All Products
Search
Document Center

Elasticsearch:Elasticsearch objects supported for authorization

Last Updated:Oct 15, 2024

Custom policies can be used to manage user permissions in a fine-grained manner. You can use custom policies to control the access permissions of RAM users, RAM roles, or other Alibaba Cloud services or to authenticate team or department members. When you create a custom policy, you must configure the Action and Resource elements. This topic describes the objects that you can specify in the Action and Resource elements.

Background information

By default, you can use your Alibaba Cloud account or RAM users within your Alibaba Cloud account to manage your Elasticsearch resources in the Elasticsearch console or by calling Elasticsearch API operations. Authorization is required in the following scenarios:

  • A new RAM user within your Alibaba Cloud account does not have permissions to perform operations on the resources of the Alibaba Cloud account.

  • You want to access Elasticsearch resources from other Alibaba Cloud services, or Elasticsearch needs to access the resources of other Alibaba Cloud services.

  • You want to perform operations on Elasticsearch resources that require resource and API operation permissions to be granted by resource owners.

Custom policies

You can create a custom policy in the RAM console or by calling the RAM API operation CreatePolicy. You need to specify the document of a custom policy based on the provided JSON template. The objects that you can specify in the Action and Resource elements are provided in the Objects supported for authorization section. For more information, see Create a custom policy and Policy elements.

{
  "Statement": [
  {
    "Effect": "Allow",
    "Action": [
                "elasticsearch:[Elasticsearch RAM Action]",
                "elasticsearch:ListInstance"
            ],
    "Resource": [
                "[Elasticsearch RAM Action Resource]",
                "acs:elasticsearch:cn-hangzhou:133071096032****:instances/es-cn-2r42b7uyg003k****"
            ]
  }
  ],
  "Version": "1"
}

Objects supported for authorization

Elasticsearch

  • Manage clusters

    Action

    Resource

    Action description

    elasticsearch:CreateInstance

    acs:elasticsearch:<yourRegionId>:<yourAccountId>:instances/*

    Creates a cluster.

    elasticsearch:ListInstance

    Queries the details of all clusters.

    elasticsearch:DescribeInstance

    acs:elasticsearch:<yourRegionId>:<yourAccountId>:instances/<yourInstanceId>

    Queries the details of a cluster.

    elasticsearch:EstimatedRestartTime

    Queries the estimated time that is required to restart a cluster.

    elasticsearch:RestartInstance

    Restarts a cluster.

    elasticsearch:UpdateInstanceChargeType

    Switches the billing method of a cluster from pay-as-you-go to subscription.

    elasticsearch:UpdateDescription

    Changes the name of a cluster.

    elasticsearch:DeleteInstance

    Releases a pay-as-you-go cluster.

    elasticsearch:CancelDeletion

    Restores a cluster that is frozen after it is released.

    elasticsearch:RenewInstance

    Renews a subscription cluster.

    elasticsearch:ActivateZones

    Restores nodes in disabled zones.

    elasticsearch:DeactivateZones

    Disables one or more zones where a multi-zone cluster resides and migrates the nodes in the disabled zones to other zones.

    elasticsearch:InterruptElasticsearchTask

    Suspends a change task of a cluster.

    elasticsearch:ResumeElasticsearchTask

    Resumes a change task of a cluster.

    elasticsearch:DescribeElasticsearchHealth

    Queries the health status of a cluster.

    elasticsearch:ListInstanceIndices

    Queries the indexes of a cluster.

    elasticsearch:MigrateToOtherZone

    Migrates nodes across zones.

    elasticsearch:MoveResourceGroup

    Migrates a cluster to a resource group.

    elasticsearch:ModifyInstanceMaintainTime

    Enables and modifies the maintenance window of a cluster.

    elasticsearch:ListShardRecoveries

    Queries the progress of ongoing and completed data restoration tasks on shards.

  • Manage tags

    Action

    Resource

    Action description

    elasticsearch:ListTags

    acs:elasticsearch:<yourRegionId>:<yourAccountId>:tags/<yourInstanceId>

    Queries all visible user tags.

    elasticsearch:CreateTags

    Creates or updates tags.

    elasticsearch:RemoveTags

    Removes tags.

    elasticsearch:ListTagResources

    • acs:elasticsearch:<yourRegionId>:<yourAccountId>:tags/*

    • acs:elasticsearch:<yourRegionId>:<yourAccountId>:tags/<yourInstanceId>

    Queries the relationships between visible tags and resources.

  • Migrate data

    Action

    Resource

    Action description

    elasticsearch:ListDataTasks

    acs:elasticsearch:<yourRegionId>:<yourAccountId>:instances/<yourInstanceId>

    Queries the information about data migration tasks.

    elasticsearch:CancelTask

    Cancels a data migration task.

    elasticsearch:CreateDataTasks

    Creates a data migration task to migrate data to a specified cluster.

    elasticsearch:DeleteDataTask

    Deletes a data migration task.

    elasticsearch:GetClusterDataInformation

    • acs:elasticsearch:<yourRegionId>:<yourAccountId>:instances/*

    • acs:elasticsearch:<yourRegionId>:<yourAccountId>:instances/<yourInstanceId>

    Queries the data information of a cluster.

  • Upgrade or downgrade cluster configurations

    Action

    Resource

    Action description

    elasticsearch:UpgradeEngineVersion

    acs:elasticsearch:<yourRegionId>:<yourAccountId>:instances/<yourInstanceId>

    Upgrades the version or kernel of a cluster.

    elasticsearch:UpdateInstance

    Modifies the configuration of a cluster.

    elasticsearch:DowngradeInstance

    • Checks whether the data on specific nodes in a cluster can be migrated before a cluster scale-in.

    • Migrates data before a cluster scale-in.

    • Checks whether specific nodes can be removed from a cluster.

    • Scales in a cluster.

  • Configure clusters

    Action

    Resource

    Action description

    elasticsearch:UpdateInstanceSettings

    acs:elasticsearch:<yourRegionId>:<yourAccountId>:instances/<yourInstanceId>

    Updates the configuration in the YML file of a cluster.

    elasticsearch:UpdateHotIkDicts

    Performs a rolling update on the analysis-ik plug-in, including the IK main dictionary and stopword list of the plug-in.

    elasticsearch:UpdateSynonymsDicts

    Updates the synonym dictionary of a cluster.

    elasticsearch:UpdateDict

    Performs a standard update on the analysis-ik plug-in, including the IK main dictionary and stopword list of the plug-in.

    elasticsearch:UpdateAliwsDict

    Updates the dictionary file of the analysis-aliws plug-in.

    elasticsearch:ListDictInformation

    Queries and verifies the details of the dictionary object stored in Object Storage Service (OSS) when you upload the object to a cluster.

    elasticsearch:UpdateAdvancedSetting

    Updates the garbage collector (GC) configuration of a cluster.

    elasticsearch:DescribeTemplates

    Queries the scenario-based configuration templates of a cluster.

    elasticsearch:ListDicts

    Queries the details of a specified type of dictionary and the link that is generated based on the related signature to download the dictionary.

  • Manage plug-ins

    Action

    Resource

    Action description

    elasticsearch:ListPlugins

    acs:elasticsearch:<yourRegionId>:<yourAccountId>:instances/<yourInstanceId>

    Queries the plug-ins that are installed for a cluster.

    elasticsearch:InstallSystemPlugin

    Installs a built-in plug-in.

    elasticsearch:UninstallPlugin

    Uninstalls a built-in plug-in.

    elasticsearch:InstallUserPlugins

    Installs a custom plug-in that is uploaded to the Elasticsearch console.

  • Query logs

    Action

    Resource

    Action description

    elasticsearch:ListSearchLogs

    acs:elasticsearch:<yourRegionId>:<yourAccountId>:instances/<yourInstanceId>

    Queries the logs of a cluster.

  • Configure security settings

    Action

    Resource

    Action description

    elasticsearch:TriggerNetwork

    acs:elasticsearch:<yourRegionId>:<yourAccountId>:instances/<yourInstanceId>

    Enables or disables the Public Network Access or Private Network Access feature for Elasticsearch or Kibana.

    elasticsearch:UpdatePrivateNetworkWhiteIps

    Updates the private IP address whitelist of a cluster.

    elasticsearch:UpdatePublicWhiteIps

    Updates the public IP address whitelist of a cluster.

    elasticsearch:UpdatePublicNetwork

    Enables or disables the Public Network Access feature for a cluster.

    elasticsearch:UpdateWhiteIps

    Updates the private IP address whitelist of a cluster.

    elasticsearch:ModifyWhiteIps

    Updates the IP address whitelist of a cluster.

    elasticsearch:UpdateAdminPassword

    Updates the password for the elastic account of a cluster.

    elasticsearch:OpenHttps

    Enables HTTPS.

    elasticsearch:CloseHttps

    Disables HTTPS.

    elasticsearch:AddConnectableCluster

    Connects clusters.

    elasticsearch:DeleteConnectedCluster

    Disconnects clusters.

    elasticsearch:DescribeConnectableClusters

    Queries the clusters that can be connected to a specified cluster. The clusters that are connected to the specified cluster are excluded.

    elasticsearch:ListConnectedClusters

    Queries a list of clusters that are connected to a specified cluster.

    elasticsearch:DeleteVpcEndpoint

    Deletes an endpoint in the VPC within the service account.

    elasticsearch:ListVpcEndpoints

    Queries the status of an endpoint in the VPC within the service account.

  • Back up data

    Action

    Resource

    Action description

    elasticsearch:CreateSnapshot

    acs:elasticsearch:<yourRegionId>:<yourAccountId>:instances/<yourInstanceId>

    Creates a snapshot for a cluster.

    elasticsearch:AddSnapshotRepo

    acs:elasticsearch:<yourRegionId>:<yourAccountId>:instances/*

    Creates a shared OSS repository for a cluster.

    elasticsearch:DeleteSnapshotRepo

    Deletes a shared OSS repository for a cluster.

    elasticsearch:ListSnapshotReposByInstanceId

    Queries a list of shared OSS repositories configured for a cluster.

    elasticsearch:ListAlternativeSnapshotRepos

    acs:elasticsearch:<yourRegionId>:<yourAccountId>:snapshotrepository/*

    Queries the shared OSS repositories that can be configured for a cluster.

    elasticsearch:DescribeSnapshotSetting

    acs:elasticsearch:<yourRegionId>:<yourAccountId>:instances/<yourInstanceId>

    Queries the data backup configuration of a cluster.

    elasticsearch:UpdateSnapshotSetting

    Updates the data backup configuration of a cluster.

  • Perform intelligent O&M

    Action

    Resource

    Action description

    elasticsearch:OpenDiagnosis

    • acs:elasticsearch:<yourRegionId>:<yourAccountId>:instances/*

    • acs:elasticsearch:<yourRegionId>:<yourAccountId>:instances/<yourInstanceId>

    Enables intelligent O&M.

    elasticsearch:CloseDiagnosis

    Disables intelligent O&M.

    elasticsearch:UpdateDiagnosisSettings

    Updates the scenario settings of intelligent O&M.

    elasticsearch:DiagnoseInstance

    Diagnoses a cluster.

    elasticsearch:ListDiagnoseReport

    Queries a historical intelligent O&M report.

    elasticsearch:ListDiagnoseReportIds

    Queries the IDs of historical intelligent O&M reports.

    elasticsearch:ListDiagnoseIndices

    Queries the indexes on which health diagnosis is performed.

    elasticsearch:DescribeDiagnoseReport

    Queries historical intelligent O&M reports.

    elasticsearch:DescribeDiagnosisSettings

    Queries the scenario settings of intelligent O&M.

Kibana

Action

Resource

Action description

elasticsearch:DescribeKibanaSettings

acs:elasticsearch:<yourRegionId>:<yourAccountId>:instances/<yourInstanceId>

Queries the configuration of Kibana.

elasticsearch:UpdateKibanaSettings

Updates the configuration of Kibana.

elasticsearch:ListKibanaPlugins

Queries the plug-ins of Kibana.

elasticsearch:InstallKibanaSystemPlugin

Installs a plug-in for Kibana.

elasticsearch:UninstallKibanaPlugin

Uninstalls a plug-in for Kibana.

elasticsearch:UpdateKibanaWhiteIps

Modifies an IP address whitelist for access to Kibana.

Logstash

  • Manage clusters

    Action

    Resource

    Action description

    elasticsearch:CreateLogstash

    • acs:elasticsearch:<yourRegionId>:<yourAccountId>:logstashes/*

    • acs:elasticsearch:<yourRegionId>:<yourAccountId>:logstashes/<yourInstanceId>

    Creates a cluster.

    elasticsearch:ListLogstash

    Queries the details of a specified cluster or all clusters.

    elasticsearch:DescribeLogstash

    acs:elasticsearch:<yourRegionId>:<yourAccountId>:logstashes/<yourInstanceId>

    Queries the details of a cluster.

    elasticsearch:UpdateLogstash

    Modifies some information about a cluster, such as the number of nodes, quota, name, and hard disk size.

    elasticsearch:RenewLogstash

    Renews a cluster.

    elasticsearch:RestartLogstash

    Restarts a cluster.

    elasticsearch:EstimatedLogstashRestartTime

    Queries the estimated time that is required to restart a cluster.

    elasticsearch:UpdateLogstashDescription

    Changes the name of a cluster.

    elasticsearch:UpdateLogstashChargeType

    Switches the billing method of a cluster from pay-as-you-go to subscription.

    elasticsearch:DeleteLogstash

    Releases a pay-as-you-go cluster.

    elasticsearch:CancelLogstashDeletion

    Restores a cluster that is frozen after it is released.

  • Configure clusters

    Action

    Resource

    Action description

    elasticsearch:UpdateLogstashSettings

    acs:elasticsearch:<yourRegionId>:<yourAccountId>:logstashes/<yourInstanceId>

    Updates the configuration of a cluster.

    elasticsearch:ListExtendfiles

    Queries the third-party libraries that are configured for a cluster.

    elasticsearch:UpdateExtendfiles

    Updates the third-party libraries that are configured for a cluster.

  • Manage plug-ins

    Action

    Resource

    Action description

    elasticsearch:ListPlugin

    acs:elasticsearch:<yourRegionId>:<yourAccountId>:logstashes/<yourInstanceId>

    Queries a list of plug-ins.

    elasticsearch:InstallSystemPlugin

    Installs a built-in plug-in.

    elasticsearch:UninstallSystemPlugin

    Uninstalls a built-in plug-in.

  • Monitor clusters and query logs

    Action

    Resource

    Action description

    elasticsearch:ListAvailableEsInstanceIds

    acs:elasticsearch:<yourRegionId>:<yourAccountId>:logstashes/<yourInstanceId>

    Queries the Elasticsearch clusters that have X-Pack monitoring capabilities and can be associated with a Logstash cluster.

    elasticsearch:ValidateConnection

    Tests the connectivity between a Logstash cluster and its associated Elasticsearch cluster when you configure the X-Pack Monitoring feature for the Logstash cluster.

    elasticsearch:UpdateXpackMonitorConfig

    Updates the configurations of the X-Pack Monitoring feature of a Logstash cluster.

    elasticsearch:DescribeXpackMonitorConfig

    Queries the configurations of the X-Pack Monitoring feature of a Logstash cluster.

    elasticsearch:ListLogstashLog

    Queries the logs of a Logstash cluster.

  • Manage tasks

    Action

    Resource

    Action description

    elasticsearch:InterruptLogstashTask

    acs:elasticsearch:<yourRegionId>:<yourAccountId>:logstashes/<yourInstanceId>

    Suspends a change task.

    elasticsearch:ResumeLogstashTask

    Resumes a change task.

  • Manage pipelines

    Action

    Resource

    Action description

    elasticsearch:CreatePipelines

    acs:elasticsearch:<yourRegionId>:<yourAccountId>:logstashes/<yourInstanceId>

    Creates a pipeline.

    elasticsearch:ListPipeline

    Queries a list of pipelines.

    elasticsearch:DescribePipeline

    Queries the configuration of a pipeline.

    elasticsearch:UpdatePipelines

    Updates the configuration of a pipeline.

    elasticsearch:RunPipelines

    Deploys a pipeline immediately.

    elasticsearch:StopPipelines

    Stops a pipeline.

    elasticsearch:UpdatePipelineManagementConfig

    Updates the pipeline management method.

    elasticsearch:DescribePipelineManagementConfig

    Queries pipeline management configurations.

    elasticsearch:ListPipelineIds

    Tests the connectivity between a Logstash cluster and the Kibana console of an Elasticsearch cluster, and queries the IDs of pipelines that are created in the Kibana console of the Elasticsearch cluster.

    elasticsearch:DeletePipelines

    Deletes a pipeline.

Beats

Action

Resource

Action description

elasticsearch:CreateCollector

acs:elasticsearch:<yourRegionId>:<yourAccountId>:collectors/<yourCollectorId>

Creates a shipper.

elasticsearch:DescribeCollector

Queries the details of a shipper.

elasticsearch:ReinstallCollector

Installs a shipper that failed to be installed when you create the shipper.

elasticsearch:ListCollectors

acs:elasticsearch:<yourRegionId>:<yourAccountId>:collectors/*

Queries a list of shippers.

elasticsearch:ListDefaultCollectorConfigurations

Queries the default configuration files of shippers.

elasticsearch:UpdateCollectorName

acs:elasticsearch:<yourRegionId>:<yourAccountId>:collectors/<yourCollectorId>

Changes the name of a shipper.

elasticsearch:UpdateCollector

Updates the information about a shipper.

elasticsearch:StartCollector

Starts a shipper.

elasticsearch:RestartCollector

Restarts a shipper.

elasticsearch:StopCollector

Stops a shipper.

elasticsearch:DeleteCollector

Deletes a shipper.

elasticsearch:ListEcsInstances

Queries a list of Elastic Compute Service (ECS) instances.

elasticsearch:ModifyDeployMachine

Changes the ECS instances on which a shipper is installed.

elasticsearch:ListNodes

Queries the statuses of ECS instances on which a shipper is installed.

elasticsearch:ListAckClusters

acs:elasticsearch:<yourRegionId>:<yourAccountId>:ackClusters/*

Queries a list of Container Service for Kubernetes (ACK) clusters.

elasticsearch:ListAckNamespaces

acs:elasticsearch:<yourRegionId>:<yourAccountId>:ackClusters/<yourClusterId>

Queries all namespaces of an ACK cluster.

elasticsearch:DescribeAckOperator

Queries the information about ES-operator that is installed for an ACK cluster.

elasticsearch:InstallAckOperator

Installs ES-operator for an ACK cluster.

Access control

Action

Resource

Action description

elasticsearch:InitializeOperationRole

acs:elasticsearch:<yourRegionId>:<yourAccountId>:instances/*

Creates a service-linked role.

CloudMonitor

Action

Resource

Action description

cms:ListProductOfActiveAlert

*

Queries the services for which CloudMonitor is activated.

cms:ListAlarm

Queries the settings of a specified alert rule or all alert rules.

cms:QueryMetricList

Queries the monitoring data of a cluster over a specific period of time.

VPCs and vSwitches displayed on the Elasticsearch buy page

Action

Resource

Action description

elasticsearch:DescribeVpcs

acs:elasticsearch:<yourRegionId>:<yourAccountId>:vpc/*

Queries virtual private clouds (VPCs).

elasticsearch:DescribeVswitches

acs:elasticsearch:<yourRegionId>:<yourAccountId>:vswitch/*

Queries a list of vSwitches.

Parameters

This section describes the parameters that are contained in the Resource element in the preceding section.

  • <yourRegionId>: Set this parameter to the region ID of your Elasticsearch or Logstash cluster. You can also set this parameter to an asterisk (*) to indicate all regions. The following table lists the IDs of all regions where Elasticsearch and Logstash are available.

    Region name

    Region ID

    China

    China (Shanghai)

    cn-shanghai

    China (Shenzhen)

    cn-shenzhen

    China (Qingdao)

    cn-qingdao

    China (Zhangjiakou)

    cn-zhangjiakou

    China (Beijing)

    cn-beijing

    China (Hangzhou)

    cn-hangzhou

    China (Hong Kong)

    cn-hongkong

    Asia Pacific

    Singapore

    ap-southeast-1

    Malaysia (Kuala Lumpur)

    ap-southeast-3

    Japan (Tokyo)

    ap-northeast-1

    Indonesia (Jakarta)

    ap-southeast-5

    Europe & Americas

    US (Virginia)

    us-east-1

    US (Silicon Valley)

    us-west-1

    Germany (Frankfurt)

    eu-central-1

    UK (London)

    eu-west-1

  • <yourAccountId>: Set this parameter to the ID of your Alibaba Cloud account. You can also set this parameter to an asterisk (*) to indicate all accounts.

  • <yourInstanceId>: Set this parameter to the ID of your Elasticsearch or Logstash cluster. You can also set this parameter to an asterisk (*) to indicate all clusters.

  • <yourCollectorId>: Set this parameter to the ID of your Beats shipper.

  • <yourClusterId>: Set this parameter to the ID of the ACK cluster for which your Beats shipper is installed.