Container Service for Kubernetes:Use labels to implement fine-grained access control

Step 1: Create a RAM user

Create a RAM user for the person or service that needs restricted cluster access.

Step 2: Create a custom permission policy with tag conditions

1. Log on to the RAM console with your Alibaba Cloud account.

2. Create a custom permission policy. For instructions, see Create custom policies.

3. In the policy, use the Condition element to set tag conditions on your cloud resources. Refer to the Examples section for policy templates, and Actions that do not support tag-based authorization for actions that require separate policies.

   An Alibaba Cloud account has full administrative permissions over all resources in the account. Alternatively, you can create a RAM user and grant the AdministratorAccess permission to designate it as an account administrator. For more information, see Create a RAM user as an account administrator.

Step 3: Attach the policy to the RAM user

Attach the custom permission policy to the RAM user. For instructions, see Grant permissions to a RAM user.

Before granting permissions to an existing RAM user, review their current permission policies to avoid duplicates or conflicts.

Allow cluster creation only with a specific tag

This policy allows creating clusters only when the test:foo tag is included in the creation request.

{
  "Version": "1",
  "Statement": [{
    "Effect": "Allow",
    "Action": "cs:CreateCluster",
    "Resource": "*",
    "Condition": {
      "StringEquals": {
        "acs:RequestTag/test": "foo"
      }
    }
  }]
}

To verify: In the ACK console, create a cluster. In the advanced options section, add the test:foo tag. The cluster is created successfully. Attempt to create another cluster without the tag—the request fails with an authorization error.

Show only tagged clusters in the cluster list

This policy allows a RAM user to list and view only clusters that have the test:foo tag.

{
  "Version": "1",
  "Statement": [{
    "Effect": "Allow",
    "Action": [
      "cs:DescribeClustersV1",
      "cs:GetClusters"
    ],
    "Resource": "*",
    "Condition": {
      "StringEquals": {
        "acs:ResourceTag/test": "foo"
      }
    }
  }]
}

To verify:

1. Log on to the ACK console as the RAM user. In the left navigation pane, click Clusters.

2. If no clusters have the test:foo tag, the list is empty.

3. Add the test:foo tag to a cluster. Refresh the page—the cluster appears in the list.

Prevent users from modifying tags

This policy denies all tag modification actions, ensuring that RAM users cannot remove or alter the tags that control their access.

{
  "Version": "1",
  "Statement": [{
    "Effect": "Deny",
    "Action": [
      "cs:UntagResources",
      "cs:ListTagResources",
      "cs:TagResources",
      "cs:ModifyClusterTags"
    ],
    "Resource": "*"
  }]
}

To verify: As the RAM user, attempt to modify a tag on any cluster. The operation fails with an authorization error.

Resource types that support tags

Tag-based authorization in ACK applies only to the following resource types.

Actions that do not support tag-based authorization

The following actions do not support tag-based authorization. For these actions, tag conditions have no effect. Create a separate custom permission policy, set the resource scope to Account Level, and do not specify tag conditions.

The following two templates cover these actions. Modify them as needed.

The Action list includes all read-only actions that do not support tag-based authorization:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "cs:CheckServiceRole",
        "cs:CheckUserClustersActivity",
        "cs:DescribeAddon",
        "cs:DescribeAddons",
        "cs:DescribeEvents",
        "cs:DescribeEventsForRegion",
        "cs:DescribeKubeConfigManagementTaskList",
        "cs:DescribeKubernetesVersionMetadata",
        "cs:DescribePatternTypes",
        "cs:DescribePolicies",
        "cs:DescribePolicyDetails",
        "cs:DescribeTaskInfo",
        "cs:DescribeTemplateAttribute",
        "cs:DescribeTemplates",
        "cs:DescribeTasks",
        "cs:DescribeUserInstances",
        "cs:DescribeUserPermission",
        "cs:DescribeUserQuota",
        "cs:ListAddons",
        "cs:ListHaveKubeconfigDeletedAccounts",
        "cs:ListKubeConfigRecycle",
        "cs:ListOperationPlans",
        "cs:ListUserKubeConfigStates",
        "cs:QueryAlertContact",
        "cs:QueryAlertContactGroup"
      ],
      "Resource": "*"
    }
  ]
}

The Action list includes all actions (read and write) that do not support tag-based authorization:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "cs:AddOrUpdateAlertContact",
        "cs:AddOrUpdateAlertContactGroup",
        "cs:CancelOperationPlan",
        "cs:CancelTask",
        "cs:CheckServiceRole",
        "cs:CheckUserClustersActivity",
        "cs:CleanUserPermissions",
        "cs:CreateKubernetesTrigger",
        "cs:CreateSessionMessage",
        "cs:CreateTemplate",
        "cs:DeleteAlertContact",
        "cs:DeleteAlertContactGroup",
        "cs:DeleteKubeConfigRecycleItem",
        "cs:DeleteTemplate",
        "cs:DeleteTriggerHook",
        "cs:DescribeAddon",
        "cs:DescribeAddons",
        "cs:DescribeEvents",
        "cs:DescribeEventsForRegion",
        "cs:DescribeKubeConfigManagementTaskList",
        "cs:DescribeKubernetesVersionMetadata",
        "cs:DescribePatternTypes",
        "cs:DescribePolicies",
        "cs:DescribePolicyDetails",
        "cs:DescribeTaskInfo",
        "cs:DescribeTemplateAttribute",
        "cs:DescribeTemplates",
        "cs:DescribeTasks",
        "cs:DescribeUserInstances",
        "cs:DescribeUserPermission",
        "cs:DescribeUserQuota",
        "cs:ListAddons",
        "cs:ListHaveKubeconfigDeletedAccounts",
        "cs:ListKubeConfigRecycle",
        "cs:ListOperationPlans",
        "cs:ListUserKubeConfigStates",
        "cs:OpenAckService",
        "cs:PauseTask",
        "cs:QueryAlertContact",
        "cs:QueryAlertContactGroup",
        "cs:RestoreKubeConfigRecycleItem",
        "cs:RestoreMultiKubeConfigRecycleItems",
        "cs:ResumeTask",
        "cs:UpdateMessageFeedback",
        "cs:UpdateTemplate",
        "cs:UpdateUserPermissions"
      ],
      "Resource": "*"
    }
  ]
}

Full list of actions that do not support tag-based authorization