Resource Management:Comparing Resource Directory, Resource Group, and tags

Service

Scenario

Resource isolation

Management level

Cross-account

Resource Directory

Best for multi-account environments.

Use Resource Directory to build a corporate hierarchy and centrally manage accounts and resources across multiple Alibaba Cloud accounts.

Isolates resources at the account level.

Account level.

Resource groups and tags created within one member cannot be used by other members.

Resource Group

Best for single-account environments.

When a single Alibaba Cloud account serves multiple teams or projects using RAM users, Resource Group acts as a container for resource isolation and permission management:

• Resource authorization

• Cost allocation

Isolates resources by using RAM identities and permission policies.

Resource level.

Resource groups created in one Alibaba Cloud account cannot be used by other accounts.

tag

Best for single-account environments.

When a single Alibaba Cloud account serves multiple teams with RAM users, tags help manage resources efficiently:

• Resource identification

• Resource authorization

• Cost allocation

• Automated O&M

Resource level.

Tags created in one Alibaba Cloud account cannot be used by other accounts.

Authentication method

Scenario

Supported services

Example

Resource Group

Add resources to a resource group and grant permissions based on that group. Supports system policies for ease of use, or custom policies for finer control.

Services that work with Resource Group

• Group and authorize resources

• Use a resource group to restrict a RAM user from managing specified ECS instances

tag

Attach tags to resources and grant permissions based on those tags. Requires specifying authorized tags in the Condition element of a custom policy. More flexible but has a steeper learning curve.

Go to the Tag-related capabilities page in the Tag console. In the Tag-based authorization column of the Tag-related Capability Items tab, find the resource types that are marked as Supported.

• ECS: Tag-based authentication

  • Use tags to categorize and manage ECS resources

  • Use tags to grant access to ECS instances by group

• ECI: Tag-based authentication

  • Use tags to authorize RAM users

• Auto Scaling: Tag-based authentication

  • Set management permissions on scaling groups by using tag-based authorization

• Server Migration Center (SMC): Tag-based authentication

  • Implement fine-grained access control by using tags

• ApsaraDB RDS: Tag-based authentication

  • Use tags to grant access to ApsaraDB RDS instances by group