Elastic Container Instance:Use tags for RAM user authentication

Example scenario

This topic uses the following scenario to demonstrate tag-based authentication.

Assume that you need to restrict a RAM user to operating only on ECI resources with a specific tag, for example, env:test, as shown in the following figure:

The specific requirements are as follows:

• Requirement 1: To create an ECI resource, the user must tag it with env:test during creation.

• Requirement 2: The user can operate only on ECI resources tagged with env:test.

• Requirement 3: When querying ECI resources, the user can view only the resources that are tagged with env:test.

Step 1: Configure and grant a custom policy

1. Log on to the RAM console with your Alibaba Cloud account.

2. In the left-side navigation pane, choose Permissions > Policies.

3. On the Policies page, click Create Policy.

4. Configure the custom policy.

   1. Click the Import Policy tab.

   2. In the dialog box that appears, select System Policy from the filter options on the right. Then, search for and select AliyunECIFullAccess, and click Import.

      AliyunECIFullAccess is the default system policy for managing ECI resources. It includes permissions to operate on ECI resources, query related resources such as security groups and VPCs, and create a service-linked role for ECI.

   3. Click the JSON Editor tab.

   4. Modify the policy content in the editor, and then click Next to edit policy information.

      Note

      A policy is a set of access permissions. It consists of a version number and a list of statements. Each statement includes an effect (Effect), actions (Action), resources (Resource), and optional conditions (Condition). For more information, see Policy structure and syntax and Policy elements.

      In the Condition element of a policy, you can add tag-based conditions to restrict permissions. The following tag condition keys are supported:

      Tag condition key	Description
      acs:RequestTag	Restricts the request to include a specific tag. If an API request does not include a tag parameter, you cannot use acs:RequestTag in the policy. Otherwise, authentication fails.
      acs:ResourceTag	Restricts operations to resources that contain a specific tag. If an API request does not include a resource ID parameter, you cannot use acs:ResourceTag in the policy. Otherwise, authentication fails.

      Note

      When you design a permission policy, you can set acs:RequestTag or acs:ResourceTag based on your business requirements and the characteristics of the API operation, such as whether it requires a resource ID or supports passing tags. For more information, see API authentication.

      To meet the requirements in the example scenario, design the policy as follows:

      Requirement	Policy
      An ECI resource can be created only if it is tagged with env:test.	{ "Effect": "Allow", "Action": "eci:Create*", "Resource": "*", "Condition": { "StringEquals": { "acs:RequestTag/env": "test" } } }
      The user can operate only on ECI resources that are tagged with env:test.	{ "Effect": "Allow", "Action": "eci:*", "Resource": "*", "Condition": { "StringEquals": { "acs:ResourceTag/env": "test" } } }
      When querying ECI resources, the user can view only resources that are tagged with env:test.	{ "Effect": "Allow", "Action": "eci:Describe*", "Resource": "*", "Condition": { "StringEquals": { "acs:RequestTag/env": "test" } } }

      The complete example policy, which includes the permissions from AliyunECIFullAccess, is as follows:

      {
       "Version": "1",
       "Statement": [{
         "Effect": "Allow",
         "Action": "eci:Create*",
         "Resource": "*",
         "Condition": {
          "StringEquals": {
           "acs:RequestTag/env": "test"
          }
         }
        },
        {
         "Effect": "Allow",
         "Action": "eci:*",
         "Resource": "*",
         "Condition": {
          "StringEquals": {
           "acs:ResourceTag/env": "test"
          }
         }
        },
        {
         "Effect": "Allow",
         "Action": "eci:Describe*",
         "Resource": "*",
         "Condition": {
          "StringEquals": {
           "acs:RequestTag/env": "test"
          }
         }
        },
        {
         "Action": [
          "ecs:DescribeSecurityGroups"
         ],
         "Resource": "*",
         "Effect": "Allow"
        },
        {
         "Action": [
          "vpc:DescribeVSwitches",
          "vpc:DescribeVpcs",
          "vpc:DescribeEipAddresses"
         ],
         "Resource": "*",
         "Effect": "Allow"
        },
        {
         "Action": "ram:CreateServiceLinkedRole",
         "Resource": "*",
         "Effect": "Allow",
         "Condition": {
          "StringEquals": {
           "ram:ServiceName": [
            "eci.aliyuncs.com",
            "vnode.eci.aliyuncs.com"
           ]
          }
         }
        }
       ]
      }

      Note

      If you use OpenAPI to operate on ECI resources, the AliyunECIFullAccess policy is sufficient. If you use the ECI console, you must grant additional permissions. For more information, see Grant permissions to a RAM user.

   5. Enter a name for the policy and click OK.

5. Grant the custom policy to a RAM user.

   1. In the left-side navigation pane, choose Identities > Users.

   2. Create a RAM user.

      If you do not have a RAM user, create one based on your management needs. For more information, see Create a RAM user.

   3. Grant permissions to the RAM user.

      Grant the custom policy to the RAM user. For more information, see Manage permissions for a RAM user.

Step 2: Verify the policy

1. Log on to OpenAPI Explorer as the RAM user.

2. Verify that the policy is effective.

   The following tests use an ECI instance as an example:

   • Create an ECI instance

     • If you set the env:test tag, the instance is created successfully.

     • If you do not set a tag or you set a different tag, the creation fails and a permission denied error is returned.

   • Delete an ECI instance

     • If an ECI instance is tagged with env:test, the deletion succeeds.

     • If an ECI instance is not tagged with env:test, the deletion fails and returns a permission denied error.

   • Query an ECI instance

     • If you specify an instance that is tagged with env:test but do not specify a tag in the query, the query returns information about the specified ECI instance.

     • If you specify an instance that is not tagged with env:test, the query returns an empty result.

     • If you do not specify an instance and set only the env:test tag in the query, the query returns information about all instances with the env:test tag.

     • If you do not specify an instance or a tag, the query returns an empty result.