How service providers manage Compute Nest resource groups - Compute Nest

A resource group is a logical container for your cloud resources. You can use resource groups to organize resources based on criteria such as purpose, permissions, or ownership. This approach helps you manage resources for multiple users and projects in a hierarchical way and provides more granular access control than an Alibaba Cloud account alone. If you have multiple Compute Nest services, you can assign different services to different resource groups to manage access and permissions at a group level.

Background

The following limitations apply to resource groups:

Compute Nest supports resource groups for the following cloud resources: services and service instances.
You cannot transfer cloud resources between resource groups that belong to different Alibaba Cloud accounts.
A cloud resource can belong to only one resource group.
Resource groups inherit global permissions granted to a RAM user. For example, if you grant a RAM user permission to manage all Alibaba Cloud resources, that user can access all resource groups within the Alibaba Cloud account.

Procedure

This section explains how a service provider can use Compute Nest resource groups to manage permissions. In this scenario, you will grant User A permission to manage only Service A, and User B permission to manage only Service B.

In the Resource Management console, create two resource groups named Resource Group A and Resource Group B. For detailed steps, see Create a resource group.
Grant User A permissions on Resource Group A and User B permissions on Resource Group B. For both User A and User B, grant the AliyunComputeNestSupplierFullAccess permission. If other permissions are required, grant them as needed. For detailed steps, see Grant permissions on resource groups to a RAM identity.
Create two services, Service A and Service B. Set the resource group for Service A to Resource Group A and the resource group for Service B to Resource Group B. When you create a service, select the corresponding resource group, and select ROS or Terraform as the deployment mode.
After the services are created, users can log on to the Compute Nest console. On the Services page, they can click All Resources in the top-left corner to view available resource groups.
Since users have permissions only for specific resource groups, they must select a group to view the services within it.
If you do not specify a resource group when you create a service, the system adds the resource to the default resource group. If resource ownership changes, you can transfer resources between resource groups to reassign ownership. For more information, see Transfer resources across resource groups.