Billing Costs & Access Permissions FAQ - Realtime Compute for Apache Flink

Common questions about billing and permissions for Realtime Compute for Apache Flink.

Billing
Permissions

Billing

Am I charged when a workspace fails to be created?

No. Failed workspace creation incurs no charges. To review deduction details, view your bills.

Am I charged if I create a pay-as-you-go workspace but don't run any deployments?

Yes. Even deployments that are cancelled or not used incur fees after a pay-as-you-go workspace is created. Fees include billable resource fees and management resource fees. The management resource fee is calculated as:

Management resource fee = 2 CUs x Unit price in the related region

To stop all charges, release the workspace. If your workload is stable, consider switching to subscription billing, which can be more cost-effective. See Switch billing methods.

How do I calculate consumed CUs in a workspace?

To calculate consumed CUs:

In the development console, go to O&M > Session Clusters. Note the CPU cores and memory size for all session clusters in each namespace.
Sum the CPU cores and memory across all session clusters in the workspace.
Apply the formula: MAX (ceil(total CPU cores), ceil(total memory in GB / 4))

The Consumed/Purchased CUs value in the management console reflects this calculation.

If I purchase 10 CUs but only use 5, which amount am I billed for?

It depends on your billing method:

Billing method	How you are charged
Subscription	You pay upfront for reserved capacity. If you purchase 10 CUs but consume only 5, you are billed for the full 10 CUs plus fixed management resources. To reduce costs, reduce your resource quota or switch to pay-as-you-go. See Subscription billing for details.
Pay-as-you-go	You pay only for what you use. No upfront CU purchase is required — the system bills based on actual workspace usage.

Can I switch between subscription and pay-as-you-go?

Yes. In the management console, find the workspace, then choose More > Convert To Subscription Billing Method or Convert To Metered Billing in the Actions column.

One exception: workspaces using the YiTian ARM architecture cannot switch from subscription to pay-as-you-go. Check the console for any restrictions before converting.

What billable items are included when I renew a subscription workspace?

The renewal covers two items. Supporting services such as Virtual Private Cloud (VPC), Object Storage Service (OSS), and Application Real-Time Monitoring Service (ARMS) are billed separately and are not included in the renewal. See Billing rules for supporting services.

Billing item	Description
Management resources	The workspace console and its components, which require approximately 2 CUs.
Compute resources	CUs consumed by your computing tasks, billed on subscription or pay-as-you-go.

How do I release a workspace?

Before releasing, back up or migrate any important data.

Pay-as-you-go workspaces

Account status	Action
No overdue payments, or overdue 15 days or fewer	Find the workspace and choose More > Release Resources in the Actions column.
Overdue more than 15 days	The workspace is automatically released. All data is cleared and cannot be recovered.

Subscription workspaces

Subscription status	Action
Active, or expired 15 days or fewer	Submit a ticket to cancel the subscription.
Expired more than 15 days	The workspace is automatically released. All data is cleared and cannot be recovered. See Resource changes after expiration.

Why am I still being charged after releasing a workspace?

Bill generation has a delay. Check the payment time in your bill to confirm whether the charge predates the release.

Permissions

My RAM user has AliyunStreamFullAccess but still can't view Flink deployments. Why?

AliyunStreamFullAccess covers the management console — purchasing, configuring, and reconfiguring resources. It does not grant access to the development console, where deployments live.

To view and manage deployments, request namespace-level permissions from the namespace owner or a member manager. See Development console permissions. For a comparison of the two consoles and their permission requirements, see Management portal permissions.

How do I fix the "Access denied by bucket policy" error when uploading artifacts?

This error has two possible causes:

Missing RAM permission: Your RAM identity lacks the oss:PutBucketCORS permission. Ask your Alibaba Cloud account owner or RAM administrator to grant it. See Management portal permissions.
Restrictive bucket policy: A global deny policy is blocking the AliyunStreamAsiDefaultRole (Realtime Compute for Apache Flink's service-linked role) from configuring CORS on your OSS bucket. Modify the bucket policy to allow the oss:PutBucketCORS action for AliyunStreamAsiDefaultRole.

Why am I redirected back to the Flink console instead of the RAM console after clicking "Authorize in RAM"?

After clicking Purchase in the Flink management console, the Authorization Request page appears. After clicking Authorize in RAM, you are redirected back to the Flink management console instead of the RAM console, causing manual authorization to fail.

The AliyunStreamAsiDefaultRole role was manually added to your account before authorization. When the system detects the role, it skips the authorization flow and redirects you back.

To fix this, delete the existing AliyunStreamAsiDefaultRole role in the RAM console, then return to the Flink management console and click Authorize in RAM to complete authorization.

What permissions do I need to use Realtime Compute for Apache Flink?

Two types of permissions are required:

RAM permissions: for purchasing workspaces and reconfiguring resources in the management console.
Namespace operation permissions: for draft development and deployment O&M in the development console.

For details on each permission type and when they apply, see Permissions.

I get a permission error when logging on to the Flink management console. What do I do?

If your account has resource group-specific permissions only: Select the correct resource group and its region in the top navigation bar to see the workspace.

If your account lacks workspace view permissions: Grant one of the following to the RAM user or the account the RAM role is assigned to. See Grant permissions to a RAM user.

System policy: AliyunStreamReadOnlyAccess (read-only) or AliyunStreamFullAccess (full access). See Management portal permissions.
Custom policy: stream:DescribeVvpInstances (workspace view only). See Custom policies.

Realtime Compute for Apache Flink became unavailable after I deleted a role or changed authorization policies. How do I recover?

Run automated authorization by completing the following steps:

Check whether the RAM role AliyunStreamAsiDefaultRole is deleted. You must revoke all permissions from the role before deleting it. See Delete a RAM role.
Delete the following Resource Orchestration Service (ROS) stacks. See Delete a stack.
- FlinkServerlessStack: the ROS stack for Realtime Compute for Apache Flink.
- FlinkOnAckStack: the ROS stack for Container Service for Kubernetes (ACK).
Delete the policy AliyunStreamAsiDefaultRolePolicy. See Delete a custom policy.
Log on to the Flink management console and run automated authorization. See Procedure.

I see "You are not authorized to perform the operation. Contact the role administrator for authorization." What do I do?

This error means your account lacks namespace operation permissions — for example, the ability to deploy, start, or stop a deployment.

On the Permissions page, open the Role Management tab to see which roles have the required permissions and who holds them, then contact the namespace owner or a member with role management access. For details on roles and their permissions, see Development console permissions.