Resource Access Management:Use resource groups to restrict RAM users to managing specific ECS instances

Procedure

This example grants RAM user Alice permission to manage only ECS instance i-001 by adding the instance to a resource group and scoping permissions to that group.

Complete these steps as an account administrator.

1. In the RAM console, create a RAM user named Alice.

   For more information, see Create a RAM user.

2. In the Resource Management console, create a resource group named ECS-Admin.

   For more information, see Create a resource group.

3. In the Resource Management console, add the ECS instance i-001 to the resource group ECS-Admin.

   Add an ECS instance to a resource group in either of the following ways:

   • Add the instance to the resource group ECS-Admin when you create it. For more information, see Create an instance by using the wizard.

   • Move an existing ECS instance to the resource group ECS-Admin. For more information, see Transfer resources across resource groups.

4. In the RAM console, grant permissions to the RAM user Alice.

   Set Authorized Scope to ECS-Admin, set Principal to Alice, and select the AliyunECSFullAccess system policy. For more information, see Grant permissions to a RAM user.

   Note

   As a security best practice, follow the principle of least privilege. Create a custom policy that grants only the required permissions to minimize the risk of excessive access.

Verify the results

1. Log on to the ECS console as the RAM user Alice.

   For more information, see Log on to the Alibaba Cloud Management Console as a RAM user.

2. In the left-side navigation pane, choose Instances & Images > Instance.

3. In the upper-left corner of the top menu bar, select the region where your instance is located.

4. In the resource group drop-down list in the upper-left corner of the top menu bar, select the resource group ECS-Admin.

   Important

   The RAM user must select the correct resource group to view instances in that group. Otherwise, the instance list appears empty.

5. In the instance list, verify that you can manage the ECS instance i-001.

Related topics

• Move resources associated with an ECS instance to the same resource group, either manually or by using the automatic resource transfer feature of Resource Management. Automatic transfer currently supports only cloud disks, elastic network interfaces (ENIs), and Elastic IP addresses (EIPs). For more information, see Transfer associated resources with a primary resource.

• To provision the resources and configure the permissions with Terraform, run the sample code in Terraform Explorer. Terraform Explorer