All Products
Search

This Product

    Resource Orchestration Service:ListStackOperationRisks

    Document Center

    Resource Orchestration Service:ListStackOperationRisks

    Last Updated:Jun 03, 2026

    Detects stack-related operation risks and returns missing permissions and the causes of the risks.

    Operation description

    The ListStackOperationRisks operation is suitable for the following scenarios:

    • You want to detect high risks that may arise in resources when you delete a stack that contains the resources, and query the cause of each risk in a resource.

    • When you create a stack, the creation may fail. In this case, you can call this operation to check which types of permissions that are required to create stacks are missing.

    Try it now

    Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

    Test

    RAM authorization

    The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

    • Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.

    • API: The API that you can call to perform the action.

    • Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.

    • Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.

      • For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.

      • For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.

    • Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.

    • Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

    Action

    Access level

    Resource type

    Condition key

    Dependent action

    ros:ListStackOperationRisks

    get

    *stack

    acs:ros:{#regionId}:{#accountId}:stack/{#stackId}

    		 None None

    Request parameters

    Parameter

    Type

    Required

    Description

    Example
    RegionId

    string

    Yes

    The region ID of the stack. You can call the DescribeRegions operation to query the most recent region list.

    cn-hangzhou
    StackId

    string

    No

    The ID of the stack.

    4a6c9851-3b0f-4f5f-b4ca-a14bf691****

    OperationType

    string

    No

    The type of the operation of which you want to detect risks. Valid values:

    • DeleteStack: detects high risks that may arise in resources when you delete a stack.

    • CreateStack: detects the missing permissions when you fail to create a stack.

    DeleteStack
    ClientToken

    string

    No

    The client token that is used to ensure the idempotence of the request. You can use the client to generate the token, but you must make sure that the token is unique among different requests. The token can be up to 64 characters in length, and can contain letters, digits, hyphens (-), and underscores (_). For more information, see How to ensure idempotence.

    123e4567-e89b-12d3-a456-42665544****

    RamRoleName

    string

    No

    The name of the RAM role.

    • If you specify a RAM role, ROS creates stacks based on the permissions that are granted to the RAM role and uses the credentials of the RAM role to call the API operations of Alibaba Cloud services.

    • If you do not specify a RAM role, ROS creates stacks based on the permissions of your Alibaba Cloud account.

    The name of the RAM role can be up to 64 bytes in length.

    test-role
    RetainAllResources

    boolean

    No

    Specifies whether to retain all resources in the stack. Valid values:

    • true

    • false (default)

    Note

    This parameter takes effect only if you set OperationType to DeleteStack.

    false
    RetainResources

    array

    No

    The list of resources to retain.

    Note

    This parameter takes effect only if you set OperationType to DeleteStack.

    WebServer

    string

    No

    The resource that you want to retain.

    instance
    TemplateBody

    string

    No

    The structure that contains the template body. The template body must be 1 to 524,288 bytes in length. If the length of the template body exceeds the upper limit, we recommend that you add parameters to the HTTP POST request body to prevent request failures caused by excessively long URLs.

    Note

    You must and can specify only one of the following parameters: TemplateBody, TemplateURL, TemplateId, and TemplateScratchId.

    {"ROSTemplateFormatVersion":"2015-09-01"}
    TemplateURL

    string

    No

    The URL of the file that contains the template body. The URL must point to a template that is located on an HTTP or HTTPS web server or in an Object Storage Service (OSS) bucket, such as oss://ros/stack-policy/demo and oss://ros/stack-policy/demo?RegionId=cn-hangzhou. The template body can be up to 524,288 bytes in length. If you do not specify RegionId in the URL, the region ID of the stack is used.

    Note

    You must specify one of TemplateBody, TemplateURL, TemplateId, and TemplateScratchId.

    oss://ros-template/demo
    TemplateId

    string

    No

    The ID of the template. This parameter applies to shared and private templates.

    Note

    You must specify one of TemplateBody, TemplateURL, TemplateId, and TemplateScratchId.

    5ecd1e10-b0e9-4389-a565-e4c15efc****
    TemplateVersion

    string

    No

    The version of the template.

    Note

    This parameter takes effect only if you specify TemplateId.

    v1

    Response elements

    Element

    Type

    Description

    Example

    object

    RequestId

    string

    The ID of the request.

    72108E7A-E874-4A5E-B22C-A61E94AD12CD
    RiskResources

    array<object>

    The resources that are at risk.

    object

    LogicalResourceId

    string

    The logical ID of the resource. The logical ID is the resource name that is defined in the template.

    MySG
    PhysicalResourceId

    string

    The physical ID of the resource. The physical ID is the actual ID of the resource.

    sg-bp1dpioafqphedg9****
    RequestId

    string

    The ID of the request when the risk detection fails.

    Note

    This parameter is not returned if the risk detection is successful.

    DF4296CF-F45F-4845-A72B-BE617601DB25
    ResourceType

    string

    The type of the resource.

    ALIYUN::ECS::SecurityGroup
    Code

    string

    The error code that is returned when the risk detection fails.

    Note

    This parameter is not returned if the risk detection is successful.

    NoPermission
    Message

    string

    The error message that is returned when the risk detection fails.

    Note

    This parameter is not returned if the risk detection is successful.

    You are not authorized to complete this action.
    RiskType

    string

    The type of the risk. Valid values:

    • Referenced: The resource is referenced by other resources.

    • MaybeReferenced: The resource may be referenced by other resources.

    • AdditionalRiskCheckRequired: An additional risk detection is required for a nested stack.

    • OperationIgnored: The operation does not take effect for the resource.

    Referenced
    Reason

    string

    The cause of the risk.

    There are some ECS instances (i-bp18el96s4wq635e****) depending on the security group.
    MissingPolicyActions

    array

    The operations on which the permissions are not granted to the Alibaba Cloud account of the caller.

    string

    The operation on which the permissions are not granted to the Alibaba Cloud account of the caller.

    ["ecs:DescribeInstance", "ros:CreateStack"]

    Examples

    Success response

    JSON format

    {
  "RequestId": "72108E7A-E874-4A5E-B22C-A61E94AD12CD",
  "RiskResources": [
    {
      "LogicalResourceId": "MySG",
      "PhysicalResourceId": "sg-bp1dpioafqphedg9****",
      "RequestId": "DF4296CF-F45F-4845-A72B-BE617601DB25",
      "ResourceType": "ALIYUN::ECS::SecurityGroup",
      "Code": "NoPermission",
      "Message": "You are not authorized to complete this action.",
      "RiskType": "Referenced",
      "Reason": "There are some ECS instances (i-bp18el96s4wq635e****) depending on the security group."
    }
  ],
  "MissingPolicyActions": [
    "[\"ecs:DescribeInstance\", \"ros:CreateStack\"]"
  ]
}

    Error codes

    See Error Codes for a complete list.

    Release notes

    See Release Notes for a complete list.