To create stacks in specific accounts and regions, use an administrator account to create a stack group with self-managed permissions. Resource Orchestration Service (ROS) uses these permissions to deploy stacks in the specified accounts.
Prerequisites
Ensure that you have granted self-managed permissions. For more information, see Step 1: Grant self-managed permissions.
Background information
When you create a stack group, you need the following accounts:
-
Administrator account (Account A): The account used to create the stack group.
-
Destination account (Account B): The account where the stack is deployed.
The administrator account and the execution account can be the same Alibaba Cloud account. For more information about administrator and execution accounts, see Overview.
This topic describes how to use an administrator account (Account A) to create a stack group and deploy stacks for a destination account (Account B) in the China (Hangzhou) and China (Beijing) regions.
Procedure
-
Use the administrator account (Account A) to log on to the ROS console.
-
In the navigation pane on the left, click Stack Groups.
-
In the top menu bar, select a region for the stack group from the region drop-down list.
-
On the Stack Groups page, click Create Stack Group.
-
Specify a template as required and click Next.
Select a Template Import Method and configure the template.
-
Enter Template Content: In the Template Content section, enter a ROS or Terraform template. For more information about how to write a template, see ROS template structure and Terraform template structure.
-
My Templates: Select an existing template and template version. The system automatically populates the template content. For more information about how to create a template, see Create a template and Create an infrastructure graph template.
-
Use URL: Enter the URL of the template and click Get Template Content. The system automatically populates the template content.
If you want to use the URL of a ROS template file that is stored in an Object Storage Service (OSS) bucket, you must configure cross-domain access. For more information, see Configure cross-domain access for ROS templates.
-
Public Templates: Select a public template. The system automatically populates the template content.
-
Shared Templates: Select a template and template version that another user shared with you. The system automatically populates the template content. For more information about how to share a template, see Share a template with an Alibaba Cloud account.
-
-
On the Configure Parameters page, enter a Stack Group Name and Stack Group Description, and then click Next.
-
On the Configure Stack Group page, select Self-managed Permissions permissions. Then, set the Admin Role (AliyunROSStackGroupAdministrationRole) and Execution Role (AliyunROSStackGroupExecutionRole), and click Next.
NoteThe administrator role and execution role are the RAM roles that are created when you grant self-managed permissions. For more information, see Step 1: Grant self-managed permissions.
-
On the Set Deployment Options page, set the following parameters and click Next.
NoteThe required parameters vary depending on the template. Specify the parameters as prompted in the console.
Parameter
Description
Accounts
The accounts where the stacks are deployed.
Select a deployment location and set the corresponding accounts as needed.
-
Deploy Stacks Within Accounts: When you use an Alibaba Cloud account to create a stack group, you can deploy stacks in one or more Alibaba Cloud accounts. For example, enter the destination account (Account B) to deploy stacks in it.
NoteEnter one or more account IDs, separated by commas (,). You can also enter the ID of the administrator account (Account A) to deploy stacks in it.
-
Deploy Stacks Within Resource Directories: If you have enabled Resource Directory and use its management account to create the stack group, you can deploy stacks to all member accounts within a specific folder.
Region
The regions where you want to deploy the stacks. For example, China (Hangzhou) and China (Beijing).
NoteYou can select up to 20 regions.
Resource Group
An organization is used to group and manage stack groups.
Select a resource group for the stack group as needed. If you do not specify a resource group, the stack group is added to the default resource group.
For more information about how to create a resource group, see Create a resource group.
Tags
Attach tags to or remove tags from the resource. You can attach up to 20 tags to each resource.
Maximum Number of Concurrent Accounts
The number of accounts in each region where stacks can be deployed at the same time.
For more information about how to set the maximum number of concurrent accounts, see Overview.
Fault Tolerance
The number of accounts in each region for which stack deployments can fail. If this number is exceeded, the operation stops in that region. If the operation stops in one region, it does not continue in other regions.
For more information about how to set the failure tolerance, see Overview.
Region Concurrency
The concurrency type for deploying stack instances across regions.
-
Sequential: Deploys stacks in one specified region at a time, in the order the regions are listed.
-
Concurrent: Deploys stacks in all specified regions in parallel.
Expand modules in current account
This parameter takes effect only when modules are used in the template. If you expand modules in the current account, the modules must exist in the current account. If you do not expand modules in the current account, the modules must exist in all destination accounts.
NoteIf you do not specify Accounts and Region, ROS creates only the stack group, not the stack instances. To deploy stacks in specific accounts and regions, you must also create stack instances. For more information, see Step 3 (Optional): Create stack instances.
-
-
On the Check and Confirm page, verify the stack group information and click Create Stack Group.
Results
After the stack group is created, you can view the stack group in the administrator account (Account A) on the Stack Groups page.
Click the stack group name, and then click the Instance tab to view the status of the stack instances in the destination account (Account B). When the instance status is Up-to-date, the stacks are successfully deployed. You can then log on to the ROS console with the destination account (Account B) to view the deployed stacks in the China (Hangzhou) and China (Beijing) regions.