name in the Name field and click OK.

3. Grant permissions to the RAM user based on your needs.

   1. In the left-side navigation pane, choose Identities > Users.

   2. Find the RAM user to which you want to grant permissions and click Add Permissions in the Actions column.

   3. In the Add Permissions panel, configure parameters to attach policies to the RAM user.

      The following table describes the parameters.

      Parameter	Description
      Authorized Scope	The authorization scope. Alibaba Cloud Account: Permissions take effect on the current Alibaba Cloud account. Specific Resource Group: Permissions take effect on a specific resource group.
      Principal	The RAM user to which you want to grant permissions. The selected RAM user is automatically entered in the Principal field. You can also specify another RAM user.
      Select Policy	The policies that you want to attach to the RAM user. Select policies that fit your needs. If you want the RAM user only to view Elastic Container Instance resources, select the AliyunECIReadOnlyAccess system policy. If you want the RAM user to manage Elastic Container Instance resources by calling API operations, select the AliyunECIFullAccess system policy. If you want the RAM user to manage Elastic Container Instance resources by using the Elastic Container Instance console, select the AliyunECIFullAccess system policy and the custom policy that you created in Step 2.

   4. Click OK.

   5. Confirm the authorization scope and the policies and click Complete.

References

If you want to control the permissions of RAM users on Elastic Container Instance resources, you can use resource groups and tags to manage the RAM users by group and by permission. For more information, see:

• Use resource groups to control the permissions of a RAM user

• Use tags to authenticate a RAM user