All Products
Search

This Product

    Container Service for Kubernetes:Use tags for fine-grained access control

    Document Center

    Container Service for Kubernetes:Use tags for fine-grained access control

    Last Updated:Jun 24, 2026

    Tags help you identify and classify cloud resources. Use RAM permission policies to manage user identity and control access to cloud resources. Add tags to classify ACK cluster resources, match them to RAM permission policies for fine-grained access control, and grant different users access to different clusters.

    image

    Procedure

    Create a custom policy requiring specific tags for ACK cluster access, then attach the policy to a RAM user.

    1. Create a RAM user.

    2. Log on to the RAM console with your Alibaba Cloud account and create a custom policy. Use the Condition element to set tag conditions on cloud resources.

      Note

      An Alibaba Cloud account has full permissions on all resources. You can also grant AdministratorAccess to a RAM user to make it an account administrator who manages all resources. See Create a RAM user as an account administrator.

      ACK supports the following condition keys:

      Condition key

      Description

      acs:RequestTag

      Requires requests to include specific tags.

      If the API request lacks a tag parameter, acs:RequestTag conditions cause authorization to fail.

      acs:ResourceTag

      Requires resources to have specific tags.

      If the API request lacks a resource ID parameter, acs:ResourceTag conditions cause authorization to fail.

      See Use cases for policy examples.

    3. Attach the custom policy to the RAM user. See Manage the permissions of a RAM user. When creating the policy, check Resource types that support tags and Actions that do not support tag-based authorization.

      Note

      Before granting permissions to a RAM user, review their existing policies to avoid duplicates or conflicts.

    Use cases

    Adapt these custom policy templates based on the principle of least privilege.

    Permission policy

    Description

    Result

    		 
    {
    "Version": "1",
    "Statement": [{
        "Effect": "Allow",
        "Action": "cs:CreateCluster",
        "Resource": "*",
        "Condition": {
            "StringEquals": {
                "acs:RequestTag/test": "foo"
            }
        }
    }]
}

    Allows creating only clusters with the test:foo tag.

    • If you add the test:foo tag in Advanced Options when creating a cluster, the operation succeeds.

    • If you create a cluster without the test:foo tag, the operation fails. Error code: StatusForbidden. Error message: RAM policy Forbidden for action cs:CreateCluster. Contact an administrator to grant permissions.

    		 
    {
    "Version": "1",
    "Statement": [{
        "Effect": "Allow",
        "Action": [
            "cs:DescribeClustersV1",
            "cs:GetClusters"
        ],
        "Resource": "*",
        "Condition": {
            "StringEquals": {
                "acs:ResourceTag/test": "foo"
            }
        }
    }]
}

    Allows viewing only clusters with the test:foo tag.

    1. Log on to the ACK console. In the left navigation pane, click Clusters.

    2. View clusters in the list.

      • If no clusters have the test:foo tag, the list is empty.

      • After adding the test:foo tag to a cluster, it appears in the list.

    		 
    {
    "Version": "1",
    "Statement": [{
        "Effect": "Deny",
        "Action": [
            "cs:UntagResources",
            "cs:ListTagResources",
            "cs:TagResources",
            "cs:ModifyClusterTags"
        ],
        "Resource": "*"
    }]
}

    Prevents the user from modifying tags.

    If you attempt to modify a tag, the operation fails.

    Error code: StatusForbidden. Error message: RAM policy Forbidden for action cs:ModifyClusterTags. Contact an administrator to grant permissions. The dialog box also links to Overview of access control for Kubernetes clusters.

    References

    Resource types that support tags

    ACK supports tag-based authorization only for the following resource types.

    Service name

    Service code

    Resource type

    ACK

    cs

    cluster: cluster

    Actions that do not support tag-based authorization

    The following ACK actions do not support tag-based authorization. See Custom policy examples.

    Action

    Description

    cs:OpenAckService

    Enable ACK

    cs:ListOperationPlans

    Query the automatic O&M schedules of a cluster

    cs:CancelOperationPlan

    Cancel a pending automatic O&M plan

    cs:DescribeTaskInfo

    Query the details of a task

    cs:PauseTask

    Pause a task

    cs:CancelTask

    Cancel a task

    cs:ResumeTask

    Resume a task

    cs:CreateKubernetesTrigger

    Create an application trigger

    cs:DeleteTriggerHook

    Delete a trigger

    cs:CreateTemplate

    Create an orchestration template

    cs:DeleteTemplate

    Delete an orchestration template

    cs:UpdateTemplate

    Update an orchestration template

    cs:DescribeTemplates

    Query all orchestration templates

    cs:DescribeTemplateAttribute

    Query the details of an orchestration template

    cs:ListUserKubeConfigStates

    Query the KubeConfig status list of all clusters that belong to a specific user

    cs:ListAddons

    Query available add-ons

    cs:DescribeAddon

    Query a specific add-on

    cs:DescribeAddons

    Query all add-ons

    cs:DescribeEvents

    Query event details

    cs:DescribeEventsForRegion

    Query events in a specific region

    cs:DescribeKubernetesVersionMetadata

    Query the details of a Kubernetes version

    cs:CheckServiceRole

    Check whether a specific service role is assigned

    cs:DescribePatternTypes

    Query instance types

    cs:CheckUserClustersActivity

    Check the active status of a user in a specific cluster

    cs:CreateSessionMessage

    Create an ACK AI Assistant session

    cs:UpdateMessageFeedback

    Update ACK AI Assistant message feedback

    cs:DescribeKubeConfigManagementTaskList

    List the tasks related to kubeconfig files

    cs:ListHaveKubeconfigDeletedAccounts

    Query the users whose accounts have deleted RAM users or RAM roles, but whose kubeconfig files remain active.

    cs:ListKubeConfigRecycle

    List the kubeconfig files in the recycle bin within the current Alibaba Cloud account

    cs:RestoreKubeConfigRecycleItem

    Restore a deleted kubeconfig file from the recycle bin

    cs:RestoreMultiKubeConfigRecycleItems

    Batch restore deleted kubeconfig files from the recycle bin

    cs:DeleteKubeConfigRecycleItem

    Permanently delete a kubeconfig file from the recycle bin

    cs:DescribeKubernetesVersionMetadata

    Query the details of a Kubernetes version

    cs:DescribePolicies

    Query the policy list

    cs:DescribePolicyDetails

    Query the details of a specific policy

    cs:DescribeUserInstances

    Obtain the node list required to add an existing node

    cs:DescribeUserPermission

    Query the permissions of a RAM user or a RAM role

    cs:UpdateUserPermissions

    Update the Role-Based Access Control (RBAC) permissions of a specific RAM user or RAM role

    cs:CleanUserPermissions

    Clear the certificate of a specific user and the related RBAC permissions

    cs:QueryAlertContact

    Query an alert contact

    cs:AddOrUpdateAlertContact

    Update an alert contact

    cs:DeleteAlertContact

    Delete an alert contact

    cs:QueryAlertContactGroup

    Query alert contact groups

    cs:AddOrUpdateAlertContactGroup

    Update an alert contact group

    cs:DeleteAlertContactGroup

    Delete an alert contact group

    cs:DescribeUserQuota

    Query quota information

    cs:ListOperationPlans

    Query the list of auto O&M task plans

    cs:CancelOperationPlan

    Cancel auto O&M task plans

    cs:DescribeTasks

    Query the task list

    Custom policy examples

    Important

    A RAM user or a RAM role that has account-level permissions can perform operations on resources within the entire account. Make sure that the permissions granted to the RAM user or RAM role meet your expectations and follow the principle of least privilege.

    Policies with tag conditions do not apply to actions that do not support tag-based authorization. Create a separate policy for these actions with the resource scope set toAccount and no tag conditions.

    Adjust these examples as needed.

    • The Action list includes all read-only actions that do not support tag-based authorization.

      {
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "cs:DescribeAddon",
        "cs:DescribeAddons",
        "cs:DescribeEvents",
        "cs:DescribeEventsForRegion",
        "cs:DescribeKubeConfigManagementTaskList",
        "cs:DescribeKubernetesVersionMetadata",
        "cs:DescribePatternTypes",
        "cs:DescribePolicies",
        "cs:DescribePolicyDetails",
        "cs:DescribeTaskInfo",
        "cs:DescribeTemplateAttribute",
        "cs:DescribeTemplates",
        "cs:DescribeUserInstances",
        "cs:DescribeUserPermission",
        "cs:ListAddons",
        "cs:ListHaveKubeconfigDeletedAccounts",
        "cs:ListKubeConfigRecycle",
        "cs:ListOperationPlans",
        "cs:ListUserKubeConfigStates",
        "cs:QueryAlertContact",
        "cs:QueryAlertContactGroup",
        "cs:CheckServiceRole",
        "cs:DescribeTasks",
        "cs:DescribeUserQuota",
        "cs:ListOperationPlans",
        "cs:CheckUserClustersActivity"
      ],
      "Resource": "*"
    }
  ]
}

    • The Action list includes all actions that do not support tag-based authorization.

      {
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "cs:AddOrUpdateAlertContact",
        "cs:AddOrUpdateAlertContactGroup",
        "cs:CancelOperationPlan",
        "cs:CancelTask",
        "cs:CheckServiceRole",
        "cs:CheckUserClustersActivity",
        "cs:CleanUserPermissions",
        "cs:CreateKubernetesTrigger",
        "cs:CreateSessionMessage",
        "cs:CreateTemplate",
        "cs:DeleteAlertContact",
        "cs:DeleteAlertContactGroup",
        "cs:DeleteKubeConfigRecycleItem",
        "cs:DeleteTemplate",
        "cs:DeleteTriggerHook",
        "cs:DescribeAddon",
        "cs:DescribeAddons",
        "cs:DescribeEvents",
        "cs:DescribeEventsForRegion",
        "cs:DescribeKubeConfigManagementTaskList",
        "cs:DescribeKubernetesVersionMetadata",
        "cs:DescribePatternTypes",
        "cs:DescribePolicies",
        "cs:DescribePolicyDetails",
        "cs:DescribeTaskInfo",
        "cs:DescribeTemplateAttribute",
        "cs:DescribeTemplates",
        "cs:DescribeUserInstances",
        "cs:DescribeUserPermission",
        "cs:ListAddons",
        "cs:ListHaveKubeconfigDeletedAccounts",
        "cs:ListKubeConfigRecycle",
        "cs:ListOperationPlans",
        "cs:ListUserKubeConfigStates",
        "cs:OpenAckService",
        "cs:DescribeTasks",
        "cs:PauseTask",
        "cs:QueryAlertContact",
        "cs:QueryAlertContactGroup",
        "cs:RestoreKubeConfigRecycleItem",
        "cs:RestoreMultiKubeConfigRecycleItems",
        "cs:ResumeTask",
        "cs:UpdateMessageFeedback",
        "cs:DescribeUserQuota",
        "cs:ListOperationPlans",
        "cs:CancelOperationPlan",
        "cs:UpdateTemplate",
        "cs:UpdateUserPermissions"
      ],
      "Resource": "*"
    }
  ]
}