：使用資源群組進行精細化資源控制-最新

資源群組授權的工作原理

您可以使用資源群組（Resource Group）對阿里雲帳號內的資源進行分組管理。例如，為不同的專案建立對應的資源群組，並將資源轉移到對應的組中，以便集中管理各專案的資源。更多資訊，請參見什麼是資源群組。

在完成資源分組後，您可以為不同的RAM授權主體（RAM使用者、RAM使用者組或RAM角色）授予指定資源群組範圍的許可權，從而限定這個授權主體只能管理該資源群組內的資源。更多資訊，請參見資源分組和授權。

這種授權方式的優點有：

• 許可權精細化：確保每個身份能獲得最準確的資源存取權限，避免帳號下的多重專案的資源混合管理。

• 良好的擴充性：後續新增資源時，只需將其加入該資源群組，RAM身份便會自動獲得新資源的相應許可權，無需再次授權。

為RAM使用者授予資源群組層級的許可權

下面以RAM使用者為例，介紹授予指定資源群組內Elastic Compute Service資源許可權的操作步驟。

支援資源群組的資源類型

Elastic Compute Service支援資源群組的資源類型如下表所示：

不支援資源群組層級授權的操作

Elastic Compute Service中不支援資源群組層級授權的操作（Action）如下：

對於不支援資源群組授權的操作，授權時資源範圍選取資源群組層級將無效。如果仍需要RAM使用者有上述操作許可權，您需要建立自訂權限原則，授權時資源範圍選取帳號層級。

以下是兩個自訂權限原則樣本，您可以根據實際需要調整策略內容。

• 允許不支援資源群組層級授權的全部唯讀操作：Action中列舉不支援資源群組層級授權的所有隻讀操作。

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "ecs:CheckOpenSnapshotService",
          "ecs:DescribeAccountAttributes",
          "ecs:DescribeAccountCommonQuotas",
          "ecs:DescribeAccountLimits",
          "ecs:DescribeBandwidthHistory",
          "ecs:DescribeClassicLinkInstances",
          "ecs:DescribeCloudAssistantSettings",
          "ecs:DescribeDedicatedBlockStorageClusterDisks",
          "ecs:DescribeDeploymentSetTopology",
          "ecs:DescribeDeploymentSets",
          "ecs:DescribeDiagnosisOperateRecords",
          "ecs:DescribeDiagnosticMetrics",
          "ecs:DescribeDiagnosticReportAttributes",
          "ecs:DescribeDiskDefaultKMSKeyId",
          "ecs:DescribeDiskEncryptionByDefaultStatus",
          "ecs:DescribeEcsScenarioFacade",
          "ecs:DescribeEipPrice",
          "ecs:DescribeFunctionFeedback",
          "ecs:DescribeHpcClusters",
          "ecs:DescribeImageFromFamily",
          "ecs:DescribeInsightCheckItems",
          "ecs:DescribeInsightChecks",
          "ecs:DescribeInsightStatus",
          "ecs:DescribeInsightSummaries",
          "ecs:DescribeInstanceCrossZoneModifyConstraint",
          "ecs:DescribeInstanceMigrationLog",
          "ecs:DescribeInstanceStatus",
          "ecs:DescribeInstanceTypeResource",
          "ecs:DescribeKMSKeyAttribute",
          "ecs:DescribeKMSKeys",
          "ecs:DescribeLimitation",
          "ecs:DescribeLinkedKMSKeys",
          "ecs:DescribeMigrationInstancesTask",
          "ecs:DescribeMigrationPlans",
          "ecs:DescribeMigrationPreferences",
          "ecs:DescribeNetworkInsightsAnalysisResult",
          "ecs:DescribeNetworkInsightsAnalysises",
          "ecs:DescribeNetworkInsightsPaths",
          "ecs:DescribeOrderAutoRebootTime",
          "ecs:DescribePlanMaintenanceWindows",
          "ecs:DescribePortRangeListAssociations",
          "ecs:DescribePortRangeListEntries",
          "ecs:DescribeReservationDemandCommittedAmount",
          "ecs:DescribeReservationDemands",
          "ecs:DescribeReservedInstanceCategories",
          "ecs:DescribeResourceByTags",
          "ecs:DescribeResourceDisplay",
          "ecs:DescribeResourceStatusDiagnosis",
          "ecs:DescribeSecurityGroupSnapshotAttributes",
          "ecs:DescribeSecurityGroupSnapshotPolicies",
          "ecs:DescribeSecurityGroupSnapshots",
          "ecs:DescribeSnapshotBusinessStatus",
          "ecs:DescribeSnapshotCampaign",
          "ecs:DescribeSnapshotMonitorData",
          "ecs:DescribeSnapshotPackage",
          "ecs:DescribeSnapshotPolicyAssociatedSecurityGroups",
          "ecs:DescribeSnapshotsUsage",
          "ecs:DescribeStorageCapacityUnitDeductFactor",
          "ecs:DescribeStorageSetDetails",
          "ecs:DescribeTaskAttribute",
          "ecs:DescribeTasks",
          "ecs:DescribeUserBusinessBehavior",
          "ecs:DescribeVolumes",
          "ecs:DescribeVpcHavsInstances",
          "ecs:DescribeWaitingOrders",
          "ecs:DiskDefaultEncryptionQueryByParam",
          "ecs:GetSnapshotBlock",
          "ecs:GetSnapshotInfo",
          "ecs:ListAccountEcsQuotas",
          "ecs:ListChangedBlocks",
          "ecs:ListServiceSettings",
          "ecs:ListSnapshotBlocks",
          "ecs:QueryNeedKeepUsing",
          "ecs:QueryUsableSnapshots",
          "ecs:QueryUserInfo"
        ],
        "Resource": "*"
      }
    ]
  }
  

• 允許不支援資源群組層級授權的全部操作：Action中列舉不支援資源群組層級授權的全部操作。

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "ecs:AddInstancesToCarePlan",
          "ecs:AddInvisibleChecks",
          "ecs:AllocateEipAddress",
          "ecs:ApplySecurityGroupSnapshot",
          "ecs:AssociateEipAddress",
          "ecs:AssociateSecurityGroupSnapshotPolicy",
          "ecs:CancelMigrationPlan",
          "ecs:CancelTask",
          "ecs:CheckOpenSnapshotService",
          "ecs:ConfirmCarePlanBill",
          "ecs:CreateCarePlan",
          "ecs:CreateClassicToVpcRollbackTask",
          "ecs:CreateDeploymentSet",
          "ecs:CreateDiagnosisOperateRecords",
          "ecs:CreateDiagnosticMetricSet",
          "ecs:CreateFunctionFeedback",
          "ecs:CreateHpcCluster",
          "ecs:CreateIssueCategoryReportRelation",
          "ecs:CreateNetworkInsightsPath",
          "ecs:CreatePlanMaintenanceWindow",
          "ecs:CreatePortRangeList",
          "ecs:CreateSecurityGroupSnapshotPolicy",
          "ecs:DeleteCarePlan",
          "ecs:DeleteDeploymentSet",
          "ecs:DeleteDiagnosticMetricSets",
          "ecs:DeleteDiagnosticReports",
          "ecs:DeleteHpcCluster",
          "ecs:DeleteNetworkInsightsAnalysis",
          "ecs:DeleteNetworkInsightsPath",
          "ecs:DeletePlanMaintenanceWindow",
          "ecs:DeletePortRangeList",
          "ecs:DeleteReservationDemand",
          "ecs:DeleteSecurityGroupSnapshotPolicy",
          "ecs:DeleteVolume",
          "ecs:DeleteWaitingOrders",
          "ecs:DescribeAccountAttributes",
          "ecs:DescribeAccountCommonQuotas",
          "ecs:DescribeAccountLimits",
          "ecs:DescribeAvailableResource",
          "ecs:DescribeBandwidthHistory",
          "ecs:DescribeCarePlans",
          "ecs:DescribeChargeTypeModificationPrice",
          "ecs:DescribeClassicLinkInstances",
          "ecs:DescribeCloudAssistantSettings",
          "ecs:DescribeClusters",
          "ecs:DescribeCustomerIssueCategory",
          "ecs:DescribeDedicatedBlockStorageClusterDisks",
          "ecs:DescribeDeploymentSetTopology",
          "ecs:DescribeDeploymentSets",
          "ecs:DescribeDiagnosisOperateRecords",
          "ecs:DescribeDiagnosticMetrics",
          "ecs:DescribeDiagnosticReportAttributes",
          "ecs:DescribeDiskDefaultKMSKeyId",
          "ecs:DescribeDiskEncryptionByDefaultStatus",
          "ecs:DescribeEcsScenarioFacade",
          "ecs:DescribeEipAddresses",
          "ecs:DescribeEipPrice",
          "ecs:DescribeFunctionFeedback",
          "ecs:DescribeHpcClusters",
          "ecs:DescribeImageFromFamily",
          "ecs:DescribeInsightCheckItems",
          "ecs:DescribeInsightChecks",
          "ecs:DescribeInsightStatus",
          "ecs:DescribeInsightSummaries",
          "ecs:DescribeInstanceCrossZoneModifyConstraint",
          "ecs:DescribeInstanceMigrationLog",
          "ecs:DescribeInstanceStatus",
          "ecs:DescribeInstanceTypeResource",
          "ecs:DescribeInstanceTypes",
          "ecs:DescribeKMSKeyAttribute",
          "ecs:DescribeKMSKeys",
          "ecs:DescribeLimitation",
          "ecs:DescribeLinkedKMSKeys",
          "ecs:DescribeMigrationInstancesTask",
          "ecs:DescribeMigrationPlans",
          "ecs:DescribeMigrationPreferences",
          "ecs:DescribeNetworkInsightsAnalysisResult",
          "ecs:DescribeNetworkInsightsAnalysises",
          "ecs:DescribeNetworkInsightsPaths",
          "ecs:DescribeOrderAutoRebootTime",
          "ecs:DescribePlanMaintenanceWindows",
          "ecs:DescribePortRangeListAssociations",
          "ecs:DescribePortRangeListEntries",
          "ecs:DescribePurchaseRecommendation",
          "ecs:DescribeRegions",
          "ecs:DescribeReservationDemandCommittedAmount",
          "ecs:DescribeReservationDemands",
          "ecs:DescribeReservedInstanceCategories",
          "ecs:DescribeResourceByTags",
          "ecs:DescribeResourceDisplay",
          "ecs:DescribeResourceStatusDiagnosis",
          "ecs:DescribeSecurityGroupSnapshotAttributes",
          "ecs:DescribeSecurityGroupSnapshotPolicies",
          "ecs:DescribeSecurityGroupSnapshots",
          "ecs:DescribeSnapshotBusinessStatus",
          "ecs:DescribeSnapshotCampaign",
          "ecs:DescribeSnapshotMonitorData",
          "ecs:DescribeSnapshotPackage",
          "ecs:DescribeSnapshotPolicyAssociatedSecurityGroups",
          "ecs:DescribeSnapshotPrice",
          "ecs:DescribeSnapshotWarmups",
          "ecs:DescribeSnapshotsUsage",
          "ecs:DescribeSpotPriceHistory",
          "ecs:DescribeStorageCapacityUnitDeductFactor",
          "ecs:DescribeStorageSetDetails",
          "ecs:DescribeTaskAttribute",
          "ecs:DescribeTasks",
          "ecs:DescribeUserBusinessBehavior",
          "ecs:DescribeVSwitches",
          "ecs:DescribeVolumes",
          "ecs:DescribeVpcHavsInstances",
          "ecs:DescribeVpcs",
          "ecs:DescribeWaitingOrders",
          "ecs:DescribeZones",
          "ecs:DisableDiskEncryptionByDefault",
          "ecs:DiskDefaultEncryptionQueryByParam",
          "ecs:EnableDiskEncryptionByDefault",
          "ecs:EnableInsight",
          "ecs:GetSnapshotBlock",
          "ecs:GetSnapshotInfo",
          "ecs:InnerCreateDiagnosticReport",
          "ecs:InnerOpenSnapShotService",
          "ecs:InnerReleaseDedicatedHost",
          "ecs:InnerReleaseElasticAssurance",
          "ecs:JoinSnapshotCampaign",
          "ecs:KeepUsing",
          "ecs:ListAccountEcsQuotas",
          "ecs:ListBandwidthHistory",
          "ecs:ListChangedBlocks",
          "ecs:ListServiceSettings",
          "ecs:ListSnapshotBlocks",
          "ecs:ModifyCarePlanAttribute",
          "ecs:ModifyCloudAssistantSettings",
          "ecs:ModifyDeploymentSetAttribute",
          "ecs:ModifyDiskDefaultKMSKeyId",
          "ecs:ModifyHpcClusterAttribute",
          "ecs:ModifyOrderAutoRebootTime",
          "ecs:ModifyPlanMaintenanceWindow",
          "ecs:ModifyPortRangeList",
          "ecs:ModifyReservationDemand",
          "ecs:ModifyResourceMeta",
          "ecs:ModifySecurityGroupSnapshotPolicy",
          "ecs:ModifySnapshotBusinessStatus",
          "ecs:ModifyUserBusinessBehavior",
          "ecs:ModifyVolumeAttribute",
          "ecs:OpenSnapShotService",
          "ecs:OpenSnapshotService",
          "ecs:PurchaseSavingPlanOffering",
          "ecs:PurchaseStorageCapacityUnit",
          "ecs:QueryConstraints",
          "ecs:QueryCopyImageSupportRegions",
          "ecs:QueryNeedKeepUsing",
          "ecs:QueryUsableSnapshots",
          "ecs:QueryUserInfo",
          "ecs:ReAddMigrationTaskInPlan",
          "ecs:ReInitVolume",
          "ecs:ReinitDisk",
          "ecs:ReleaseCapacityReservation",
          "ecs:ReleaseEipAddress",
          "ecs:RemoveInvisibleChecks",
          "ecs:ResetDiskDefaultKMSKeyId",
          "ecs:ResizeVolume",
          "ecs:RollbackVolume",
          "ecs:RunInstance",
          "ecs:StartNetworkInsightsAnalysis",
          "ecs:UnassociateEipAddress",
          "ecs:UnassociateSecurityGroupSnapshotPolicy",
          "ecs:UpdateServiceSettings",
          "ecs:WithdrawCarePlan",
          "ecs:describeImageFromFamily",
          "ecs:describeInstances",
          "ecs:runInstances",
          "ecs:unmountPEDisk"
        ],
        "Resource": "*"
      }
    ]
  }
  

常見問題