XXL-JOB authorization - Microservices Engine - Alibaba Cloud Documentation Center

Grant a RAM user the permissions required to use Microservices Engine (MSE) Task Scheduling XXL-JOB Edition. Access to XXL-JOB requires two separate authorizations: job scheduling permissions, which you grant through a custom policy, and CloudMonitor read-only permissions, which you grant through a system policy.

Important

If you use a Resource Access Management (RAM) user, you must configure both job scheduling permissions and CloudMonitor read-only permissions.

Prerequisites

A RAM user that requires access to XXL-JOB.
The ID of the XXL-JOB instance that you want to authorize, unless you grant permissions on all instances.

Authorization overview

Complete both of the following authorizations for each RAM user that uses XXL-JOB:

Job scheduling permissions — A custom policy that grants the XXL-JOB API actions the RAM user needs.
CloudMonitor read-only permissions — A system policy that grants read-only access to CloudMonitor.

Grant job scheduling permissions

Grant XXL-JOB job scheduling permissions by using a custom policy that combines an account-level statement and an instance-level statement.

Authorization scope requirements

Before you write a custom policy, note the following requirements:

Service prefix — XXL-JOB API actions use the schedulerx3 service prefix in a RAM policy. In a resource path, the cluster resource type refers to an XXL-JOB instance.
Account-level statement — The ListClusters action supports only account-level authorization and cannot be filtered by instance-level permissions. Every policy must grant schedulerx3:ListClusters on the account-level resource path acs:schedulerx3:*:*:*. Do not remove this statement, even when you restrict all other actions to a single instance.
Instance-level statement — All other actions support instance-level and action-level authorization. Use acs:schedulerx3:*:*:cluster/<instance-id> to grant permissions on a single instance, or acs:schedulerx3:*:*:cluster/* to grant permissions on all instances.
Example values — xxljob-0pp1j8om80a in the following examples is an example instance ID. Replace it with the ID of your own instance.

Choose a policy

The following table maps each use case to the corresponding policy example.

Use case	Resource scope	Actions granted	Includes deletion actions
Manage instances, applications, and jobs on one instance	One instance: `cluster/xxljob-0pp1j8om80a`	All actions: `schedulerx3:*`	Yes
Query instances, applications, and jobs on one instance	One instance: `cluster/xxljob-0pp1j8om80a`	Read-only actions: `schedulerx3:List` and `schedulerx3:Get`	No
Query instances, applications, and jobs on all instances	All instances: `cluster/*`	Read-only actions: `schedulerx3:List` and `schedulerx3:Get`	No

The read-write policy grants schedulerx3:*, which includes the deletion actions DeleteCluster, DeleteApp, and DeleteJobs. As a best practice, grant the narrowest scope that the RAM user needs: prefer a read-only policy over a read-write policy, and prefer a single instance over all instances. To grant a subset of actions instead of a wildcard, specify individual action names from the tables in XXL-JOB API actions.

Policy examples

Grant a RAM user read and write permissions on one instance:

{
  "Statement": [
    {
      "Action": "schedulerx3:ListClusters",
      "Resource": "acs:schedulerx3:*:*:*",
      "Effect": "Allow"
    },
    {
      "Action": "schedulerx3:*",
      "Resource": "acs:schedulerx3:*:*:cluster/xxljob-0pp1j8om80a",
      "Effect": "Allow"
    }
  ],
  "Version": "1"
}

Grant a RAM user read-only permissions on one instance:

{
  "Statement": [
    {
      "Action": "schedulerx3:ListClusters",
      "Resource": "acs:schedulerx3:*:*:*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "schedulerx3:List*",
        "schedulerx3:Get*"
      ],
      "Resource": "acs:schedulerx3:*:*:cluster/xxljob-0pp1j8om80a",
      "Effect": "Allow"
    }
  ],
  "Version": "1"
}

Grant a RAM user read-only permissions on all XXL-JOB instances:

{
  "Statement": [
    {
      "Action": "schedulerx3:ListClusters",
      "Resource": "acs:schedulerx3:*:*:*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "schedulerx3:List*",
        "schedulerx3:Get*"
      ],
      "Resource": "acs:schedulerx3:*:*:cluster/*",
      "Effect": "Allow"
    }
  ],
  "Version": "1"
}

Grant CloudMonitor read-only permissions

XXL-JOB is integrated with CloudMonitor by default. Grant your RAM user the system policy for read-only access to CloudMonitor. Otherwise, the RAM user cannot view the scheduling statistics dashboard in Basic Information.

On the Grant Permission page, set Resource Scope to Account Level. In the Permission Policy section, search for "CloudMonitor" and select the system policy AliyunCloudMonitorReadOnlyAccess.

To verify the authorization, log on as the RAM user and confirm that the scheduling statistics dashboard is displayed in Basic Information.

XXL-JOB API actions

The following tables list the XXL-JOB API actions that you can grant in a custom policy, grouped by the authorization scope each action supports. In both tables, Read-only indicates whether the action only reads data. Yes means the action is read-only and is covered by the schedulerx3:List* and schedulerx3:Get* wildcards used in the read-only policy examples.

Actions that support only account-level authorization

The following action supports only account-level authorization and cannot be filtered by instance-level permissions. Grant it on the account-level resource path acs:schedulerx3:*:*:*.

Action	Description	Read-only
ListClusters	Queries the cluster list.	Yes

Actions that support instance-level and action-level authorization

The following actions support instance-level authorization and action-level RAM permissions.

Category	Action	Description	Read-only
Query	ListAppNames	Queries the application name list.	Yes
Query	ListApps	Queries the application list.	Yes
Query	ListCalendarNames	Queries the custom calendar name list.	Yes
Query	ListExecutors	Queries the executor list.	Yes
Query	ListJobs	Queries the job list.	Yes
Query	ListJobExecutions	Queries the job execution list.	Yes
Query	ListScheduleTimes	Queries the next five schedule times.	Yes
Creation	CreateCluster	Creates a cluster.	No
Creation	CreateApp	Creates an XXL-JOB application.	No
Creation	CreateJob	Creates an XXL-JOB job.	No
Update	UpdateCluster	Updates a cluster.	No
Update	UpdateApp	Updates an XXL-JOB application.	No
Update	UpdateJob	Updates an XXL-JOB job.	No
Deletion	DeleteCluster	Deletes a cluster.	No
Deletion	DeleteApp	Deletes an application.	No
Deletion	DeleteJobs	Deletes multiple jobs.	No
O&M operation	OperateDesignateExecutors	Designates executors for a job.	No
O&M operation	OperateDisableJobs	Disables multiple jobs.	No
O&M operation	OperateEnableJobs	Enables multiple jobs.	No
O&M operation	OperateExecuteJob	Runs a job once.	No
O&M operation	OperateRerunJob	Reruns the job executions of a specified time period.	No
O&M operation	OperateRetryJobExecution	Retries failed job executions.	No
O&M operation	OperateStopJobExecution	Stops running job executions.	No