FAQ: Billing and permissions for Realtime Compute for Apache Flink - Realtime Compute for Apache Flink

Billing
Permissions

Charges for failed workspace creation

No. You are not charged for a workspace that fails to be created. You can review your billing details to confirm. For more information, see View your bills.

Charges for idle pay-as-you-go workspaces

Yes. You are charged for a pay-as-you-go workspace even if no deployments are running. This includes workspaces with stopped deployments or those that have been idle since creation. Charges for Realtime Compute for Apache Flink include compute resources and management resources. Even if you have zero compute usage, you are still charged for management resources at a rate of 2 CUs multiplied by the unit price in your region. To stop all charges, you must release the workspace.

If your workload is stable, consider switching to a subscription model. For more information, see Change the billing method.

Calculating consumed CUs

In the development console, navigate to the O&M > Session Clusters page. Calculate the total CPU cores and memory for all session clusters in each namespace.
Calculate the total CPU cores and memory for all session clusters across all namespaces in the workspace.
Calculate the consumed CUs using the following formula: MAX(⌈Total CPU Cores⌉, ⌈Total Memory in GB / 4⌉).

The result matches the consumed CU value displayed in the management console. On the Workspaces list page, you can find the CU usage of each workspace in the Consumed/Purchased CUs column. You can expand a workspace to view the CU allocation details for each namespace. The total consumed CUs for a workspace is the sum of the CUs consumed by each of its namespaces. For example, 9.00 + 18.00 = 27.00.

Billing for unused CUs

For a subscription workspace, you prepay for resources. If you purchase 10 CUs and use only 5, you are still billed for all 10 CUs. In addition, a fixed charge for management resources is applied to each workspace. For more information, see Subscription.

You can adjust your resources based on your business needs, such as by scaling down. For more information, see Scale in resources. You can also switch to the pay-as-you-go model. For more information, see Switch from subscription to pay-as-you-go.
For a pay-as-you-go workspace, you are billed based on the actual resources your workspace consumes. The concept of purchased CUs does not apply.

Switching billing methods

Yes, you can switch between pay-as-you-go and subscription billing methods. In the Realtime Compute for Apache Flink management console, find the workspace, click More in the Actions column, and then select the desired conversion option. For example, select More > Convert To Subscription.

In some cases, switching billing methods is not supported. For example, you cannot switch a workspace that uses the ARM architecture from subscription to pay-as-you-go. For specific restrictions, see the prompts in the console.

The console may prevent you from switching to the pay-as-you-go model for several reasons: the workspace is not in the Running state, it is already a pay-as-you-go workspace, the subscription has expired and requires renewal, it uses the ARM architecture, or it has cross-availability-zone deployment enabled.

Subscription renewal scope

A renewal for Realtime Compute for Apache Flink covers only the service. It does not include charges for other Alibaba Cloud products such as Virtual Private Cloud (VPC), Object Storage Service (OSS), or Application Real-Time Monitoring Service (ARMS). For more information, see Billing of related products.

Billable item	Description
Management resources	When you create a workspace, the system deploys a development console for the workspace. Each development console and its necessary components require about 2 CUs of management resources.
Compute resources	These are the resources available for computation. You are charged based on the resources that you purchase for a subscription workspace or the resources that you use for a pay-as-you-go workspace. The unit of measurement is the CU.

Releasing a workspace

If you no longer need a workspace, you can release it after backing up or migrating your data and ensuring the release will not affect your business.

pay-as-you-go: No overdue payments, or overdue for 15 days or fewer

Click Release Resources in the Actions column of the target workspace and follow the on-screen instructions.
pay-as-you-go: Overdue for more than 15 days

If your payment is overdue for more than 15 days, the workspace is automatically released. All deployment data in the workspace is erased and cannot be recovered.
subscription: Active, or expired for 15 days or fewer

You can submit a ticket to unsubscribe.
subscription: Expired for more than 15 days

The workspace is automatically released. The deployment data is deleted and cannot be recovered. For more information, see Resource changes after expiration.

Charges after releasing a workspace

Bills may be generated with a delay. If you notice charges for a pay-as-you-go workspace after you release it, first view your bill and check the Billing Time. This field, found in your billing details, confirms the actual billing period.

RAM user cannot see deployments

Issue

After a RAM user logs on, the following message appears: "The current account cannot access this namespace. You can refer to the authorization documentation to obtain access permissions."
Cause

The AliyunStreamFullAccess policy grants full permissions for the Realtime Compute for Apache Flink management console, used for purchasing and configuring workspaces. It does not grant permissions for the development console, used for developing and managing deployments. For a detailed comparison of console permissions, see Permission management.
Solution

Ask a member with the owner role for that namespace or a member with user management permissions to grant you the necessary permissions as described in Grant permissions for the development console. After you are granted access, refresh the page or log on again to access the namespace.

Resolving bucket policy access error

Issue

When you upload an artifact, a Server Response Error dialog box appears with the following error details: Failed to parse the response result. [ErrorCode]: InvalidResponse [RequestId]: 6503FEFEDAC9123933E98AFB [HostId]: null [ResponseError]: AccessDenied Access denied by bucket policy., with a status code of 500. The key error is AccessDenied Access denied by bucket policy.
Cause
- The current account does not have the oss:PutBucketCORS permission, which causes the Object Storage Service (OSS) artifact upload to fail.
- A global deny policy in RAM restricts the permissions of the AliyunStreamAsiDefaultRole role. This prevents Realtime Compute for Apache Flink from performing the oss:PutBucketCORS action. This, in turn, prevents the system from automatically configuring Cross-Origin Resource Sharing (CORS) rules, which leads to the OSS artifact upload failure.
Solution
1. If the current account does not have the oss:PutBucketCORS permission, grant this permission to the account. For details, see Grant permissions for the management console.
2. If the account already has the oss:PutBucketCORS permission but the issue persists, check whether a deny policy is configured on the target bucket. If a deny policy exists, adjust the policy to allow Realtime Compute for Apache Flink to perform the oss:PutBucketCORS action.

Authorization redirect loop

Issue

In the Realtime Compute console, you click Purchase Product and are prompted to click Authorize in RAM. However, after you click Authorize in RAM, you are redirected back to the Realtime Compute console, creating an endless loop that also prevents manual authorization.
Cause

You previously manually added the AliyunStreamAsiDefaultRole role, which skips the automatic role-granting process.
Solution

In the RAM console, delete the manually added AliyunStreamAsiDefaultRole role. Then, return to the Realtime Compute for Apache Flink purchase page and click the Authorize in RAM button to complete the authorization. To verify the role, log on to the RAM console, navigate to Identities > Roles, search for Realtime Compute, and then click the role name AliyunStreamAsiDefaultRole. Confirm that the role exists and its description is "This is the default role used by the Realtime Compute fully managed edition (FlinkServerless) to access your resources in other cloud products."

Flink console permissions

You need both RAM permissions and namespace permissions to access the Realtime Compute for Apache Flink consoles for development and operations.

RAM permissions: Required for operations such as purchasing workspaces and adjusting resources.
Namespace permissions: Required for developing and operating deployments within a namespace.

For details on the use cases and differences between these permission types, see Permission management.

Permission denied error on logon

Issue

When you log on to the Realtime Compute console, an error message is displayed: "You are not authorized to perform this operation. You need the following permissions: [stream:DescribeVvpInstances] on [acs:stream:cn-beijing:1418886*********:vvpinstance/*]. Contact your administrator."
Cause

The identity you are using does not have the permissions to view Flink workspaces, or it has permissions only for a specific resource group.
Solution
- If you have permissions only for a specific resource group, select the correct resource group and region from the top navigation bar to view the target workspace.
  
  The resource group selector is the All Resources drop-down menu in the top navigation bar.
- If your identity is not authorized, attach a permission policy that grants the permission to view Flink workspaces to the RAM user or role. For more information, see Grant permissions.
  
  The following permission policies grant permission to view Flink workspaces. You can use either one.
  - System policy: AliyunStreamReadOnlyAccess (read-only access to streaming services) or AliyunStreamFullAccess (full access to streaming services). For more information, see Grant permissions for the management console.
  - Custom policy: stream:DescribeVvpInstances (view workspaces). For more information, see Custom policies.

Restoring service after deleting roles or policies

Follow these steps to rerun the automatic authorization process.

Delete the RAM role named AliyunStreamAsiDefaultRole. For more information, see Delete a RAM role.

Important
You must revoke all permission policies from the role before deleting it.
Delete the FlinkServerlessStack and FlinkOnAckStack stacks. For more information, see Delete a stack.
- FlinkServerlessStack: The unified name for the Resource Orchestration Service (ROS) stack of Realtime Compute for Apache Flink.
- FlinkOnAckStack: The unified name for the ROS stack of Container Service for Kubernetes (ACK).
Delete the RAM policy named AliyunStreamAsiDefaultRolePolicy. For more information, see Delete a custom policy.
In the Realtime Compute console, rerun the automatic authorization process. For more information, see Create a pay-as-you-go workspace.

Resolving "You are not authorized" error

This error indicates that you do not have the required permissions to perform an operation, such as deploying, starting, or stopping a deployment.

This means your account lacks the required permissions for the operation. You can go to Security > Permissions and check the Role Management tab to see which roles have the required permissions and which members are assigned those roles. Then, contact a member with the owner role or role management permissions to grant you access. For more details on roles and their permission dependencies, see Grant permissions for the development console.