Automate Resource Account Creation with CreateResourceAccount API - Resource Management - Alibaba Cloud - Resource Management

Creates a member of the resource account type by calling CreateResourceAccount.

Operation description

In a resource directory, a member serves as a resource container and is a unit for resource grouping. A member typically represents a project or application. Resources in each member are physically isolated from resources in other members.

This topic provides an example of how to create a member in the folder fd-r23M55****. The display name of the member is Dev, and the account name prefix is alice.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

resourcemanager:CreateResourceAccount

create

*Folder

acs:resourcemanager:*:{#accountId}:folder/{#ResourceDirectoryPath}

None

Request parameters

Parameter	Type	Required	Description	Example
DisplayName	string	Yes	The display name of the member. Length: 2 to 50 characters. Format: Can contain letters, digits, underscores (_), periods (.), hyphens (-), and spaces. The display name must be unique within the resource directory.	Dev
ParentFolderId	string	No	The ID of the parent folder.	fd-r23M55****
PayerAccountId	string	No	The ID of the billing account. If you leave this parameter empty, the newly created member pays for its own resource consumption.	12323344****
AccountNamePrefix	string	No	The prefix of the account name. If you leave this parameter empty, the system randomly generates a prefix. Length: 2 to 37 characters. Format: Can contain letters, digits, and special characters `_.-`. Must start and end with a letter or digit. Consecutive special characters `_.-` are not allowed. The full account name is in the format of @.aliyunid.com, such as `alice@rd-3G****.aliyunid.com`. The account name must be unique within the resource directory.	alice
Tag	array<object>	No	The tags of the member.
	object	No	The tags of the member.
Key	string	No	The tag key.	k1
Value	string	No	The tag value.	v1
ResellAccountType	string	No	The identity type of the member. Valid values: resell (default): reseller account. The created member automatically establishes a reseller relationship with your reseller. You must use the management account to pay for the new member. non_resell: non-reseller account. The created member is a regular Alibaba Cloud account that is not associated with your current reseller. The account purchases resources directly from Alibaba Cloud and pays for its own resource consumption. Note This parameter is supported only for China site (Chinese mainland) reseller customers.	resell
DryRun	boolean	No	Specifies whether to perform only a dry run for the request. Valid values: true: performs a dry run without actually creating the member. The check currently includes whether the current account is allowed to set the identity type of the member. If the check fails, the corresponding error code is returned. false (default): sends the request. If the check passes, the member is created.	false

For more information about common request parameters, see Common parameters.

Response elements

Element	Type	Description	Example
	object	The response parameters.
Account	object	The member information.
Status	string	The join status of the member. The value CreateSuccess indicates that the member is created.	CreateSuccess
Type	string	The type of the member. The value ResourceAccount indicates a resource account.	ResourceAccount
DisplayName	string	The display name of the member.	Dev
FolderId	string	The ID of the folder.	fd-r23M55****
ResourceDirectoryId	string	The ID of the resource directory.	rd-3G****
JoinTime	string	The time when the member joined the resource directory (UTC).	2020-12-31T03:37:39.456Z
AccountId	string	The ID of the member.	112730938585****
JoinMethod	string	The way in which the member joined the resource directory. Valid values: invited: invited. created: created.	created
ModifyTime	string	The time when the member was last modified (UTC).	2020-12-31T03:37:39.456Z
AccountName	string	The name of the account.	alice@rd-3g****.aliyunid.com
RequestId	string	The request ID.	B356A415-D860-43E5-865A-E2193D62BBD6

Examples

Success response

JSON format

{
  "Account": {
    "Status": "CreateSuccess",
    "Type": "ResourceAccount",
    "DisplayName": "Dev",
    "FolderId": "fd-r23M55****",
    "ResourceDirectoryId": "rd-3G****",
    "JoinTime": "2020-12-31T03:37:39.456Z",
    "AccountId": "112730938585****",
    "JoinMethod": "created",
    "ModifyTime": "2020-12-31T03:37:39.456Z",
    "AccountName": "alice@rd-3g****.aliyunid.com"
  },
  "RequestId": "B356A415-D860-43E5-865A-E2193D62BBD6"
}

Error codes

HTTP status code	Error code	Error message	Description
400	MissingParameter.Account.DisplayName	You must specify DisplayName.	The DisplayName parameter is not configured. Configure this parameter.
400	InvalidParameter.Account.DisplayName	The DisplayName of account is invalid.	The value of the DisplayName parameter is invalid. The value can contain only letters, digits, underscores (_), periods (.), and hyphens (-).
400	InvalidParameter.Account.DisplayName.Length	The DisplayName of the account exceeds the length limit.	The length of the value for the DisplayName parameter exceeds the upper limit. The value must be 2 to 50 characters in length.
400	InvalidParameter.ParentFolderId	The ParentFolderId is invalid.	The value of the ParentFolderId parameter is invalid. The value must start with r- followed by 6 characters or start with fd- followed by 10 characters. Valid characters include letters and digits.
400	InvalidParameter.Account.AccountNamePrefix	The account name prefix is invalid.
400	InvalidParameter.Account.AccountNamePrefix.Length	The account name prefix exceeds the length limit.
400	NotSupport.Site.Action	Site does not allow current action.	Site does not allow current action.
404	EntityNotExists.ResourceDirectory	The resource directory for the account is not enabled. We recommend that you first enable the resource directory for the account.	The account is not used to enable a resource directory. Use the account to enable a resource directory first.
404	EntityNotExists.Folder	The resource directory folder does not exist.	The specified folder does not exist. Create such a folder first.
409	LimitExceeded.Account	The maximum number of member accounts in a resource directory exceeds the limit.	The number of members in the resource directory exceeds the upper limit.
409	InvalidParameter.Account.DisplayName.AlreadyUsed	The displayname of account has been used.	The displayname of account has been used.
409	EntityAlreadyExists.ResourceDirectory.Account	The email address that the system generates when you create a member account already exists. Try again later.	The email address that is generated by the system when the member is created already exists. Try again later.
409	Invalid.PayRelation	Failed to create a member. The specified billing account is unavailable. Please change to another billing account and try again.	Failed to create the member. The specified billing account is unavailable. Specify a valid billing account and try again.
409	NotSupport.PayerAccountInAnotherResourceDirectory	The specified settlement account does not exist in the resource directory. You must specify a valid settlement account.
409	CreateAccountDisabled	The specified resource directory cannot create a new account.
409	PaymentAccountEnterpriseVerifyError	The type of the payment account is not enterprise verified.	The billing account does not pass enterprise real-name verification.
409	PaymentAccountFinancialRelationshipVerifyError	The payment account must not be the beneficiary account from other financial relationships.	A billing account cannot be associated with a financial account.
409	PaymentAccountEnterpriseTypeError	The type of the payment account is not enterprise.	The billing account is not an enterprise account.
409	PaymentAccountFinancialRelationshipsChangeFrequencyVerifyError	The financial relationship of payment account changes too frequently. Please try again later.	The financial relationship of the billing account frequently changes. Try again later.
409	MemberAccountVirtualCloudOperatorVerifyError	The type of the member account must not be virtual operator.
409	MemberAccountResellerVerifyError	The type of the member account must not be reseller.
409	PaymentAccountVirtualCloudOperatorVerifyError	The type of the payment account must not be virtual operator.	A billing account cannot be an account for a virtual network operator (VNO).
409	PaymentAccountResellerVerifyError	The type of the payment account must not be reseller.	The billing account cannot be an account for a reseller.
409	PaymentAccountCreditIdentityTypeError	The identity of the payment account is not credit.
409	InconsistentEnterpriseNameError	The enterprise name of the payment account and the member account must be consistent.
409	PaymentAccountEnterpriseInvoiceError	No enterprise invoice header information is set for the payment account.	No invoice title information is specified for the billing account.
409	UnknownFinancialError	An unknown financial error occurred.	An unknown financial error occurred.
409	BusinessRestricted	Business is restricted. Please contact your customer service manager.	Your business is limited. Contact your customer business manager (CBM).
409	FundAccountHasArrearsAmount	There are arrears in the current payment account. You cannot change the payment account. Please settle the arrears and try again.	There are arrears in the current payment account. You cannot change the payment account. Please settle the arrears and try again.
409	FundAccountOwnerPayedByOthers	If the payment has been made by another account, it is not allowed to be used as the main payment account.	If the payment has been made by another account, it is not allowed to be used as the main payment account.
409	UserOwnFundAccountPayForOthers	If the account has been used as the main payment account, it is not allowed to set up payment by others.	If the account has been used as the main payment account, it is not allowed to set up payment by others.
409	EcoRelationCheckFailed	Accounts associated with partners are not allowed to set up agency payment relationships.	Accounts associated with partners are not allowed to set up agency payment relationships.
409	NotSupport.SettingResellAccountType	The current account does not support setting the resellAccountType for members.	The current account does not support setting the resellAccountType for members.
409	InvalidParameter.Email.AlreadyUsed	The email has been used.	The email has been used.

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.