Resource Management:Comparing Resource Directory, Resource Group, and tags

Service

Scenario

Resource isolation

Management level

Cross-account

Resource Directory

Best for multi-account environments.

Resource Directory lets you build a corporate hierarchy and centrally manage accounts and resources across multiple Alibaba Cloud accounts.

Isolates resources at the account level.

Account level.

Resource groups and tags created within one member cannot be used by other members.

Resource Group

Best for single-account environments.

When a single Alibaba Cloud account serves multiple teams or projects with RAM users, resource groups let you isolate resources and manage permissions:

• Resource authorization

• Cost allocation

Isolates resources by using RAM identities and permission policies.

Resource level.

Resource groups created in one Alibaba Cloud account cannot be used by other accounts.

tag

Best for single-account environments.

When a single Alibaba Cloud account serves multiple teams with RAM users, tags help manage resources efficiently:

• Resource identification

• Resource authorization

• Cost allocation

• Automated O&M

Resource level.

Tags created in one Alibaba Cloud account cannot be used by other accounts.

Authentication method

Scenario

Supported services

Example

Resource Group

Add resources to a resource group and grant permissions based on that group. You can use system policies for simplicity or custom policies for finer control.

Services that work with Resource Group

• Group and authorize resources

• Use a resource group to restrict a RAM user from managing specified ECS instances

tag

Attach tags to resources and grant permissions based on those tags. You must specify the authorized tags in the Condition element of a custom policy. This approach is more flexible but has a steeper learning curve.

Go to the Tag-related capabilities page in the Tag console. In the Tag-based authorization column of the Tag-related Capability Items tab, find the resource types that are marked as Supported.

• ECS: Tag-based authentication

  • Use tags to categorize and manage ECS resources

  • Use tags to grant access to ECS instances by group

• ECI: Tag-based authentication

  • Use tags to authorize RAM users

• Auto Scaling: Tag-based authentication

  • Set management permissions on scaling groups by using tag-based authorization

• Server Migration Center (SMC): Tag-based authentication

  • Implement fine-grained access control by using tags

• ApsaraDB RDS: Tag-based authentication

  • Use tags to grant access to ApsaraDB RDS instances by group