Resource Access Management:Use tags to control access to ECS instances

Background

A custom policy specifies authorized tags in the condition block. The following condition keys apply to tags:

• acs:RequestTag/<tag-key>: A tag that must be included in the API request.

• acs:ResourceTag/<tag-key>: A tag that must be attached to the resource being accessed.

Procedure

This example allows a RAM user named Alice to view and manage only ECS instances with both the owner:alice and environment:production tags.

Complete these steps with your Alibaba Cloud account or a RAM user that has administrative permissions.

1. Create a RAM user named Alice in the RAM console.

   Create a RAM user.

2. Attach tags to the target ECS instances.

   Attach the owner:alice and environment:production tags to the target ECS instances.

   Use one of the following methods to attach tags:

   • Create and attach the tags in the Tag console. Create a tag, Add tags.

   • Create and attach tags directly to your instances in the ECS console. Create and attach tags.

3. Create a custom policy named UseTagAccessRes in the RAM console.

   Create a policy with the following content. Create a custom policy.

   {
       "Version": "1",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": "ecs:*",
               "Resource": "*",
               "Condition": {
                   "StringEquals": {
                       "acs:ResourceTag/owner": [
                           "alice"
                       ],
                       "acs:ResourceTag/environment": [
                           "production"
                       ]
                   }
               }
           },
           {
               "Effect": "Allow",
               "Action": "ecs:*",
               "Resource": "*",
               "Condition": {
                   "StringEquals": {
                       "acs:RequestTag/owner": [
                           "alice"
                       ],
                       "acs:RequestTag/environment": [
                           "production"
                       ]
                   }
               }
           },
           {
               "Effect": "Allow",
               "Action": [
                   "ecs:List*",
                   "ecs:DescribeInstanceStatus",
                   "ecs:DescribeInstanceVncUrl",
                   "ecs:DescribeInstanceAutoRenewAttribute",
                   "ecs:DescribeInstanceRamRole",
                   "ecs:DescribeInstanceTypeFamilies",
                   "ecs:DescribeInstanceTypes",
                   "ecs:DescribeInstanceAttachmentAttributes",
                   "ecs:DescribeInstancesFullStatus",
                   "ecs:DescribeInstanceHistoryEvents",
                   "ecs:DescribeInstanceMonitorData",
                   "ecs:DescribeInstanceMaintenanceAttributes",
                   "ecs:DescribeInstanceModificationPrice",
                   "ecs:DescribeA*",
                   "ecs:DescribeC*",
                   "ecs:DescribeD*",
                   "ecs:DescribeE*",
                   "ecs:DescribeH*",
                   "ecs:DescribeIm*",
                   "ecs:DescribeInv*",
                   "ecs:DescribeK*",
                   "ecs:DescribeL*",
                   "ecs:DescribeM*",
                   "ecs:DescribeN*",
                   "ecs:DescribeP*",
                   "ecs:DescribeR*",
                   "ecs:DescribeS*",
                   "ecs:DescribeT*",
                   "ecs:DescribeZ*",
                   "vpc:DescribeVpcs",
                   "vpc:DescribeVSwitches"
               ],
               "Resource": "*"
           },
           {
               "Effect": "Deny",
               "Action": [
                   "ecs:DeleteTags",
                   "ecs:UntagResources",
                   "ecs:CreateTags",
                   "ecs:TagResources"
               ],
               "Resource": "*"
           }
       ]
   }

   Policy description:

   Policy	Description
   { "Effect": "Allow", "Action": "ecs:*", "Resource": "*", "Condition": { "StringEquals": { "acs:RequestTag/owner": "alice", "acs:RequestTag/environment": "production" } } }	Allows actions, such as creating an instance, only if the request includes both the owner:alice and environment:production tags.
   { "Effect": "Allow", "Action": "ecs:*", "Resource": "*", "Condition": { "StringEquals": { "acs:ResourceTag/owner": [ "alice" ], "acs:ResourceTag/environment": [ "production" ] } } }	Allows management operations on ECS instances with both the owner:alice and environment:production tags.
   { "Effect": "Allow", "Action": [ "ecs:List*", "ecs:DescribeInstanceStatus", "ecs:DescribeInstanceVncUrl", "ecs:DescribeInstanceAutoRenewAttribute", "ecs:DescribeInstanceRamRole", "ecs:DescribeInstanceTypeFamilies", "ecs:DescribeInstanceTypes", "ecs:DescribeInstanceAttachmentAttributes", "ecs:DescribeInstancesFullStatus", "ecs:DescribeInstanceHistoryEvents", "ecs:DescribeInstanceMonitorData", "ecs:DescribeInstanceMaintenanceAttributes", "ecs:DescribeInstanceModificationPrice", "ecs:DescribeA*", "ecs:DescribeC*", "ecs:DescribeD*", "ecs:DescribeE*", "ecs:DescribeH*", "ecs:DescribeIm*", "ecs:DescribeInv*", "ecs:DescribeK*", "ecs:DescribeL*", "ecs:DescribeM*", "ecs:DescribeN*", "ecs:DescribeP*", "ecs:DescribeR*", "ecs:DescribeS*", "ecs:DescribeT*", "ecs:DescribeZ*", "vpc:DescribeVpcs", "vpc:DescribeVSwitches" ], "Resource": "*" }	Grants permissions to list and describe ECS instances. The console needs these permissions to display instance information before applying tag-based filters.
   { "Effect": "Deny", "Action": [ "ecs:DeleteTags", "ecs:UntagResources", "ecs:CreateTags", "ecs:TagResources" ], "Resource": "*" }	Denies permissions to create, attach, detach, or delete tags. Prevents the RAM user from bypassing access restrictions by modifying tags.

4. Attach the UseTagAccessRes policy to the RAM user Alice in the RAM console.

   When you grant the permission, set Account to Account, select the RAM user Alice as the Principal, and choose the custom policy UseTagAccessRes. Grant permissions to a RAM user.

Result verification

1. Log in to the ECS console as the RAM user Alice.

   Log on to the Alibaba Cloud console as a RAM user.

2. In the left-side navigation pane, choose Instances & Images > Instance.

3. In the upper-left corner of the top navigation bar, select the region.

4. On the Instance page, click Filter by Tag next to the search bar and select the owner:alice and environment:production tags.

   Important

   The RAM user must filter by the correct tags to view the tagged ECS instances. Otherwise, no instances appear.

5. Verify that you can view and manage only the ECS instances that have both the owner:alice and environment:production tags.

References

RAM authorization documents the RAM authentication rules for ECS.