Resource Access Management:Use resource groups to restrict RAM users to managing specific ECS instances

Procedure

The following example grants a RAM user named Alice permission to manage only the ECS instance i-001. The ECS instance is added to a resource group, which is then used to scope the permissions.

Complete the following steps as an account administrator.

1. In the RAM console, create a RAM user named Alice.

   For more information, see Create a RAM user.

2. In the Resource Management console, create a resource group named ECS-Admin.

   For more information, see Create a resource group.

3. In the Resource Management console, add the ECS instance i-001 to the resource group ECS-Admin.

   You can add an ECS instance to a resource group by using either of the following methods:

   • Add the instance to the resource group ECS-Admin when you create it. For more information, see Create an instance by using the wizard.

   • Move an existing ECS instance to the resource group ECS-Admin. For more information, see Transfer resources across resource groups.

4. In the RAM console, grant permissions to the RAM user Alice.

   When you grant the permissions, set Authorized Scope to ECS-Admin, set Principal to the RAM user Alice, and select the AliyunECSFullAccess system policy. For more information, see Grant permissions to a RAM user.

   Note

   As a security best practice, follow the principle of least privilege. Create a custom policy that grants only the required permissions. This minimizes the security risk of excessive permissions.

Verify the results

1. Log on to the ECS console as the RAM user Alice.

   For more information, see Log on to the Alibaba Cloud Management Console as a RAM user.

2. In the left-side navigation pane, choose Instances & Images > Instance.

3. In the upper-left corner of the top menu bar, select the region where your instance is located.

4. In the resource group drop-down list in the upper-left corner of the top menu bar, select the resource group ECS-Admin.

   Important

   The RAM user must select the correct resource group to view its instances. Otherwise, the instance list will be empty.

5. In the instance list, verify that you can manage the ECS instance i-001.

Related topics

• You can move resources associated with an ECS instance to the same resource group, either manually or automatically through the resource transfer feature of Resource Management. Automatic transfer currently supports only cloud disks, elastic network interfaces (ENIs), and Elastic IP addresses (EIPs). For more information, see Transfer associated resources with a primary resource.

• To provision the resources and configure the permissions with Terraform, run the sample code in Terraform Explorer. Terraform Explorer