All Products
Search

This Product

    Elastic Desktop Service:CreatePolicyGroup

    Document Center

    Elastic Desktop Service:CreatePolicyGroup

    Last Updated:Aug 10, 2026

    Creates a cloud computer policy.

    Operation description

    A cloud computer policy is a collection of rules that primarily includes configurations for cloud computer performance and security, such as basic policies like disk mapping, USB redirection, and watermarks, as well as rules like DNS management. For more information, see Policy overview.

    Try it now

    Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

    Test

    RAM authorization

    The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

    • Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.

    • API: The API that you can call to perform the action.

    • Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.

    • Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.

      • For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.

      • For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.

    • Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.

    • Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

    Action

    Access level

    Resource type

    Condition key

    Dependent action

    ecd:CreatePolicyGroup

    create

    *All Resource

    *

    		 None None

    Request parameters

    Parameter

    Type

    Required

    Description

    Example
    RegionId

    string

    Yes

    The region ID. You can call DescribeRegions to query the list of regions supported by WUYING Workspace.

    cn-hangzhou
    Clipboard

    string

    No

    The clipboard permission.

    Valid values:

    • read :

      One-way allowed. Content replication from the local device to the cloud computer is allowed, but content replication from the cloud computer to the local device is not allowed.

    • readwrite :

      Two-way allowed. Content replication between the local device and the cloud computer is allowed in both directions.

    • write :

      One-way allowed. Content replication from the cloud computer to the local device is allowed, but content replication from the local device to the cloud computer is not allowed.

    • off :

      Two-way disabled. Copy operations between the cloud computer and the local device are not allowed. [Default value]

    off
    LocalDrive

    string

    No

    The local disk mapping permission.

    Valid values:

    • read :

      Read-only. The cloud computer has a mapping of the local disk, but you can only read (copy) local files and cannot modify them.

    • readwrite :

      Read/Write. The cloud computer has a mapping of the local disk. You can read (copy) and modify local files.

    • off :

      Disabled. The cloud computer does not have a mapping of the local disk. [Default value]

    off
    UsbRedirect

    string

    No

    The USB redirection setting.

    Valid values:

    • off :

      Disabled. [Default value]

    • on :

      Enabled.

    off
    VisualQuality

    string

    No

    The image display quality policy.

    Valid values:

    • high :

      High definition.

    • low :

      Smooth.

    • lossless :

      Lossless.

    • medium :

      Adaptive [Default value]

    medium
    Html5Access

    string

    No

    The web client access policy.

    Valid values:

    • off :

      Disabled. [Default value]

    • on :

      Enabled.

    off
    Html5FileTransfer

    string

    No

    The web client file transfer policy.

    Valid values:

    • all :

      Upload and download allowed.

    • download :

      Download allowed.

    • upload :

      Upload allowed.

    • off :

      Disabled. [Default value]

    off
    Watermark

    string

    No

    The watermark setting.

    Valid values:

    • blind :

      Invisible watermark enabled.

    • off :

      Watermark disabled [Default value]

    • on :

      Visible watermark enabled.

    off
    Name

    string

    No

    The policy name.

    testPolicyGroupName
    WatermarkType

    string

    No

    The watermark type. You can select up to three types, separated by commas (,).

    Valid values:

    • EndUserId :

      Username.

    • Custom :

      Custom text.

    • DesktopIp :

      Cloud computer IP address.

    • ClientIp :

      Client IP address.

    • HostName :

      Last 15 characters of the cloud computer ID.

    • ClientTime :

      Current time of the cloud computer.

    EndUserId
    WatermarkTransparency

    string

    No

    The transparency level of the watermark.

    Valid values:

    • LIGHT :

      Light [Default value]

    • DARK :

      Dark.

    • MIDDLE :

      Medium.

    LIGHT
    PreemptLogin

    string

    No

    The preemption policy for the cloud desktop.

    Note

    To ensure the user experience and data security of end users who are using the cloud desktop, preemption between multiple users is not allowed. This parameter is set to off by default and cannot be modified.

    Valid values:

    • off :

      Preemption among multiple users is not allowed. [Default value]

    off
    DomainList

    string

    No

    The domain name access control setting. Domain names support wildcards (*). Separate multiple domain names with commas (,).

    Valid values:

    • off :

      Disabled.

    • on :

      Enabled.

    off
    PrinterRedirection

    string

    No

    The printer redirection policy.

    Valid values:

    • off :

      Disabled.

    • on :

      Enabled.

    on
    PreemptLoginUser

    array

    No

    The usernames of users who are allowed to preempt the cloud desktop. You can specify up to 5 usernames.

    Note

    To ensure the user experience and data security of end users who are using the cloud desktop, mutual preemption among multiple users is not supported.

    Alice

    string

    No

    The username of a user who can preempt the cloud computer.

    Alice
    AuthorizeSecurityPolicyRule

    array<object>

    No

    The list of security group rules.

    object

    No

    The security group rule.

    Type

    string

    No

    The direction of the security group rule.

    Valid values:

    • outflow :

      Outbound.

    • inflow :

      Inbound.

    inflow
    Policy

    string

    No

    The authorization policy of the security group rule.

    Valid values:

    • drop :

      Deny policy. All access requests are denied. No rejection message is returned, and the request appears to time out or fail to establish a connection on the sender side.

    • accept :

      Allow policy. All access requests are accepted. [Default value]

    accept
    PortRange

    string

    No

    The port range of the security group rule. The valid values of this parameter are determined by the value of IpProtocol:

    • TCP or UDP: Valid values are 1 to 65535. Separate the start port and the end port with a forward slash (/). Example: 1/200.

    • ICMP: -1/-1.

    • GRE: -1/-1.

    • If IpProtocol is set to all: -1/-1.

    For more information about the common ports of typical applications, see Common ports.

    22/22
    Description

    string

    No

    The description of the security group rule.

    Allow access to the internal R&D environment
    IpProtocol

    string

    No

    The protocol type of the security group rule.

    Valid values:

    • TCP :

      TCP protocol.

    • UDP :

      UDP protocol.

    • ALL :

      All protocols supported.

    • GRE :

      GRE protocol.

    • ICMP :

      ICMP (IPv4) protocol.

    tcp
    Priority

    string

    No

    The priority of the security group access control rule. A smaller value indicates a higher priority.

    Valid values: 1 to 60.

    Default value: 1.

    1
    CidrIp

    string

    No

    The object of the security group rule. The value is an IPv4 CIDR block in CIDR notation.

    47.100.XX.XX/16
    AuthorizeAccessPolicyRule

    array<object>

    No

    The list of client IP whitelist rules. After you configure this parameter, only IP addresses within the whitelisted CIDR blocks can access the cloud computer.

    object

    No

    The client IP whitelist rule.

    Description

    string

    No

    The description of the client IP whitelist rule.

    North China branch office
    CidrIp

    string

    No

    The client access IP CIDR block. The value is an IPv4 CIDR block in CIDR notation.

    47.100.XX.XX/16
    ClientType

    array<object>

    No

    The list of logon method control rules. Specifies which client types are allowed to access cloud desktops.

    object

    No

    The logon method control rule.

    Status

    string

    No

    Specifies whether to allow users to log on to cloud desktops by using a specific type of client.

    Note

    If you do not set ClientType-related parameters, all types of clients are allowed to log on to cloud desktops by default.

    Valid values:

    • OFF :

      not allowed.

    • ON :

      allowed.

    ON
    ClientType

    string

    No

    The client type for logon method control.

    Valid values:

    • html5 :

      Web client.

    • android :

      Android client.

    • ios :

      iOS client.

    • windows :

      Windows client.

    • macos :

      macOS client.

    windows
    GpuAcceleration

    string

    No

    Specifies whether to enable the image quality policy for graphics-type cloud desktops. Enable this policy when high performance and user experience are required, such as in professional design scenarios.

    Valid values:

    • off :

      Disabled.

    • on :

      Enabled.

    off
    UsbSupplyRedirectRule

    array<object>

    No

    The USB redirection rules.

    object

    No

    The USB redirection rules.

    VendorId

    string

    No

    The vendor ID. See Valid USB Vendor IDs (VIDs).

    04**
    ProductId

    string

    No

    The product ID.

    08**
    Description

    string

    No

    The rule description.

    Test rule
    UsbRedirectType

    integer

    No

    The USB redirection type.

    Valid values:

    • 1 :

      Allow.

    • 2 :

      Deny.

    1
    DeviceClass

    string

    No

    The device class. This parameter is required when usbRuleType is set to 1. See Defined Class Codes.

    0Eh
    DeviceSubclass

    string

    No

    The device subclass. This parameter is required when usbRuleType is set to 1. See Defined Class Codes.

    xxh
    UsbRuleType

    integer

    No

    The USB redirection rule type.

    Valid values:

    • 1 :

      Device class.

    • 2 :

      Device vendor.

    1
    DomainResolveRuleType

    string

    No

    The domain name resolution policy type.

    Valid values:

    • OFF :

      Disabled.

    • ON :

      Enabled.

    OFF
    DomainResolveRule

    array<object>

    No

    The domain name resolution policy details.

    object

    No

    The domain name resolution policy.

    Domain

    string

    No

    The domain name.

    *.example.com
    Policy

    string

    No

    The resolution policy.

    Valid values:

    • allow :

      Allow.

    • block :

      Block.

    allow
    Description

    string

    No

    The policy description.

    Test rule
    Recording

    string

    No

    Specifies whether to enable screen recording.

    Valid values:

    • byaction_cmd_ft :

      User action recording (triggered when commands are executed or files are transferred)

    • ALLTIME :

      Full-session recording, from connection to disconnection of the cloud desktop.

    • session :

      Session lifecycle recording.

    • PERIOD :

      Scheduled recording. You must specify the start time and end time.

    • byaction_commands :

      User action recording (triggered only when commands are executed)

    • OFF :

      Disabled.

    • byaction_file_transfer :

      User action recording (triggered only when files are transferred)

    OFF
    RecordingStartTime

    string

    No

    The start time of screen recording in the format of HH:MM:SS. This parameter takes effect only when Recording is set to PERIOD.

    08:00:00
    RecordingEndTime

    string

    No

    The end time of screen recording in the format of HH:MM:SS. This parameter takes effect only when Recording is set to PERIOD.

    08:59:00
    RecordingFps

    integer

    No

    The frame rate of screen recording. Unit: FPS (frames per second).

    Valid values:

    • 2 :

      2

    • 5 :

      5

    • 10 :

      10

    • 15 :

      15

    2
    RecordingExpires

    integer

    No

    The retention period of screen recording files. Valid values: 1 to 180. Unit: days.

    15
    CameraRedirect

    string

    No

    Specifies whether to enable local camera redirection.

    Valid values:

    • off :

      Disabled.

    • on :

      Enabled [Default]

    on
    NetRedirect

    string

    No

    Specifies whether to enable network redirection.

    Valid values:

    • off :

      Disabled. [Default value]

    • on :

      Enabled.

    off
    AppContentProtection

    string

    No

    Specifies whether to enable the anti-screenshot feature.

    Valid values:

    • off :

      Disabled. [Default value]

    • on :

      Enabled.

    off
    RecordContent

    string

    No

    Specifies whether to enable custom screen recording.

    Valid values:

    • off :

      Disabled. [Default value]

    • on :

      Enabled.

    OFF
    RecordContentExpires

    integer

    No

    The expiration time of custom screen recording files. Default value: 30 days.

    30
    RemoteCoordinate

    string

    No

    The keyboard and mouse control permissions during remote assistance.

    Valid values:

    • optionalControl :

      Disabled by default (can be requested)

    • fullControl :

      Full control.

    • disableControl :

      No control.

    fullControl
    RecordingDuration

    integer

    No

    The duration of each screen recording file segment. Unit: minutes. Recording files are automatically split and uploaded to the storage space based on the specified duration. Files are rolled over when they reach 300 MB.

    Valid values:

    • 10 :

      10

    • 20 :

      20

    • 30 :

      30

    • 60 :

      60

    10
    Scope

    string

    No

    The scope of the policy.

    Valid values:

    • IP :

      Takes effect based on IP address.

    • GLOBAL :

      Takes effect globally.

    GLOBAL
    ScopeValue

    array

    No

    The scope value. This parameter is required when Scope is set to IP. This parameter takes effect only when Scope is set to IP.

    string

    No

    The CIDR block range that the policy applies to.

    47.100.XX.XX/24
    RecordingAudio

    string

    No

    The option for recording cloud desktop audio.

    Valid values:

    • off :

      Record video only without audio.

    • on :

      Record both video and audio.

    on
    InternetCommunicationProtocol

    string

    No

    The network communication protocol.

    Valid values:

    • TCP :

      Allow only TCP [Default]

    • BOTH :

      Allow automatic switching between TCP and UDP.

    both
    VideoRedirect

    string

    No

    Multimedia redirection.

    Valid values:

    • off :

      Disable multimedia redirection.

    • on :

      Enable multimedia redirection.

    on
    WatermarkTransparencyValue

    integer

    No

    The watermark opacity. A larger value indicates lower transparency. Valid values: 10 to 100.

    10
    WatermarkColor

    integer

    No

    The watermark font color. Valid values: 0 to 16777215.

    0
    WatermarkDegree

    number

    No

    The watermark tilt angle. Valid values: -10 to -30.

    -10
    WatermarkFontSize

    integer

    No

    The watermark font size. Valid values: 10 to 20.

    10
    WatermarkFontStyle

    string

    No

    The watermark font style.

    Valid values:

    • plain :

      Plain.

    • bold :

      Bold.

    plain
    WatermarkRowAmount

    integer

    No

    The number of watermark rows.

    5
    EndUserApplyAdminCoordinate

    string

    No

    Specifies whether to enable the feature that allows users to request administrator assistance.

    Valid values:

    • OFF :

      Disabled.

    • ON :

      Enabled.

    ON
    EndUserGroupCoordinate

    string

    No

    Specifies whether to enable stream collaboration between users.

    Valid values:

    • OFF :

      Disabled.

    • ON :

      Enabled.

    ON
    WatermarkSecurity

    string

    No

    The security-first rule for invisible watermarks.

    Valid values:

    • off :

      Disabled.

    • on :

      Enabled.

    on
    AdminAccess

    string

    No

    Specifies whether users have administrator permissions after logging on to the cloud desktop.

    deny
    WatermarkAntiCam

    string

    No

    The anti-camera capture feature for invisible watermarks.

    Valid values:

    • off :

      Disabled.

    • on :

      Enabled.

    off
    WatermarkPower

    string

    No

    The enhancement level for invisible watermarks.

    Valid values:

    • high :

      High.

    • low :

      Low.

    • medium :

      Medium.

    medium
    RecordingUserNotify

    string

    No

    The screen recording client notification feature.

    Valid values:

    • off :

      Disabled.

    • on :

      Enabled.

    off
    RecordingUserNotifyMessage

    string

    No

    The notification content for the screen recording client. Leave this parameter empty by default.

    Your cloud desktop is being recorded
    MaxReconnectTime

    integer

    No

    The maximum reconnection retry time when the cloud desktop is disconnected due to objective reasons. Valid values: 30 to 7200. Unit: seconds.

    120
    DeviceRedirects

    array<object>

    No

    The list of device redirection rules.

    object

    No

    The device redirection rule.

    DeviceType

    string

    No

    The peripheral type.

    Valid values:

    • printer :

      Printer.

    • scanner :

      Scanner.

    • camera :

      Camera.

    • adb :

      Android device.

    camera
    RedirectType

    string

    No

    The redirection type.

    Valid values:

    • deviceRedirect :

      Device redirection.

    • usbRedirect :

      USB redirection.

    • off :

      Disable redirection.

    deviceRedirect
    DeviceRules

    array<object>

    No

    The list of custom peripheral rules.

    object

    No

    The custom peripheral rule.

    DeviceType

    string

    No

    The peripheral type.

    Valid values:

    • usbKey :

      UKey

    • other :

      Other.

    • graphicsTablet :

      Graphics tablet.

    • printer :

      Printer.

    • cardReader :

      Card reader.

    • scanner :

      Scanner.

    • storage :

      Storage device.

    • camera :

      Camera.

    • adb :

      Android device.

    • networkInterfaceCard :

      Network interface card.

    storage
    DeviceName

    string

    No

    The device name.

    sandisk
    DeviceVid

    string

    No

    The vendor ID. See Valid USB Vendor IDs (VIDs).

    0x0781
    DevicePid

    string

    No

    The product ID.

    0x55b1
    RedirectType

    string

    No

    The redirection type.

    Valid values:

    • deviceRedirect :

      Device redirection.

    • usbRedirect :

      USB redirection.

    • off :

      Disable redirection.

    usbRedirect
    OptCommand

    string

    No

    The link optimization instruction.

    2:0
    Platforms

    string

    No

    The platform types to which the device rule applies.

    Windows
    WyAssistant

    string

    No

    Specifies whether to provide the WUYING AI Assistant entry in the floating ball when connecting to a cloud computer through a desktop client (including Windows and macOS clients).

    Note

    Applicable only to desktop clients of V7.7 or later.

    Valid values:

    • off :

      Not provided.

    • on :

      Provided.

    on

    Response elements

    Element

    Type

    Description

    Example

    object

    The response parameters.

    PolicyGroupId

    string

    The cloud desktop policy ID.

    pg-gx2x1dhsmthe9****
    RequestId

    string

    The request ID.

    1CBAFFAB-B697-4049-A9B1-67E1FC5F****

    Examples

    Success response

    JSON format

    {
  "PolicyGroupId": "pg-gx2x1dhsmthe9****",
  "RequestId": "1CBAFFAB-B697-4049-A9B1-67E1FC5F****"
}

    Error codes

    See Error Codes for a complete list.

    Release notes

    See Release Notes for a complete list.