Use tags to authorize ECS instances by group - Resource Access Management

Use tags to group ECS instances and grant RAM users access to only their assigned instances.

Use case

Your Alibaba Cloud account owns 10 ECS instances. You want to grant the developer team access to five instances and the operator team access to the other five, with each team restricted to viewing and managing only its assigned instances.

Solution

Use tags to identify the ECS instances for different teams.

Create two tags to identify the instances for the developer and operator teams.
Group RAM users.

Create two RAM user groups named developer and operator, then add each team's RAM users to the corresponding group.
Grant permissions to RAM user groups based on tags.

Create two custom policies that use the Condition element with tag-based conditions to define the resource scope, then attach each policy to the corresponding group. RAM users in a group inherit the group's policy permissions.
- acs:RequestTag/<tag-key>: A tag that must be included in the API request.
- acs:ResourceTag/<tag-key>: A tag that must be attached to the resource being accessed.

The following table lists the resource plan.

Team	RAM user group	RAM policy	Tag
developer team	developer	policyForDevTeam	tag key: team, tag value: dev
operator team	operator	policyForOpsTeam	tag key: team, tag value: ops

Procedure

Sign in with an Alibaba Cloud account or a RAM user that has AliyunRAMFullAccess and AliyunECSFullAccess permissions.

In the ECS console, create and bind tags to your ECS instances.

Bind the tag team:dev to five ECS instances and the tag team:ops to the other five instances. Create and bind tags.
In the RAM console, create RAM user groups.

Create two RAM user groups: developer and operator. Create a RAM user group.
In the RAM console, create RAM users and add them to their corresponding RAM user groups.

Create RAM users for each team and add them to the developer or operator group. Create a RAM user. Add a RAM user to a RAM user group.

In the RAM console, create custom policies.

Create two custom policies: policyForDevTeam and policyForOpsTeam. Create a custom policy.

policyForDevTeam policy document:

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "ecs:*",
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "acs:RequestTag/team": [
                        "dev"
                    ]
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": "ecs:*",
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "acs:ResourceTag/team": [
                        "dev"
                    ]
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [
                "ecs:DescribeTags",
                "ecs:ListTagResources"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Deny",
            "Action": [
                "ecs:DeleteTags",
                "ecs:UntagResources",
                "ecs:CreateTags",
                "ecs:TagResources"
            ],
            "Resource": "*"
        }
    ]
}

policyForOpsTeam policy document:

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "ecs:*",
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "acs:RequestTag/team": [
                        "ops"
                    ]
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": "ecs:*",
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "acs:ResourceTag/team": [
                        "ops"
                    ]
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [
                "ecs:DescribeTags",
                "ecs:ListTagResources"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Deny",
            "Action": [
                "ecs:DeleteTags",
                "ecs:UntagResources",
                "ecs:CreateTags",
                "ecs:TagResources"
            ],
            "Resource": "*"
        }
    ]
}

The following table describes each policy statement.

Policy statement	Description
`{ "Effect": "Allow", "Action": "ecs:", "Resource": "", "Condition": { "StringEquals": { "acs:RequestTag/team": [ "dev" ] } } }`	Allows users to filter for ECS instances that have the `team:dev` tag.
`{ "Effect": "Allow", "Action": "ecs:", "Resource": "", "Condition": { "StringEquals": { "acs:ResourceTag/team": [ "dev" ] } } }`	Allows management operations on ECS instances that have the `team:dev` tag.
`{ "Effect": "Allow", "Action": [ "ecs:DescribeTags", "ecs:ListTagResources" ], "Resource": "*" }`	Allows users to view all tags on ECS instances. Note If you do not need to list all tags, remove this statement. Without it, users can still filter ECS instances by manually entering a tag key and value.
`{ "Effect": "Deny", "Action": [ "ecs:DeleteTags", "ecs:UntagResources", "ecs:CreateTags", "ecs:TagResources" ], "Resource": "*" }`	Denies permissions to delete, unbind, create, and bind tags. Prevents RAM users from modifying tags and losing access to resources.

Grant permissions to the RAM user groups.

Attach policyForDevTeam to the developer group and policyForOpsTeam to the operator group. Grant permissions to a RAM user group.

Note
RAM users automatically inherit permissions from their group.

Verify the results

Log on to the ECS console as a RAM user.
In the left-side navigation pane, choose Instances & Images > Instance.
In the top navigation bar, select a region.
On the Instance page, click Filter by Tag next to the search box, and then select the appropriate tag key and value.

For example, a RAM user in the developer group can filter for authorized instances by selecting the team:dev tag.

Important
RAM users can only view ECS instances that match their authorized tag. Without the tag filter, the instance list appears empty.
View and manage the authorized ECS instances.

More information

You can apply the same tag-based authorization to other ECS resources, such as block storage, snapshots, images, security groups, elastic network interfaces, dedicated hosts, and SSH key pairs.