How to create ECS instances with the same configuration in multiple regions across multiple Alibaba Cloud accounts - Resource Orchestration Service

You can use Resource Orchestration Service (ROS) stack groups to create ECS instances with the same configuration across multiple Alibaba Cloud accounts and regions.

Overview

This topic describes how to use ROS stack groups (StackGroup) to create ECS instances with the same configuration in multiple regions across multiple Alibaba Cloud accounts, along with the dependent network resources (VPC, vSwitch, and security group). It is suitable for scenarios such as unified multi-account deployment across enterprise groups, multi-region expansion for global businesses, and standardized infrastructure for development, test, and production environments.

Prerequisites

Complete the preparations that match the permission model you plan to use.

Service-managed permission model (recommended when many accounts are involved)

Alibaba Cloud account: you have an Alibaba Cloud account, and both ROS and ECS are activated.
Resource directory: a resource directory is created, and the target accounts have joined it.
Delegated administrator account: a delegated administrator account is set up for ROS. For details, see Set up a delegated administrator account.

Self-managed permission model

Alibaba Cloud account: you have an Alibaba Cloud account, and both ROS and ECS are activated.
Accounts: an administrator account and the target accounts are created.
RAM roles and trust: RAM roles are created manually in the administrator account and in each target account, so that a two-way trust relationship exists between them. For details, see Grant self-managed permissions.

Tutorial

Step 1: Prepare the ROS template

The following template automatically queries the recommended instance type through a DATASOURCE, and creates a complete ECS environment (VPC + vSwitch + security group + ECS instance) in the target region:

ROSTemplateFormatVersion: '2015-09-01'
Description:
  zh-cn: 自动选择实例规格，创建一台ECS实例及网络资源
  en: Creates one ECS instance with an auto-selected instance type

Resources:
  # Data source: queries the instance types recommended for the current region (2 vCPUs, 8 GiB of memory, ESSD system disk)
  DS-InstanceTypes:
    Type: DATASOURCE::ECS::RecommendInstanceTypes
    Properties:
      Cores: 2
      Memory: 8
      SystemDiskCategory: cloud_essd

  # Creates a VPC
  Vpc:
    Type: ALIYUN::ECS::VPC
    Properties:
      CidrBlock: 192.168.0.0/16

  # Creates a vSwitch; the zone is taken from the data source result
  VSwitch:
    Type: ALIYUN::ECS::VSwitch
    Properties:
      VpcId:
        Ref: Vpc
      CidrBlock: 192.168.0.0/24
      ZoneId:
        Fn::Jq:
          - First
          - .[].ZoneId
          - Fn::GetAtt:
              - DS-InstanceTypes
              - InstanceTypes

  # Creates a security group
  SecurityGroup:
    Type: ALIYUN::ECS::SecurityGroup
    Properties:
      VpcId:
        Ref: Vpc

  # Creates an ECS instance; the instance type is taken from the data source result
  Instance:
    Type: ALIYUN::ECS::Instance
    Properties:
      IoOptimized: optimized
      VpcId:
        Ref: Vpc
      SecurityGroupId:
        Ref: SecurityGroup
      VSwitchId:
        Ref: VSwitch
      ImageId: centos
      InstanceType:
        Fn::Jq:
          - First
          - .[].InstanceType
          - Fn::GetAtt:
              - DS-InstanceTypes
              - InstanceTypes
      SystemDiskCategory: cloud_essd

Outputs:
  VpcId:
    Label:
      en: VPC ID
    Value:
      Fn::GetAtt:
        - Vpc
        - VpcId
  InstanceId:
    Label:
      en: ECS instance ID
    Value:
      Fn::GetAtt:
        - Instance
        - InstanceId

Key syntax analysis

The DATASOURCE data source resource

DS-InstanceTypes:
  Type: DATASOURCE::ECS::RecommendInstanceTypes    # The DATASOURCE:: prefix marks a data source
  Properties:
    Cores: 2                    # number of vCPUs
    Memory: 8                   # memory (GB)
    SystemDiskCategory: cloud_essd  # system disk category

A DATASOURCE resource creates no actual cloud resource. Instead, it queries existing resources or recommended configurations. The result is obtained through Fn::GetAtt. In this example, the returned InstanceTypes attribute is an array:

[
  {"InstanceType": "ecs.g7.large", "ZoneId": "cn-hangzhou-h", ...},
  {"InstanceType": "ecs.g6.large", "ZoneId": "cn-hangzhou-i", ...}
]

The Fn::Jq data extraction function

ZoneId:
  Fn::Jq:
    - First           # mode: First returns the first result, All returns all results
    - .[].ZoneId      # JQ expression: walks the array and extracts ZoneId from each element
    - Fn::GetAtt:     # data source: the DATASOURCE query result
        - DS-InstanceTypes
        - InstanceTypes

Fn::Jq uses JQ syntax to extract data from complex JSON structures. The First mode returns the first matching result as a string.

Fn::Jq parameter	Meaning	Value in this example
1st parameter	Result mode	`First` (returns the first matching value)
2nd parameter	JQ filter expression	`.[].ZoneId` (extracts ZoneId from every element)
3rd parameter	Input data	The `InstanceTypes` array returned by the DATASOURCE

Step 2: Create a stack group

Log on to the Resource Orchestration console.
In the left-side navigation pane, click Stack Groups.
In the top menu bar, select a region. This region manages the stack group; it does not limit the regions into which stacks are deployed.
Click Create Stack Group.

Step 3: Configure the stack group

On the Configure Stack Group page, configure Permissions.
If you select Self-managed Permissions, configure the Admin Role and the Execution Role as required by the page. If you select Service-managed Permissions, the stack group automatically creates the required roles and no configuration is needed. After the configuration is complete, click Next.

Step 4: Configure the template and parameters

On the Select Template page, click Select an Existing Template, set Template Import Method to Enter Template Content, paste the YAML template from Step 1, and then click Next.
On the Configure Parameters page, enter a Stack Group Name and a Stack Group Description, and then click Next.
Note
This template requires no additional parameters (the instance type and zone are automatically determined by the DATASOURCE). Just click Next.

Step 5: Set deployment options

On the Set Deployment Options page, the configuration items vary based on the Permissions mode that you selected in Step 3: Configure the stack group.

When you use Service-managed Permissions:

Configuration item	Action
Deployment Destinations	Select multiple member accounts or organizational units from the resource directory.
Automatic Deployment	When enabled, stacks are automatically deployed to newly added accounts. When an account is deleted, the behavior is determined by Account Removal Behavior. When disabled, no automatic action is taken.
Account Removal Behavior	Takes effect when automatic deployment is enabled. You can specify whether to delete the stacks in an account when the account is removed from the folder.

When you use Self-managed Permissions:

Configuration item	Action
Deployment Locations	Select Deploy Stacks Within Accounts.
Accounts	Enter multiple target account IDs, separated by commas.

Configure the regions and deployment options.

Parameter	Description	Recommended value
Regions	Select the target regions where the ECS instances are deployed (up to 20).	Select based on your business needs.
Maximum Number of Concurrent Accounts	The number of accounts that are deployed at the same time.	The default is 1. You can increase it to accelerate deployment.
Fault Tolerance	The maximum number of failures that are tolerated before deployment stops.	Set based on the deployment scale.
Region Concurrency	Whether regions are deployed in parallel.	Parallel (to accelerate deployment).

Note

Deployment matrix example (3 accounts x 4 regions = 12 stack instances):

                      China (Hangzhou)  China (Beijing)  China (Shenzhen)  China (Hong Kong)
Account A (12345...)  Instance 1        Instance 2       Instance 3        Instance 4
Account B (67890...)  Instance 5        Instance 6       Instance 7        Instance 8
Account C (11111...)  Instance 9        Instance 10      Instance 11       Instance 12

Each instance contains: VPC + VSwitch + SecurityGroup + ECS Instance (4 resources in total)

Click Next, check the information on the Check and Confirm page, and then click Create Stack Group.

Step 6: View the deployment results

In the left-side navigation pane, click Stack Groups, and then click the name of the stack group.

Click the Instance tab to view the stack instances of every account and every region.

Column	Description
Stack Instance Account	The target account that owns the stack instance.
Stack Instance Region	The region in which the stack instance resides.
Stack ID	The unique stack identifier of each instance.
Instance Status	Current: the stack instance is up to date, which means that no operation on it is in progress or has failed. Outdated: the stack instance is not up to date, which means that its latest operation is unfinished or has failed. For example, when you update the stack group and the stack instances, the instances being updated are Outdated. When role assumption fails while a stack instance is being created or updated, the stack is not created or updated and the instance is Outdated. When role assumption succeeds but the stack creation or update fails, the instance is also Outdated.

Click a Stack ID, and then open the Resources tab to view every resource that the stack instance created: the VPC, the vSwitch, the security group, and the ECS instance.
Once the resource status of every stack instance reads as created, the ECS instances are deployed across all of the selected accounts and regions.

FAQ

Does a data source resource incur a fee?

No. A data source resource only runs a query. It creates no cloud resource and incurs no fee. It behaves like an API query that runs automatically while the stack is created.

What happens if a region has no instance type that meets the query?

When the data source returns an empty result, the resources that depend on that result, the vSwitch and the ECS instance, fail to be created. The stack instance of that region enters a failed state, while the other regions continue to deploy. Two ways out are available:

Relax the query in the data source, for example by lowering the Cores value and the Memory value.
Exclude the unsupported region from the deployment options.

Does the same private IP address (192.168.0.1) collide across regions?

No. Each stack instance creates a VPC of its own, and a private IP address is valid only inside the VPC that holds it. One VPC is isolated from another at the network level, so the same CIDR block and the same address can be reused in every account and every region without a collision.

Can the ECS configuration in the template, such as the number of vCPUs or the memory size, be changed?

Yes. Change the Cores property and the Memory property of the data source. For an instance with 4 vCPUs and 16 GiB of memory:

DS-InstanceTypes:
  Type: DATASOURCE::ECS::RecommendInstanceTypes
  Properties:
    Cores: 4
    Memory: 16
    SystemDiskCategory: cloud_essd

The data source then queries the recommended instance type that meets the new requirements in each region, so no instance type has to be specified manually.

To learn more about resource deployment issues, see FAQ.

Resource Orchestration Service:Create ECS instances across multiple accounts and regions