Bastionhost:Grant management permissions to a RAM user

Permission types

Bastionhost supports the following permission types. Each type restricts what the RAM user can do in the Bastionhost console.

Prerequisites

Before you begin, ensure that you have:

• A RAM user created within the Alibaba Cloud account that owns the Bastionhost instance.

• (Optional). A virtual multi-factor authentication (MFA) device bound to the RAM user. When an MFA device is bound, Bastionhost verifies the RAM user's identity using the configured MFA settings at each logon.

Grant permissions to a RAM user

1. Log on to the RAM console as a RAM administrator.

2. In the left-side navigation pane, choose Identities > Users.

3. On the Users page, find the RAM user and click Add Permissions in the Actions column. To grant permissions to multiple RAM users at once, select them and click Add Permissions at the bottom of the page.

4. In the Add Permissions panel, configure the following parameters:

   • Resource Scope: Select the scope for the authorization.

     • Account: The authorization takes effect on the current Alibaba Cloud account.

     • ResourceGroup: The permissions apply to a specific resource group.

     Important

     If you select ResourceGroup, make sure the cloud service supports resource groups. See Services that work with Resource Group. For instructions on granting permissions scoped to a resource group, see Use a resource group to grant a RAM user the permissions to manage a specific ECS instance.

   • Principal: The RAM user to grant permissions to. The current RAM user is automatically selected.

   • Policy: Select one or more policies that correspond to the permission types you want to grant.

     Note

     When you create a Bastionhost instance, in addition to the AliyunYundunBastionHostFullAccess permission, you also need the AliyunBSSOrderAccess permission to pay for the instance order. Without these permissions, the instance creation will fail.

     • AliyunYundunBastionHostFullAccess: Provides full permissions to manage Bastionhost.

     • AliyunBSSOrderAccess: Grants permissions to view, pay for, and cancel orders in the User Center.

     The AliyunYundunBastionHostFullAccess policy grants permissions only to manage Bastionhost and view instance details. It does not include the permissions required to pay for orders in the User Center. Therefore, you cannot create a Bastionhost instance with only this policy.

5. Click Grant permissions.

6. Click Close.

FAQ

Q: What should I do if calling Bastionhost APIs returns an InvalidAccessKeyId or unknown endpoint error?

Perform the following checks in sequence to troubleshoot the issue:

1. Check permission policies: Verify that the RAM user has been granted AliyunYundunBastionHostFullAccess or a custom policy that includes the required Bastionhost actions. Insufficient permissions can cause InvalidAccessKeyId-class authentication failures.

2. Specify the correct endpoint: When calling Bastionhost APIs, you must explicitly specify the regional endpoint. For example, use yundun-bastionhost.aliyuncs.com for the China (Shanghai) region. Bastionhost does not support default endpoint resolution, so if no endpoint is specified the SDK returns an unknown endpoint error.

3. Verify your AK/SK: Confirm that the AccessKey ID and AccessKey Secret are valid and correctly matched. If you suspect the AccessKey Secret has been exposed or is incorrect, create a new AccessKey for testing.

4. Verify permissions using OpenAPI Explorer: Use OpenAPI Explorer with the RAM user's AK/SK to test the ListHostAccounts operation (specify the RegionId parameter). A successful call confirms that both the permissions and AK/SK are correctly configured.

Q: What should I do if a RAM user reports a missing ListTagResources permission error when logging on to the Bastionhost O&M console?

Cause: The preset read-only permission policy for Bastionhost does not include the yundun-bastionhost:ListTagResources action. When the O&M console attempts to load tag resources, the authorization check fails and returns a missing permission error.

Solution: Create a custom permission policy in the RAM console and grant it to the affected RAM user:

1. Log on to the RAM console.

2. In the left-side navigation pane, choose Permissions > Policies.

3. Click Create Policy and switch to the JSON editing mode.

4. Add the yundun-bastionhost:ListTagResources action for the Bastionhost service.

5. Complete the policy creation, then grant the custom policy to the target RAM user.

Q: What should I do if a RAM user reports insufficient permissions when calling management APIs such as GetWatermarkConfig?

Cause: This issue typically occurs when the RAM user's permissions are scoped to a resource group that does not include the target Bastionhost instance. Even if the RAM user has been granted AliyunYundunBastionHostFullAccess or another management policy, API calls such as GetWatermarkConfig will fail if the resource group scope does not cover the Bastionhost instance being accessed.

Solution: Perform one of the following:

• In the RAM console, review the authorization scope for the RAM user. If resource group-level authorization is configured, ensure the resource group includes the target Bastionhost instance.

• Change the Resource Scope of the permission grant from ResourceGroup to Account to grant access across all instances under the current Alibaba Cloud account.

What's next

• Add hosts

• Use the database management feature

• O&M overview