Realtime Compute for Apache Flink:Billing and permissions

• Billing

  • Will I be charged if a workspace fails to be created?

  • Am I charged for an idle pay-as-you-go workspace?

  • How do I calculate the consumed CUs for a workspace?

  • If I purchase 10 CUs for my subscription workspace but use only 5, how am I billed?

  • Can I switch a workspace between subscription and pay-as-you-go billing methods?

  • What is included in a Realtime Compute for Apache Flink subscription renewal?

  • How do I release a Flink workspace?

  • Why am I still being charged after releasing a workspace?

• Permissions

  • Why can't a RAM user see deployments after being granted the AliyunStreamFullAccess policy?

  • Why can't I navigate to the RAM console when I click Authorize in RAM?

  • What permissions are required to access the Flink console?

  • What should I do if an "insufficient permissions" error occurs when I log on to the console?

  • What should I do if the service becomes unavailable after I accidentally delete a role or change an authorization policy?

  • What should I do if the error message "You are not authorized to perform this operation. Contact the role administrator for authorization" appears?

Will I be charged if a workspace fails to be created?

No, you are not charged for a failed workspace creation. You can view your bill to see a detailed breakdown of charges. For more information, see View bills.

Am I charged for an idle pay-as-you-go workspace?

Yes. You are charged for a pay-as-you-go workspace after it is created, even if no deployments are running (for example, if deployments are stopped or the workspace is unused). Charges for a Flink workspace include fees for computing resources and management resources. Even if there are no fees for computing resources, you are still charged for management resources at a rate of 2 CUs multiplied by the unit price for your region per hour. To stop all charges, you must release the workspace.

If your business has a stable data volume, you can switch to the subscription billing method to optimize costs. For more information, see Switch billing methods.

How do I calculate the consumed CUs for a workspace?

1. On the O&M > Session Clusters page, calculate the sum of CPU cores and memory for all session clusters within each namespace.

2. Calculate the total sum of CPU cores and memory for all session clusters across all namespaces in the workspace.

3. Use the following formula to calculate the total consumed CUs for the workspace: MAX(⌈Total CPU Cores⌉, ⌈Total Memory in GB / 4⌉).

   The calculated number of consumed CUs matches the value displayed in the management console. On the workspace list page of Fully-managed Flink, the Consumed/Purchased CUs column shows the consumed CUs for each workspace. You can expand a workspace to view the CU consumption details for each namespace. The total CUs consumed by a workspace is the sum of the CUs consumed by all its namespaces. For example, a workspace has consumed 27.00 CUs, and it contains two namespaces that have consumed 9.00 and 18.00 CUs respectively.

If I purchase 10 CUs for my subscription workspace but use only 5, how am I billed?

• The subscription billing method is a prepaid model where you pay for resources in advance based on the subscription duration and resource amount. If you purchase 10 CUs but use only 5 CUs, you are still billed for the computing resources based on the 10 CUs you purchased. In addition, each workspace incurs a fixed fee for management resources. For more information, see Subscription.

  You can adjust your resources (for example, by scaling down) based on your actual business needs. For more information, see Scale down resources. You can also switch to the pay-as-you-go billing method if needed. For more information, see Switch from subscription to pay-as-you-go.

• The pay-as-you-go billing method is a postpaid model. The system bills you based on the actual resource usage of your workspace. There are no purchased CUs in this model.

Can I switch a workspace between subscription and pay-as-you-go billing methods?

Yes, you can switch between the pay-as-you-go and subscription billing methods. In the Realtime Compute for Apache Flink management console, find the target workspace, and in the Actions column, click More and select the appropriate conversion option. For example, choose More > Convert to Subscription.

In some cases, conversion is not supported. For example, you cannot switch from subscription to pay-as-you-go for workspaces that use the ARM architecture. For specific limitations, refer to the prompts in the console.

What is included in a Realtime Compute for Apache Flink subscription renewal?

A subscription renewal for Realtime Compute for Apache Flink does not include fees for other cloud products such as VPC, OSS, and ARMS. For more information about the billing of related products, see Billing of related products.

How do I release a Flink workspace?

If you no longer need a workspace, you can release it. Before doing so, ensure that your data is backed up or migrated and that the release will not affect your business.

• Pay-as-you-go: No overdue payments or overdue for 15 days or less

  In the Actions column of the target workspace, click Release Resources and follow the on-screen instructions.

• Pay-as-you-go: Overdue for more than 15 days

  If your payment is more than 15 days overdue, the workspace is considered abandoned and is automatically released. All deployment data is then deleted and cannot be recovered.

• Subscription: Not expired or expired for 15 days or less

  To unsubscribe, submit a ticket.

• Subscription: Expired for more than 15 days

  If a subscription has been expired for more than 15 days, the workspace is automatically released. All deployment data is deleted and cannot be recovered. For more information, see Resource changes after expiration.

Why am I still being charged after releasing a workspace?

Bill generation may be delayed. If you are still being charged for a pay-as-you-go workspace after it has been released, first view your bill and check the Billing Time.

On the Billing Details page, the Billing Time column shows a time range, such as 2023-12-11 17:00:00 to 2023-12-11 18:00:00. This range indicates the actual period when the charges were incurred.

Why can't a RAM user see deployments after being granted the AliyunStreamFullAccess policy?

• Symptom

  After a RAM user logs on, the following message is displayed: "Your account does not have the permissions to access this namespace. You can refer to the Authorization Documentation to obtain access permissions."

• Cause

  The AliyunStreamFullAccess policy grants full permissions for the Realtime Compute for Apache Flink management console. This policy is used for operations such as purchasing and configuring workspaces. However, this policy does not grant permissions for the development console, where you develop and manage deployments. For more information about the differences and permission requirements for each console, see Permissions.

• Solution

  Contact a member who has the owner role for the namespace or a member with permission to manage roles. Ask them to grant you the necessary permissions as described in Authorize users in the development console. After you are granted the permissions, refresh the page or log on again to access the namespace.

Why can't I navigate to the RAM console when I click Authorize in RAM?

• Symptom

  In the Realtime Compute console, when you click Purchase Product, you are prompted to grant permissions by clicking Go to RAM for authorization. After you click Go to RAM for authorization, you are redirected back to the Realtime Compute console. This process results in an infinite loop, and manual authorization is also ineffective.

• Cause

  The automatic role granting process is skipped because the AliyunStreamAsiDefaultRole role was previously added manually.

• Solution

  Delete the manually added AliyunStreamAsiDefaultRole role in the RAM console, and then use the Authorize in RAM button on the Realtime Compute for Apache Flink purchase page to grant the permissions. To do this, log on to the RAM console. In the left-side navigation pane, choose Identities > Roles. Search for Realtime Compute to find the role named AliyunStreamAsiDefaultRole.

What permissions are required to access the Flink console?

To access the Realtime Compute for Apache Flink console and perform development and O&M tasks, you need both RAM permissions and namespace permissions.

• RAM permissions: Used for operations such as purchasing workspaces and adjusting resources.

• Namespace permissions: Used for operations such as deployment development and O&M within a namespace.

For more information about the use cases and differences between these two types of permissions, see Permissions.

What should I do if an "insufficient permissions" error occurs when I log on to the console?

• Symptom

  When logging on to the Realtime Compute for Apache Flink console, an error message appears: "You are not authorized to perform this operation. Action: stream:DescribeVvpInstances, Resource: acs:stream:cn-beijing:1418886*********:vvpinstance/*. Please contact the administrator of the master account."

  

• Cause

  The current identity lacks the permission to view Flink workspaces, or it has permissions only for a specific resource group.

• Solution

  • If you have permissions only for a specific resource group, select the corresponding resource group and region in the console's top navigation bar to view the target workspace.

    

  • If the current identity is not authorized, add a policy that grants permission to view Flink workspaces to the corresponding RAM user or role. For more information, see Grant permissions to a RAM user.

    The following policies include the permission to view Flink workspaces. You can add either of them.

    • System policy: AliyunStreamReadOnlyAccess (Read-only access to Realtime Compute for Apache Flink) or AliyunStreamFullAccess (Full access to Realtime Compute for Apache Flink). For more information, see Authorize users in the management console.

    • Custom policy: stream:DescribeVvpInstances (View workspaces). For more information, see Create a custom policy.

What should I do if the service becomes unavailable after I accidentally delete a role or change an authorization policy?

To restore service, re-run the automatic authorization process:

1. Confirm that the RAM role AliyunStreamAsiDefaultRole has been deleted. For more information, see Delete a RAM role.

   Important

   You must revoke all permissions from the role before you can successfully delete it.

2. Delete the stacks named FlinkServerlessStack and FlinkOnAckStack. For more information, see Delete a stack.

   • FlinkServerlessStack: The standard name for the Resource Orchestration Service (ROS) stack of Realtime Compute for Apache Flink.

   • FlinkOnAckStack: The standard name for the ROS stack of ACK.

3. Delete the RAM policy named AliyunStreamAsiDefaultRolePolicy. For more information, see Delete a custom policy.

4. In the Realtime Compute for Apache Flink console, run the automatic authorization again. For more information, see Create a pay-as-you-go workspace.

What should I do if the error message "You are not authorized to perform this operation. Contact the role administrator for authorization" appears?

This error indicates that your account lacks the permissions to use a feature or perform an operation, such as creating, starting, or stopping a deployment.

You can go to the Security > Permissions page and click the Role Management tab to view the permissions of different roles and the members assigned to them. Then, contact a member with the owner role or role management permissions to grant you the required permissions. For more information about roles and their permission dependencies, see Authorize users in the development console.