Resource Management:Use tags to control access to ECS instances

Background

In a custom policy, authorized tags are specified in the condition block. The following condition keys apply to tags:

• acs:RequestTag/<tag-key>: A tag that must be present in the API request.

• acs:ResourceTag/<tag-key>: A tag that must be attached to the resource being accessed.

Procedure

In this example, a RAM user named Alice can view and manage only ECS instances that carry both the owner:alice and environment:production tags.

Perform these steps with your Alibaba Cloud account or a RAM user that has administrative permissions.

1. Create a RAM user named Alice in the RAM console.

   Create a RAM user.

2. Attach tags to the target ECS instances.

   Attach the owner:alice and environment:production tags to the target ECS instances.

   Use one of the following methods to attach tags:

   • Create and attach the tags in the Tag console. Create a tag, Add tags.

   • Create and attach tags directly to your instances in the ECS console. Create and attach tags.

3. Create a custom policy named UseTagAccessRes in the RAM console.

   Create a policy with the following content. Create a custom policy.

   {
       "Version": "1",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": "ecs:*",
               "Resource": "*",
               "Condition": {
                   "StringEquals": {
                       "acs:ResourceTag/owner": [
                           "alice"
                       ],
                       "acs:ResourceTag/environment": [
                           "production"
                       ]
                   }
               }
           },
           {
               "Effect": "Allow",
               "Action": "ecs:*",
               "Resource": "*",
               "Condition": {
                   "StringEquals": {
                       "acs:RequestTag/owner": [
                           "alice"
                       ],
                       "acs:RequestTag/environment": [
                           "production"
                       ]
                   }
               }
           },
           {
               "Effect": "Allow",
               "Action": [
                   "ecs:List*",
                   "ecs:DescribeInstanceStatus",
                   "ecs:DescribeInstanceVncUrl",
                   "ecs:DescribeInstanceAutoRenewAttribute",
                   "ecs:DescribeInstanceRamRole",
                   "ecs:DescribeInstanceTypeFamilies",
                   "ecs:DescribeInstanceTypes",
                   "ecs:DescribeInstanceAttachmentAttributes",
                   "ecs:DescribeInstancesFullStatus",
                   "ecs:DescribeInstanceHistoryEvents",
                   "ecs:DescribeInstanceMonitorData",
                   "ecs:DescribeInstanceMaintenanceAttributes",
                   "ecs:DescribeInstanceModificationPrice",
                   "ecs:DescribeA*",
                   "ecs:DescribeC*",
                   "ecs:DescribeD*",
                   "ecs:DescribeE*",
                   "ecs:DescribeH*",
                   "ecs:DescribeIm*",
                   "ecs:DescribeInv*",
                   "ecs:DescribeK*",
                   "ecs:DescribeL*",
                   "ecs:DescribeM*",
                   "ecs:DescribeN*",
                   "ecs:DescribeP*",
                   "ecs:DescribeR*",
                   "ecs:DescribeS*",
                   "ecs:DescribeT*",
                   "ecs:DescribeZ*",
                   "vpc:DescribeVpcs",
                   "vpc:DescribeVSwitches"
               ],
               "Resource": "*"
           },
           {
               "Effect": "Deny",
               "Action": [
                   "ecs:DeleteTags",
                   "ecs:UntagResources",
                   "ecs:CreateTags",
                   "ecs:TagResources"
               ],
               "Resource": "*"
           }
       ]
   }

   Policy description:

   Policy	Description
   { "Effect": "Allow", "Action": "ecs:*", "Resource": "*", "Condition": { "StringEquals": { "acs:RequestTag/owner": "alice", "acs:RequestTag/environment": "production" } } }	Allows actions such as creating an instance only if the request includes both the owner:alice and environment:production tags.
   { "Effect": "Allow", "Action": "ecs:*", "Resource": "*", "Condition": { "StringEquals": { "acs:ResourceTag/owner": [ "alice" ], "acs:ResourceTag/environment": [ "production" ] } } }	Allows management operations on ECS instances that carry both the owner:alice and environment:production tags.
   { "Effect": "Allow", "Action": [ "ecs:List*", "ecs:DescribeInstanceStatus", "ecs:DescribeInstanceVncUrl", "ecs:DescribeInstanceAutoRenewAttribute", "ecs:DescribeInstanceRamRole", "ecs:DescribeInstanceTypeFamilies", "ecs:DescribeInstanceTypes", "ecs:DescribeInstanceAttachmentAttributes", "ecs:DescribeInstancesFullStatus", "ecs:DescribeInstanceHistoryEvents", "ecs:DescribeInstanceMonitorData", "ecs:DescribeInstanceMaintenanceAttributes", "ecs:DescribeInstanceModificationPrice", "ecs:DescribeA*", "ecs:DescribeC*", "ecs:DescribeD*", "ecs:DescribeE*", "ecs:DescribeH*", "ecs:DescribeIm*", "ecs:DescribeInv*", "ecs:DescribeK*", "ecs:DescribeL*", "ecs:DescribeM*", "ecs:DescribeN*", "ecs:DescribeP*", "ecs:DescribeR*", "ecs:DescribeS*", "ecs:DescribeT*", "ecs:DescribeZ*", "vpc:DescribeVpcs", "vpc:DescribeVSwitches" ], "Resource": "*" }	Grants permissions to list and describe ECS instances. The console requires these permissions to display instance information before tag-based filters are applied.
   { "Effect": "Deny", "Action": [ "ecs:DeleteTags", "ecs:UntagResources", "ecs:CreateTags", "ecs:TagResources" ], "Resource": "*" }	Denies permissions to create, attach, detach, or delete tags. This prevents the RAM user from bypassing access restrictions by modifying tags.

4. Attach the UseTagAccessRes policy to the RAM user Alice in the RAM console.

   When you grant the permission, set Account to Account, select the RAM user Alice as the Principal, and choose the custom policy UseTagAccessRes. Grant permissions to a RAM user.

Result verification

1. Log in to the ECS console as the RAM user Alice.

   Log on to the Alibaba Cloud console as a RAM user.

2. In the left-side navigation pane, choose Instances & Images > Instance.

3. In the upper-left corner of the top navigation bar, select the region.

4. On the Instance page, click Filter by Tag next to the search bar and select the owner:alice and environment:production tags.

   Important

   The RAM user must filter by the correct tags to view the tagged ECS instances. Otherwise, no instances are displayed.

5. Verify that you can view and manage only the ECS instances that have both the owner:alice and environment:production tags.

References

RAM authorization describes the RAM authentication rules for ECS.