Granting permissions for SchedulerX - SchedulerX - Alibaba Cloud Documentation Center

SchedulerX supports Resource Access Management (RAM) for granting permissions to multiple users and user groups at a time. RAM enables fine-grained, least-privilege access control, eliminating the need to share your Alibaba Cloud account AccessKey pair and reducing security risks.

Background information

Two types of RAM policies are available for quick authorization, each with a different effective scope. Choose the policy type that fits your requirements. For more fine-grained control, create custom RAM policies. For more information, see the "Sample custom policies" section of this topic.

Grant RAM users the permissions to create resources

By default, RAM users cannot create, view, or manage SchedulerX resources. After you grant resource creation permissions to a RAM user, the RAM user can read and write all resources that the RAM user creates.

Procedure:

Log on to the RAM console.
Create a custom policy. For more information, see Create a custom policy by using the JSON editor. The following sample policy grants a RAM user or user group the permissions to create namespaces and instance groups. The RAM user can access only instance groups that the RAM user created. To grant access to instance groups and resources created by another RAM user, create and attach a custom policy. For more information, see the "Sample custom policies" section of this topic.
```
{
    "Version": "1",
    "Statement": [
        {
            "Action": ["edas:CreateSchedulerxNamespace*",
                       "edas:CreateSchedulerxAppGroup*"],
            "Effect": "Allow",
            "Resource": "acs:edas:*:*:*"
        }
    ]
}
```
Optional. Create a RAM user or user group. For more information, see Create a RAM user or Create a RAM user group. If a RAM user or user group exists, you can skip this step.
Attach the custom policy created in Step 2 to a single RAM user. For more information, see Manage RAM user permissions.
Attach the custom policy created in Step 2 to a user group and add RAM users to the user group.
1. Attach the policy to the user group. For more information, see Grant permissions to a RAM user group. In the RAM console, select the custom policy that you created in Step 2.
2. Add the user to a user group that has the appropriate policy. For more information, see Method 2: Add a RAM user to a RAM user group. In the Add Group Member panel, select schedulerx_admin for User Group, select the target user from the user list on the left, and click OK.

Create resources as an administrator and grant permissions to RAM users

Typically, only O&M personnel can create resources, while developers have only read and management permissions. You can assign an administrator role to O&M personnel so they can manage all SchedulerX resources, create namespaces and instance groups, and then grant RAM users access to those resources through custom policies.

Procedure:

Log on to the RAM console.
Create a custom policy. For more information, see Create a custom policy by using the JSON editor. The following sample policy grants a RAM user or user group the administrator permissions on SchedulerX, allowing full management of all SchedulerX resources.
```
{
  "Statement": [
    {
      "Action": "edas:*Schedulerx*",
      "Effect": "Allow",
      "Resource": [
                "acs:edas:*:*:*"
            ]
    }
  ],
  "Version": "1"
}
```
Optional. Create a RAM user or user group. For more information, see Create a RAM user or Create a RAM user group. If a RAM user or user group exists, you can skip this step.
Attach the custom policy created in Step 2 to a single RAM user. For more information, see Manage RAM user permissions.
Attach the custom policy created in Step 2 to a user group and add RAM users to the user group.
1. Attach the policy to the user group. For more information, see Grant permissions to a RAM user group.
2. Add the RAM user to the user group. For more information, see Add a RAM user to a RAM user group.

SchedulerX permissions

By default, an Alibaba Cloud account has full permissions on all resources within the account. We recommend that you use RAM to grant specific permissions to different users. SchedulerX supports attaching a policy to multiple RAM users or user groups at a time. The following table describes the system policies supported by SchedulerX.

System policy	Description
AliyunEDASFullAccess	Provides the permissions to manage Enterprise Distributed Application Service (EDAS) resources.

A custom RAM policy contains the Action and Resource elements. You can create a custom policy based on the rules defined by SchedulerX.

Principal structure

{
  "Statement": [
    { 
      "Action": "edas:*", // The actions that are allowed. For information about how to configure the Action element, see the "Action" section of this topic.
      "Effect": "Allow",
      "Resource": "*"     // The resources that can be accessed. For information about how to configure the Resource element, see the "Resource" section of this topic.
    }
  ],
  "Version": "1",
}

Action

SchedulerX defines the Action element in the following structure:

edas:${type}Schedulerx*

The ${type} parameter can be set to Read, Manage, Delete, or Create. The following table describes the operations for each type.

Valid value	Operation
Create	Create namespaces, applications, jobs, and workflows.
Manage	Modify namespaces. Import jobs, export jobs, modify jobs, enable jobs, disable jobs, manually run jobs, re-run jobs, and specify machines. Stop job instances, re-run job instances, set the state of job instances to successful, set the state of workflow instances to successful, and re-run tasks. Modify workflows, import job configurations to workflows, manually run workflows, re-run workflows, enable workflows, and disable workflows. Modify instance groups.
Delete	Delete namespaces, instance groups, jobs, and workflows.
Read	Query instance groups, jobs, job instances, workflows, and online instances.

Resource

SchedulerX defines the Resource element in the following structure:

acs:edas:${regionid}:${accountid}:namespace/${namespace_id}/${resourceType}/${resourceId}

Parameter	Description
`${regionid}`	The region in which the resource is deployed. Use an asterisk (`*`) for the default setting.
`${accountid}`	The Alibaba Cloud account that owns the resource. Use an asterisk (`*`) for the default setting.
`${namespace_id}`	The ID of the namespace that contains the resource. SchedulerX users Log on to the SchedulerX console. In the left-side navigation pane, click Namespace. In the Namespace ID column, hover over the target namespace ID and click the copy icon . Replace `${namespace_id}` with the copied ID. EDAS users Log on to the EDAS console. In the left-side navigation pane, choose Resource Management > Microservice Namespaces. On the Microservices Namespace page, move the pointer over the ID of the namespace that you want to access in the Microservices Namespace Name/ID/TID column, click the icon that appears on the right to copy the namespace ID, and then replace `${namespace_id}` with the namespace ID.
`${resourceType}`	The resource type. A value of JobGroup specifies a job group in SchedulerX. Jobs are grouped by application.
`${resourceId}`	The resource ID. If `${resourceType}` is set to JobGroup, this parameter specifies an application ID in the Application Management module of SchedulerX. To obtain the value of the `${resourceId}` parameter, perform the following steps: Log on to the SchedulerX console. In the left-side navigation pane, click Application Management. In the Application ID column, hover over the target application ID and click the copy icon . Replace `${resourceId}` with the copied ID.

Sample custom policies

Grant RAM users the management permissions on all resources

RAM users with management permissions can perform all operations on all SchedulerX resources. Sample policy:

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "edas:*Schedulerx*"
            ],
            "Resource": [
                "acs:edas:*:*:*"
            ]
        }
    ]
}

Grant RAM users the read-only permissions on all resources

RAM users with read-only permissions can query all SchedulerX resources. Sample policy:

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "edas:ReadSchedulerx*"
            ],
            "Resource": [
                "acs:edas:*:*:*"
            ]
        }
    ]
}

Grant RAM users the management permissions on specified namespaces

The following sample policy grants management permissions on application and job resources in specified namespaces (ID-01 and ID-02 in this example). RAM users with this policy can manage and schedule all resources in those namespaces. You can modify the Action element to further restrict permissions. For example, setting Action to edas:ReadSchedulerx limits access to read-only queries.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "edas:*Schedulerx*"
            ],
            "Resource": [
                "acs:edas:*:*:namespace/Namespace ID-01/*",
              	"acs:edas:*:*:namespace/Namespace ID-02/*"
            ]
        }
    ]
}

In the left-side navigation pane of the SchedulerX console, click Namespaces. You can obtain the required namespace IDs from the Namespace ID column.

Grant RAM users the management permissions on specified applications

The following sample policy grants management permissions on specific applications. The Resource element specifies the application IDs. You can use an asterisk (*) to match multiple applications. For example, including TestGroup* grants management permissions on all applications prefixed with TestGroup in the specified namespace.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "edas:*Schedulerx*"
            ],
            "Resource": [
                "acs:edas:*:*:namespace/Namespace ID-01/JobGroup/TestGroup*",
              	"acs:edas:*:*:namespace/Namespace ID-02/JobGroup/AppGroup"
            ]
        }
    ]
}

In the left-side navigation pane of the SchedulerX console, click Application Management. You can obtain the application ID from the App ID/App Key column.