Grant a RAM user permissions to use Cloud Assistant - Elastic Compute Service

Grant RAM users fine-grained Cloud Assistant access with custom or system policies to avoid exposing your Alibaba Cloud account AccessKey pair.

Background

Cloud Assistant supports custom policies and Alibaba Cloud system policies. Custom policies control access by dimensions such as regions, ECS instances, commands, and managed instance activation codes.

Procedure

Create a RAM user with an Alibaba Cloud account.

See Create a RAM user.

Create a custom policy with the Alibaba Cloud account. See Create a custom policy.

The following table lists sample custom policies for common Cloud Assistant features.

Cloud Assistant feature	Sample custom policy
Cloud Assistant	Administrative permissions (read and write) for Cloud Assistant Read-only permissions for Cloud Assistant Set region restrictions for Cloud Assistant
Cloud Assistant Agent	Check the Cloud Assistant Agent installation status Installing the Cloud Assistant Agent Querying and Modifying the Cloud Assistant Agent Upgrade Configuration Query the Cloud Assistant Agent upgrade configuration
Cloud Assistant commands	View Cloud Assistant commands Delete a Cloud Assistant command Create a Cloud Assistant command Permissions to modify Cloud Assistant commands Run the command Execute command now Query command execution results Stop a task Modify a scheduled task Using OOS common parameters in commands Using OOS encryption parameters in commands
Send files	Upload a local file Query the file upload result
O&M task execution record delivery	Query and Modify the O&M Task Execution Record Delivery Feature Configuration Query the configuration of the delivery feature for O&M task execution records Region-specific permissions for O&M task execution record delivery Query and modify the session operation records delivery feature configuration Query the session operation record delivery configuration Configuring regional restrictions for the session operation record delivery feature Permissions to query OSS buckets Query SLS Projects and Logstores
Managed instances	Unregister managed instance Query managed instances Create a managed instance activation code Permissions to disable activation codes for managed instances Permissions to query activation codes for managed instances Deleting a managed instance activation code
Session management	Session Management (Session Manager): Create and Query

Grant permissions to the RAM user with your Alibaba Cloud account.
See Manage permissions for a RAM user.
- Specify a custom policy.
  
  In the Add Permissions panel, set Authorization Scope to Entire Cloud Account, select the required permission policy, and then click OK.
- Specify a system policy provided by Alibaba Cloud.
  - AliyunECSAssistantFullAccess: Full Cloud Assistant management permissions.
  - AliyunECSAssistantReadonlyAccess: Read-only Cloud Assistant permissions.
  View system policy details, such as the policy content, in the RAM console. See Policy information.
Verify that console access is granted to the RAM user.

If Console Access is not enabled, the RAM user can use Cloud Assistant only by calling API operations. See View RAM user permissions.

On the Authentication tab, view the Console Logon Management section and verify that Console Access is Enabled.
Log on to the Alibaba Cloud Management Console as the RAM user.

See Log on to the Alibaba Cloud Management Console as a RAM user.

On the RAM User Logon page, select the RAM User Logon tab, enter the RAM username (in the format username@company.onaliyun.com or username@company-alias), click Next, and then enter the password to log on.
Log on to the Cloud Assistant page of the ECS console as the RAM user to use Cloud Assistant.

Sample custom policies for Cloud Assistant features

Administrative permissions (read and write) for Cloud Assistant

Grants full query and operation permissions for all Cloud Assistant APIs.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:DescribeInstances",
                "ecs:DescribeTag*",
                "ecs:*Command",
                "ecs:DescribeCommand*",
                "ecs:DescribeInvocation*",
                "ecs:StopInvocation",
                "ecs:*CloudAssistant*",
                "ecs:SendFile",
                "ecs:DescribeSendFileResults",
                "ecs:*ManagedInstance",
                "ecs:DescribeManagedInstances",
                "ecs:*Activation",
                "ecs:DescribeActivations",
                "ecs:ListPluginStatus",
                "ecs:ModifyInvocationAttribute",
                "ecs:StartTerminalSession",
                "ecs:DescribeTerminalSessions",
                "ecs:RunCommand"
            ],
            "Resource": [
                "acs:ecs:*:*:instance/*",
                "acs:ecs:*:*:command/*",
                "acs:ecs:*:*:activation/*",
                "acs:ecs:*:*:invocation/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "ram:CreateServiceLinkedRole"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": [
                        "archiving.ecs.aliyuncs.com"
                    ]
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [
                "ecs:ModifyCloudAssistantSettings",
                "ecs:DescribeCloudAssistantSettings"
            ],
            "Resource": [
                "acs:ecs:*:*:servicesettings/*"

            ]
        }
    ]
}

Read-only permissions for Cloud Assistant

Grants query-only permissions for all Cloud Assistant APIs.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:DescribeInstances",
                "ecs:DescribeTag*",
                "ecs:DescribeCommand*",
                "ecs:DescribeInvocation*",
                "ecs:DescribeCloudAssistant*",
                "ecs:DescribeSendFileResults",
                "ecs:DescribeManagedInstances",
                "ecs:DescribeActivations",
                "ecs:ListPluginStatus",
                "ecs:DescribeTerminalSessions"
            ],
            "Resource": [
                "acs:ecs:*:*:instance/*",
                "acs:ecs:*:*:command/*",
                "acs:ecs:*:*:activation/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "ecs:DescribeCloudAssistantSettings"
            ],
            "Resource": [
                "acs:ecs:*:*:servicesettings/*"
            ]
        }
    ]
}

Configure regional restrictions for Cloud Assistant

Restricts Cloud Assistant permissions to a specific region. This example limits access to China (Hangzhou).

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:DescribeInstances",
                "ecs:DescribeTag*",
                "ecs:*Command",
                "ecs:DescribeCommand*",
                "ecs:DescribeInvocation*",
                "ecs:StopInvocation",
                "ecs:*CloudAssistant*",
                "ecs:SendFile",
                "ecs:DescribeSendFileResults",
                "ecs:*ManagedInstance",
                "ecs:DescribeManagedInstances",
                "ecs:*Activation",
                "ecs:DescribeActivations",
                "ecs:ListPluginStatus",
                "ecs:ModifyInvocationAttribute",
                "ecs:StartTerminalSession",
                "ecs:DescribeTerminalSessions",
                "ecs:RunCommand"
            ],
            "Resource": [
                "acs:ecs:cn-hangzhou:*:instance/*",
                "acs:ecs:cn-hangzhou:*:command/*",
                "acs:ecs:cn-hangzhou:*:activation/*",
                "acs:ecs:cn-hangzhou:*:invocation/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "ram:CreateServiceLinkedRole"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": [
                        "archiving.ecs.aliyuncs.com"
                    ]
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [
                "ecs:ModifyCloudAssistantSettings",
                "ecs:DescribeCloudAssistantSettings"
            ],
            "Resource": [
                "acs:ecs:cn-hangzhou:*:servicesettings/*"
            ]
        }
    ]
}

Cloud Assistant Agent

Query Cloud Assistant Agent installation status

API operation: DescribeCloudAssistantStatus

Query the installation status of Cloud Assistant Agent on all ECS instances.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:DescribeInstances",
                "ecs:DescribeCloudAssistantStatus"
            ],
            "Resource": [
                "acs:ecs:*:*:instance/*"
            ]
        }
    ]
}

Set instance IDs in Resource to limit queries to specified ECS instances.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:DescribeInstances",
                "ecs:DescribeCloudAssistantStatus"
            ],
            "Resource": [
                "acs:ecs:*:*:instance/i-instancexxx000a",
                "acs:ecs:*:*:instance/i-instancexxx000b"
            ]
        }
    ]
}

Install Cloud Assistant Agent

API operation: InstallCloudAssistant

Install Cloud Assistant Agent on any ECS instance.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:InstallCloudAssistant"
            ],
            "Resource": [
                "acs:ecs:*:*:instance/*"
            ]
        }
    ]
}

Set instance IDs in Resource to limit installation to specified ECS instances.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:InstallCloudAssistant"
            ],
            "Resource": [
                "acs:ecs:*:*:instance/i-instancexxx00a",
                  "acs:ecs:*:*:instance/i-instancexxx00b"
            ]
        }
    ]
}

Sample custom policies for commands

View Cloud Assistant commands

API operation: DescribeCommands

View all Cloud Assistant commands.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:DescribeCommands"
            ],
            "Resource": [
                "acs:ecs:*:*:command/*"
            ]
        }
    ]
}

Set command IDs in Resource to limit viewing to specified commands.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:DescribeCommands"
            ],
            "Resource": [
                "acs:ecs:*:*:command/c-commandxxx000a",
                "acs:ecs:*:*:command/c-commandxxx000b"
            ]
        }
    ]
}

Delete Cloud Assistant commands

API operation: DeleteCommand

Delete all Cloud Assistant commands.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:DeleteCommand"
            ],
            "Resource": [
                "acs:ecs:*:*:command/*"
            ]
        }
    ]
}

Set command IDs in Resource to limit deletion to specified commands.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:DeleteCommand"
            ],
            "Resource": [
                "acs:ecs:*:*:command/c-commandxxx000a",
                "acs:ecs:*:*:command/c-commandxxx000b"
            ]
        }
    ]
}

Create a Cloud Assistant command

API operation: CreateCommand

Minimum permissions required to create Cloud Assistant commands.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:CreateCommand"
            ],
            "Resource": [
                "acs:ecs:*:*:command/*"
            ]
        }
    ]
}

Modify Cloud Assistant commands

API operation: ModifyCommand

Modify any Cloud Assistant command.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:ModifyCommand"
            ],
            "Resource": [
                "acs:ecs:*:*:command/*"
            ]
        }
    ]
}

Set command IDs in Resource to limit modifications to specified commands.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:ModifyCommand"
            ],
            "Resource": [
                "acs:ecs:*:*:command/c-commandxxx000a",
                "acs:ecs:*:*:command/c-commandxxx000b"
            ]
        }
    ]
}

Execute a command

API operation: InvokeCommand

Run commands on any instance.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:InvokeCommand"
            ],
            "Resource": [
                "acs:ecs:*:*:command/*",
                "acs:ecs:*:*:instance/*"
            ]
        }
    ]
}

Set instance IDs in Resource to limit command execution to specified ECS instances.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:InvokeCommand"
            ],
            "Resource": [
                "acs:ecs:*:*:command/*",
                "acs:ecs:*:*:instance/i-instancexxx00a",
                "acs:ecs:*:*:instance/i-instancexxx00b"
            ]
        }
    ]
}

Set command IDs in Resource to limit execution to specified commands on any ECS instance.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:InvokeCommand"
            ],
            "Resource": [
                "acs:ecs:*:*:command/c-commandxxx00a",
                "acs:ecs:*:*:command/c-commandxxx00b",
                "acs:ecs:*:*:instance/*"
            ]
        }
    ]
}

Set both command IDs and instance IDs in Resource to limit execution to specified commands on specified ECS instances.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:InvokeCommand"
            ],
            "Resource": [
                "acs:ecs:*:*:instance/i-instancexxx00a",
                "acs:ecs:*:*:instance/i-instancexxx00b",
                "acs:ecs:*:*:command/c-commandxxx00a",
                "acs:ecs:*:*:command/c-commandxxx00b"
            ]
        }
    ]
}

Limit executable plugins. This example allows only the public command ACS-ECS-ExecutePlugin-for-linux.sh, which corresponds to the plugin test-plugin.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ecs:InvokeCommand",
      "Resource": [
        "acs:ecs:*:*:command/ACS-ECS-ExecutePlugin-for-linux.sh",
        "acs:ecs:*:*:instance/*"
      ],
      "Condition": {
        "StringEqualsIgnoreCase": {
          "ecs:PluginName": [
            "test-plugin"
          ]
        }
      }
    }
  ]
}

Add a tag condition to Condition to restrict which ECS instances can run commands. This example allows commands only on instances with the test:tony tag.

Note

The acs:ResourceTag condition requires a tag on the resource. Tags can be attached to ECS instances but not to commands.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ecs:InvokeCommand",
      "Resource": [
        "acs:ecs:*:*:instance/*"
      ],
      "Condition": {
        "StringEquals": {
          "acs:ResourceTag/Owner": "zxy"
        }
      }
    },  
    {
      "Effect": "Allow",
      "Action": "ecs:InvokeCommand",
      "Resource": [
        "acs:ecs:*:*:command/*"
      ]
    }
  ]
}

Execute a command immediately

API operation: RunCommand

Note

If you set KeepCommand to true when calling RunCommand, add "acs::ecs:*:*:command/*" to Resource.

Run commands immediately on any instance.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:RunCommand"
            ],
            "Resource": [
                "acs:ecs:*:*:instance/*"
            ]
        }
    ]
}

Set instance IDs in Resource to limit immediate command execution to specified ECS instances.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:RunCommand"
            ],
            "Resource": [
                "acs:ecs:*:*:instance/i-instancexxx00a",
                "acs:ecs:*:*:instance/i-instancexxx00b"
            ]
        }
    ]
}

Add a tag condition to Condition to restrict which ECS instances can immediately run commands. This example allows only instances with the test:tony tag.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:RunCommand"
            ],
            "Resource": "acs:ecs:*:*:instance/*",
            "Condition": {
                "StringEquals": {
                    "acs:ResourceTag/test": "tony"
                }
            }
        }
    ]
}

Query command execution results

API operation: DescribeInvocations

Query command execution results on any instance.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:DescribeInvocations"
            ],
            "Resource": [
                "acs:ecs:*:*:instance/*",
                "acs:ecs:*:*:command/*"
            ]
        }
    ]
}

Set instance IDs in Resource to limit queries to specified ECS instances.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:DescribeInvocations"
            ],
            "Resource": [
                "acs:ecs:*:*:instance/i-instancexxx00a",
                "acs:ecs:*:*:instance/i-instancexxx00b",
                "acs:ecs:*:*:command/*"
            ]
        }
    ]
}

Set command IDs in Resource to limit queries to specified commands on any ECS instance.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:DescribeInvocations"
            ],
            "Resource": [
                "acs:ecs:*:*:instance/*",
                "acs:ecs:*:*:command/c-commandxxx00a",
                "acs:ecs:*:*:command/c-commandxxx00b"
            ]
        }
    ]
}

Set both command IDs and instance IDs in Resource to limit queries to specified commands on specified ECS instances.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:DescribeInvocations"
            ],
            "Resource": [
                "acs:ecs:*:*:instance/i-instancexxx00a",
                "acs:ecs:*:*:instance/i-instancexxx00b",
                "acs:ecs:*:*:command/c-commandxxx00a",
                "acs:ecs:*:*:command/c-commandxxx00b"
            ]
        }
    ]
}

Modify scheduled task execution information

API operation: ModifyInvocationAttribute

Modify the execution information of any scheduled task and add any instance to it.

When calling InvokeCommand or RunCommand, if you modify CommandContent and set KeepCommand to true, a new command is created for long-term retention (LTR). Add acs:ecs:*:*:command/* to Resource before calling ModifyInvocationAttribute.
```
{
  "Version": "1",
  "Statement": [
    {
      "Action": "ecs:ModifyInvocationAttribute",
      "Resource": [
        "acs:ecs:*:*:instance/*",
        "acs:ecs:*:*:invocation/*"
      ],
      "Effect": "Allow"
    }
  ]
}
```

Set a task ID in Resource to limit modifications to the specified task, while allowing any instance to be added.

{
  "Version": "1",
  "Statement": [
    {
      "Action": "ecs:ModifyInvocationAttribute",
      "Resource": [
        "acs:ecs:*:*:instance/*",
        "acs:ecs:*:*:invocation/task-xxx"
      ],
      "Effect": "Allow"
    }
  ]
}

Set an instance ID in Resource to allow modifying any scheduled task but adding only the specified instance.

{
  "Version": "1",
  "Statement": [
    {
      "Action": "ecs:ModifyInvocationAttribute",
      "Resource": [
        "acs:ecs:*:*:instance/i-instance-xxx",
        "acs:ecs:*:*:invocation/*"
      ],
      "Effect": "Allow"
    }
  ]
}

Set both an instance ID and a task ID in Resource to limit modifications and instance additions to the specified task and instance.

{
  "Version": "1",
  "Statement": [
    {
      "Action": "ecs:ModifyInvocationAttribute",
      "Resource": [
        "acs:ecs:*:*:instance/i-instance-xxx",
        "acs:ecs:*:*:invocation/task-xxx"
      ],
      "Effect": "Allow"
    }
  ]
}

Stop task execution

API operation: StopInvocation

Stop running Cloud Assistant command processes on any instance.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:StopInvocation"
            ],
            "Resource": [
                "acs:ecs:*:*:instance/*"
            ]
        }
    ]
}

Set instance IDs in Resource to limit this operation to specified ECS instances.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:StopInvocation"
            ],
            "Resource": [
                "acs:ecs:*:*:instance/i-instancexxx00a",
                "acs:ecs:*:*:instance/i-instancexxx00b"
            ]
        }
    ]
}

Use OOS standard parameters in commands

Run commands that contain OOS common parameters.

{
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:DescribeInstances",
                "ecs:CreateCommand",
                "ecs:DescribeCommands",
                "ecs:InvokeCommand",
                "ecs:RunCommand",
                "ecs:DescribeInvocations",
                "ecs:DescribeInvocationResults",
                "ecs:DescribeCloudAssistantStatus",
                "oos:GetParameters",
                "oos:GetParameter"
            ],
            "Resource": "*"
        }
    ],
    "Version": "1"
}

Use OOS encrypted parameters in commands

Run commands that contain OOS encrypted parameters.

{
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:DescribeInstances",
                "ecs:CreateCommand",
                "ecs:DescribeCommands",
                "ecs:InvokeCommand",
                "ecs:RunCommand",
                "ecs:DescribeInvocations",
                "ecs:DescribeInvocationResults",
                "ecs:DescribeCloudAssistantStatus",
                "oos:GetParameters",
                "oos:GetSecretParameters",
                "oos:GetParameter",
                "oos:GetSecretParameter",
                "kms:GetSecretValue"
            ],
            "Resource": "*"
        }
    ],
    "Version": "1"
}

Sample custom policies for sending files

Upload a local file

API operation: SendFile

Upload local files to any ECS instance.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:SendFile"
            ],
            "Resource": [
                "acs:ecs:*:*:instance/*"
            ]
        }
    ]
}

Set instance IDs in Resource to limit uploads to specified ECS instances.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:SendFile"
            ],
            "Resource": [
                "acs:ecs:*:*:instance/i-instancexxx00a",
                "acs:ecs:*:*:instance/i-instancexxx00b"
            ]
        }
    ]
}

Add a tag condition to Condition to restrict which ECS instances can receive files. This example allows uploads only to instances with the test:tony tag.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:SendFile"
            ],
            "Resource": "acs:ecs:*:*:instance/*",
            "Condition": {
                "StringEquals": {
                    "acs:ResourceTag/test": "tony"
                }
            }
        }
    ]
}

Query file upload results

API operation: DescribeSendFileResults

Query file upload results for any instance.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:DescribeSendFileResults"
            ],
            "Resource": [
                "acs:ecs:*:*:instance/*"
            ]
        }
    ]
}

Set instance IDs in Resource to limit queries to specified ECS instances.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:DescribeSendFileResults"
            ],
            "Resource": [
                "acs:ecs:*:*:instance/i-instancexxx00a",
                  "acs:ecs:*:*:instance/i-instancexxx00b"
            ]
        }
    ]
}

Sample custom policies for O&M task execution record delivery

Permissions to query and modify the configuration of O&M task execution record delivery

Query and modify the O&M task execution record delivery configuration.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:ModifyCloudAssistantSettings",
                "ecs:DescribeCloudAssistantSettings"
            ],
            "Resource": [
                "acs:ecs:*:*:servicesettings/cloudassistantdeliverysettings"
            ]
        }
    ]
}

Query the configuration of the O&M task execution record delivery feature

Query the O&M task execution record delivery configuration.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:DescribeCloudAssistantSettings"
            ],
            "Resource": [
                "acs:ecs:*:*:servicesettings/cloudassistantdeliverysettings"
            ]
        }
    ]
}

Region-specific permissions for O&M task execution record delivery

Specify a region to restrict delivery configuration access.

Query and modify O&M task execution record delivery only in China (Hangzhou).

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:ModifyCloudAssistantSettings",
                "ecs:DescribeCloudAssistantSettings"
            ],
            "Resource": [
                "acs:ecs:cn-hangzhou:*:servicesettings/cloudassistantdeliverysettings"
            ]
        }
    ]
}

Query O&M task execution record delivery only in China (Hangzhou).

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:DescribeCloudAssistantSettings"
            ],
            "Resource": [
                "acs:ecs:cn-hangzhou:*:servicesettings/cloudassistantdeliverysettings"
            ]
        }
    ]
}

Permissions to query and modify the configuration of session record delivery

Query and modify the session record delivery configuration.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:ModifyCloudAssistantSettings",
                "ecs:DescribeCloudAssistantSettings"
            ],
            "Resource": [
                "acs:ecs:*:*:servicesettings/sessionmanagerdeliverysettings"
            ]
        }
    ]
}

Permissions to query the configuration of session record delivery

Query the session record delivery configuration.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:DescribeCloudAssistantSettings"
            ],
            "Resource": [
                "acs:ecs:*:*:servicesettings/sessionmanagerdeliverysettings"
            ]
        }
    ]
}

Region-specific permissions for session record delivery

Specify a region to restrict session record delivery access.

Query and modify session record delivery only in China (Hangzhou).

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:ModifyCloudAssistantSettings",
                "ecs:DescribeCloudAssistantSettings"
            ],
            "Resource": [
                "acs:ecs:cn-hangzhou:*:servicesettings/sessionmanagerdeliverysettings"
            ]
        }
    ]
}

Query session record delivery only in China (Hangzhou).

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:DescribeCloudAssistantSettings"
            ],
            "Resource": [
                "acs:ecs:cn-hangzhou:*:servicesettings/sessionmanagerdeliverysettings"
            ]
        }
    ]
}

Query OSS buckets

To deliver O&M task execution records or session records to OSS, grant the following permissions.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "oss:ListBuckets"
            ],
            "Resource": "*"
        }
    ]
}

After records are delivered to OSS, understand OSS access control rules to query and analyze the records. See Overview of RAM policies for OSS and Common examples of RAM policies for OSS.

Query SLS projects and Logstores

To deliver O&M task execution records or session records to SLS, grant the following permissions.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "log:ListProject",
                "log:ListLogStores"
            ],
            "Resource": "*"
        }
    ]
}

After records are delivered to SLS, understand SLS access control rules to query and analyze the records. See Overview of SLS authentication rules.

Sample custom policies for managed instances

Unregister a managed instance

API operation: DeregisterManagedInstance

Unregister any managed instance.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:DeregisterManagedInstance"
            ],
            "Resource": [
                "acs:ecs:*:*:instance/*"
            ]
        }
    ]
}

Set instance IDs in Resource to limit unregistration to specified managed instances.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:DeregisterManagedInstance"
            ],
            "Resource": [
                "acs:ecs:*:*:instance/i-instancexxx00a",
                  "acs:ecs:*:*:instance/i-instancexxx00b"
            ]
        }
    ]
}

Query managed instances

API operation: DescribeManagedInstances

Query any managed instance.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:DescribeManagedInstances"
            ],
            "Resource": [
                "acs:ecs:*:*:instance/*"
            ]
        }
    ]
}

Set instance IDs in Resource to limit queries to specified managed instances.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:DescribeManagedInstances"
            ],
            "Resource": [
                "acs:ecs:*:*:instance/i-instancexxx00a",
                  "acs:ecs:*:*:instance/i-instancexxx00b"
            ]
        }
    ]
}

Create a managed instance activation code

API operation: CreateActivation

Minimum permissions to create activation codes for registering non-Alibaba Cloud servers as managed instances.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:CreateActivation"
            ],
            "Resource": [
                "acs:ecs:*:*:activation/*"
            ]
        }
    ]
}

Permissions to disable activation codes for managed instances

API operation: DisableActivation

Disable any activation code for a managed instance.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:DisableActivation"
            ],
            "Resource": [
                "acs:ecs:*:*:activation/*"
            ]
        }
    ]
}

Set activation code IDs in Resource to limit this operation to specified activation codes.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:DisableActivation"
            ],
            "Resource": [
                "acs:ecs:*:*:activation/*****-*****A",
                  "acs:ecs:*:*:activation/*****-*****B"
            ]
        }
    ]
}

Query managed instance activation codes

API operation: DescribeActivations

Query activation codes and their usage for managed instances.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:DescribeActivations"
            ],
            "Resource": [
                "acs:ecs:*:*:activation/*"
            ]
        }
    ]
}

Set activation code IDs in Resource to limit queries to specified activation codes.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:DescribeActivations"
            ],
            "Resource": [
                "acs:ecs:*:*:activation/*****-*****A",
                  "acs:ecs:*:*:activation/*****-*****B"
            ]
        }
    ]
}

Delete managed instance activation codes

API operation: DeleteActivation

Delete any unused activation code for a managed instance.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:DeleteActivation"
            ],
            "Resource": [
                "acs:ecs:*:*:activation/*"
            ]
        }
    ]
}

Set activation code IDs in Resource to limit deletion to specified unused activation codes.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:DeleteActivation"
            ],
            "Resource": [
                "acs:ecs:*:*:activation/*****-*****A",
                  "acs:ecs:*:*:activation/*****-*****B"
            ]
        }
    ]
}

Sample custom policies for Cloud Assistant Agent upgrades

API operations: ModifyCloudAssistantSettings and DescribeCloudAssistantSettings.

Permissions to query and modify the Cloud Assistant Agent upgrade configuration

Query and modify the Cloud Assistant Agent upgrade configuration.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:ModifyCloudAssistantSettings",
                "ecs:DescribeCloudAssistantSettings"
            ],
            "Resource": [
                "acs:ecs:*:*:servicesettings/AgentUpgradeConfig"
            ]
        }
    ]
}

Query the Cloud Assistant Agent upgrade configuration

Query the Cloud Assistant Agent upgrade configuration.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:DescribeCloudAssistantSettings"
            ],
            "Resource": [
                "acs:ecs:*:*:servicesettings/AgentUpgradeConfig"
            ]
        }
    ]
}

Sample custom policies for Session Manager

API operations: StartTerminalSession and DescribeTerminalSessions.

Permissions to create and query Session Manager sessions

Create and query Session Manager sessions on any instance.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:StartTerminalSession",
                "ecs:DescribeTerminalSessions"
            ],
            "Resource": [
                "acs:ecs:*:*:instance/*"
            ]
        }
    ]
}

Set instance IDs in Resource to limit Session Manager operations to specified instances.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:StartTerminalSession",
                "ecs:DescribeTerminalSessions"
            ],
            "Resource": [
                "acs:ecs:*:*:instance/i-instancexxx00a",
                "acs:ecs:*:*:instance/i-instancexxx00b"
            ]
        }
    ]
}