This topic lists the cloud services that support resource group-level authorization and their resource types. It also identifies unsupported operations and provides custom policy examples to help you achieve fine-grained resource control. - Resource Management

This topic lists the cloud services and resource types that support resource group-level authorization and identifies the operations that are not supported.

Overview

You can use resource groups to manage resources in your Alibaba Cloud account by group. For example, you can create a resource group for each project and move the project resources into the corresponding groups for centralized management. For more information, see What is a resource group?.

After grouping resources, you can grant permissions on a specific resource group to different RAM principals (such as RAM users, RAM user groups, or RAM roles), which restricts them to managing only the resources within that group. For more information, see Resource grouping and authorization.

The following table lists the cloud services that support resource group-level authorization. The columns are described as follows:

Cloud service: The name of the cloud service.
Service code: The code that corresponds to the cloud service.
Supported resource types: Resource types that support this authorization.
Unsupported operations and custom policy examples: The actions that do not support resource group-level authorization and sample custom policies.

Important
If you grant permissions for an unsupported operation at the Resource group-level, the request is denied due to insufficient permissions.

Solution: Create a custom permission policy that includes the required actions. Refer to the provided samples for guidance. When you grant permissions, set the resource scope to the account level.

Cloud service	Service code	Supported resource types	Unsupported actions
Alibaba Cloud Distributed Cloud Container Platform	ackone	Resource types that support resource groups	Operations that do not support resource group-level authorization
AnalyticDB for MySQL	adb	Resource types that support resource groups	Operations that do not support resource group-level authorization
Application Load Balancer	alb	Resource types that support resource groups	Operations that do not support resource group-level authorization
Alibaba Cloud DNS	alidns	Resource types that support resource groups	Operations that do not support resource group-level authorization
ApsaraMQ for Kafka	alikafka	Resource types that support resource groups	Operations that do not support resource group-level authorization
API Gateway	apig	Resource types that support resource groups	Operations that do not support resource group-level authorization
Application Real-Time Monitoring Service (ARMS)	arms	Resource types that support resource groups	Operations that do not support resource group-level authorization
Shared Bandwidth Plan	bandwidthpackage	Resource types that support resource groups	Operations that do not support resource group-level authorization
Cloud Architect Design Tool (CADT)	bpstudio	Resource types that support resource groups	Operations that do not support resource group-level authorization
ChatApp Message Service	cams	Resource types that support resource groups	Operations that do not support resource group-level authorization
Alibaba Cloud CDN	cdn	Resource types that support resource groups	Operations that do not support resource group-level authorization
Cloud Enterprise Network (CEN)	cen	Resource types that support resource groups	Operations that do not support resource group-level authorization
Logical Composer	composer	Resource types that support resource groups	Operations that do not support resource group-level authorization
Compute Nest	computenest	Resource types that support resource groups	Operations that do not support resource group-level authorization
Container Registry (ACR)	cr	Resource types that support resource groups	Operations that do not support resource group-level authorization
Container Service for Kubernetes (ACK)	cs	Resource types that support resource groups	Operations that do not support resource group-level authorization
Database Backup (DBS)	dbs	Resource types that support resource groups	Operations that do not support resource group-level authorization
Dynamic Route for CDN (DCDN)	dcdn	Resource types that support resource groups	Operations that do not support resource group-level authorization
ApsaraDB for MongoDB	dds	Resource types that support resource groups	Operations that do not support resource group-level authorization
DataWorks	dide	Resource types that support resource groups	Operations that do not support resource group-level authorization
Domains	domain	Resource types that support resource groups	Operations that do not support resource group-level authorization
Data Transmission Service (DTS)	dts	Resource types that support resource groups	Operations that do not support resource group-level authorization
Elastic Block Storage	ebs	Resource types that support resource groups	Operations that do not support resource group-level authorization
Elastic Container Instance (ECI)	eci	Resource types that support resource groups	Operations that do not support resource group-level authorization
Elastic Compute Service (ECS)	ecs	Resource types that support resource groups	Operations that do not support resource group-level authorization
Elastic IP Address (EIP)	eip	Resource types that support resource groups	Operations that do not support resource group-level authorization
Anycast EIP	eipanycast	Resource types that support resource groups	Operations that do not support resource group-level authorization
Alibaba Cloud Elasticsearch	elasticsearch	Resource types that support resource groups	Operations that do not support resource group-level authorization
E-MapReduce	emr	Resource types that support resource groups	Operations that do not support resource group-level authorization
Auto Scaling	ess	Resource types that support resource groups	Operations that do not support resource group-level authorization
Express Connect	expressconnect	Resource types that support resource groups	Operations that do not support resource group-level authorization
Realtime Compute for Apache Flink	flinkasi	Resource types that support resource groups	Operations that do not support resource group-level authorization
Global Accelerator (GA)	ga	Resource types that support resource groups	Operations that do not support resource group-level authorization
AnalyticDB for PostgreSQL	gpdb	Resource types that support resource groups	Operations that do not support resource group-level authorization
Gateway Load Balancer (GWLB)	gwlb	Resource types that support resource groups	Operations that do not support resource group-level authorization
Hybrid Backup Recovery (HBR)	hbr	Resource types that support resource groups	Operations that do not support resource group-level authorization
Tair (Redis^®-compatible)	kvstore	Resource types that support resource groups	Operations that do not support resource group-level authorization
Log Service (SLS)	log	Resource types that support resource groups	Operations that do not support resource group-level authorization
Microservices Engine (MSE)	mse	Resource types that support resource groups	Operations that do not support resource group-level authorization
ApsaraDB for HBase	multimod	Resource types that support resource groups	Operations that do not support resource group-level authorization
Apsara File Storage NAS	nas	Resource types that support resource groups	Operations that do not support resource group-level authorization
Network Intelligence	netana	Resource types that support resource groups	Operations that do not support resource group-level authorization
Network Load Balancer (NLB)	nlb	Resource types that support resource groups	Operations that do not support resource group-level authorization
Operation Orchestration Service (OOS)	oos	Resource types that support resource groups	Operations that do not support resource group-level authorization
Object Storage Service (OSS)	oss	Resource types that support resource groups	Operations that do not support resource group-level authorization
Tablestore	ots	Resource types that support resource groups	Operations that do not support resource group-level authorization
Platform for AI (PAI)	paiworkspace	Resource types that support resource groups	Operations that do not support resource group-level authorization
PrivateLink	privatelink	Resource types that support resource groups	Operations that do not support resource group-level authorization
ApsaraDB RDS	rds	Resource types that support resource groups	Operations that do not support resource group-level authorization
ApsaraMQ for RocketMQ	rocketmq	Resource types that support resource groups	Operations that do not support resource group-level authorization
Resource Orchestration Service (ROS)	ros	Resource types that support resource groups	Operations that do not support resource group-level authorization
ApsaraDB for SelectDB	selectdb	Resource types that support resource groups	Operations that do not support resource group-level authorization
Server Load Balancer (SLB)	slb	Resource types that support resource groups	Operations that do not support resource group-level authorization
Smart Access Gateway (SAG)	smartag	Resource types that support resource groups	Operations that do not support resource group-level authorization
Server Migration Center (SMC)	smc	Resource types that support resource groups	Operations that do not support resource group-level authorization
EMR Serverless StarRocks	starrocks	Resource types that support resource groups	Operations that do not support resource group-level authorization
ApsaraVideo VOD	vod	Resource types that support resource groups	Operations that do not support resource group-level authorization
Virtual Private Cloud (VPC)	vpc	Resource types that support resource groups	Operations that do not support resource group-level authorization

Submit feedback

If you need support for resource types or operations not listed here, submit your feedback in the Resource Group console.

For Issue Type, select Unsupported product or resource type. In the description field, enter the unsupported product or resource type, and then click Submit.