使用資源群組進行精細化資源控制-最新 - Elasticsearch

當您使用資源群組對資源進行分組管理時，可以結合存取控制（RAM），在單個阿里雲帳號內實現資源的隔離和精微調權限管理。本文總結了Elasticsearch對資源群組的支援情況，以及資源群組層級的授權操作步驟。

說明

只有支援資源群組的資源類型和支援資源群組層級授權的操作，資源群組層級授權才會生效。
對於不支援資源群組的資源類型，授予資源群組範圍的許可權將無效。在選擇資源範圍時，請選擇帳號層級，進行帳號層級授權。具體操作，請參見不支援資源群組層級授權的操作。

資源群組授權的工作原理

您可以使用資源群組（Resource Group）對阿里雲帳號內的資源進行分組管理。例如，為不同的專案建立對應的資源群組，並將資源轉移到對應的組中，以便集中管理各專案的資源。更多資訊，請參見什麼是資源群組。

在完成資源分組後，您可以為不同的RAM授權主體（RAM使用者、RAM使用者組或RAM角色）授予指定資源群組範圍的許可權，從而限定這個授權主體只能管理該資源群組內的資源。更多資訊，請參見資源分組和授權。

這種授權方式的優點有：

許可權精細化：確保每個身份能獲得最準確的資源存取權限，避免帳號下的多重專案的資源混合管理。
良好的擴充性：後續新增資源時，只需將其加入該資源群組，RAM身份便會自動獲得新資源的相應許可權，無需再次授權。

為RAM使用者授予資源群組層級的許可權

下面以RAM使用者為例，介紹授予指定資源群組內Elasticsearch資源許可權的操作步驟。

1. 前置步驟

建立待使用的RAM使用者，可參考：建立RAM使用者
建立資源群組並將已有資源劃分到目標資源群組，可參考：建立資源群組，資源自動轉組及資源手動轉組。

2. 進行資源群組層級授權

您可以通過以下任一方式進行資源群組層級授權。

方式一：在資源管理主控台中授權

通過資源群組的許可權管理功能為指定 RAM 使用者授權。詳情操作可參見為RAM身份授予資源群組範圍的許可權。

登入資源群組控制台。
在資源群組頁面，單擊目標資源群組操作列的許可權管理。
在許可權管理頁簽，單擊新增授權。
在新增授權面板，設定授權主體和權限原則。
- 授權主體：選擇已有RAM使用者。
- 權限原則：選擇系統策略或已建立的自訂策略，參考建立自訂權限原則。
單擊確認新增授權。

方式二：在 RAM 控制台中授權

通過RAM控制台為指定 RAM 使用者進行資源群組層級授權。詳細操作可參見為RAM使用者授權。

使用阿里雲帳號（主帳號）或Resource Access Management員登入RAM控制台。
在左側導覽列，選擇身份管理 > 使用者。在使用者頁面，單擊目標RAM使用者操作列的添加許可權。
在新增授權面板，為RAM使用者添加許可權。
- 資源範圍：選擇資源群組層級。
- 授權主體：選擇已有 RAM 使用者或前面步驟建立的 RAM 使用者。
- 權限原則：選擇系統策略或已建立的自訂策略，參考建立自訂權限原則。
單擊確認新增授權。

支援資源群組的資源類型

Elasticsearch支援資源群組的資源類型如下表所示：

雲端服務	雲端服務代碼	資源類型
Elasticsearch	elasticsearch	apm : 應用效能監控
Elasticsearch	elasticsearch	instance : 執行個體
Elasticsearch	elasticsearch	logstash : Logstash

說明

對於暫不支援資源群組的資源類型，如有需要，您可以在資源群組控制台提交反饋。

不支援資源群組層級授權的操作

Elasticsearch中不支援資源群組層級授權的操作（Action）如下：

操作（Action）	操作描述
elasticsearch:ActivePhone	-
elasticsearch:AddWhiteListTemplate	-
elasticsearch:AttachMigrationJob	-
elasticsearch:CreateCollector	-
elasticsearch:CreateComponentIndex	-
elasticsearch:CreateEmonAlarmGroup	-
elasticsearch:CreateEmonAlarmRule	-
elasticsearch:CreateEmonContact	-
elasticsearch:CreateEmonContactGroup	-
elasticsearch:CreateEmonContactGroupContact	-
elasticsearch:CreateEmonProject	-
elasticsearch:CreateMigrationJob	-
elasticsearch:DeleteCollector	-
elasticsearch:DeleteEmonAlarmGroup	-
elasticsearch:DeleteEmonAlarmRule	-
elasticsearch:DeleteEmonProject	-
elasticsearch:DeleteMigrationJobResource	-
elasticsearch:DeleteWhiteListTemplate	-
elasticsearch:DescribeAckOperator	-
elasticsearch:DescribeCollector	-
elasticsearch:DescribeMigrationMergeConfig	-
elasticsearch:DescribeVpcs	-
elasticsearch:DescribeVswitches	-
elasticsearch:DisableEmonAlarmRule	-
elasticsearch:DisableEmonContact	-
elasticsearch:DisableEmonContactGroup	-
elasticsearch:EnableEmonAlarmRule	-
elasticsearch:EnableEmonContact	-
elasticsearch:EnbaleEmonContactGroup	-
elasticsearch:FeedbackReport	-
elasticsearch:GetClusterDataInformation	-
elasticsearch:GetEmonAlarmEventList	-
elasticsearch:GetEmonAlarmEventStatistics	-
elasticsearch:GetEmonAlarmGroup	-
elasticsearch:GetEmonAlarmGroupList	-
elasticsearch:GetEmonAlarmRecordList	-
elasticsearch:GetEmonAlarmRecordStatistics	-
elasticsearch:GetEmonAlarmRecordStatisticsDistribute	-
elasticsearch:GetEmonAlarmRule	-
elasticsearch:GetEmonAlarmRuleList	-
elasticsearch:GetEmonConsoleConfig	-
elasticsearch:GetEmonContact	-
elasticsearch:GetEmonContactGroup	-
elasticsearch:GetEmonContactGroupList	-
elasticsearch:GetEmonContactList	-
elasticsearch:GetEmonGrafanaAlerts	-
elasticsearch:GetEmonGrafanaDashboards	-
elasticsearch:GetEmonProject	-
elasticsearch:GetEmonProjectList	-
elasticsearch:GetEmonUserConfig	-
elasticsearch:GetMigrationJob	-
elasticsearch:GetRegionConfiguration	-
elasticsearch:GetSinleEmonUserConfig	-
elasticsearch:GetWhiteListTemplates	-
elasticsearch:InitCustomModel	-
elasticsearch:InitializeOperationRole	-
elasticsearch:InstallAckOperator	-
elasticsearch:ListAckClusters	-
elasticsearch:ListAckNamespaces	-
elasticsearch:ListApm	-
elasticsearch:ListCollectors	-
elasticsearch:ListDefaultCollectorConfigurations	-
elasticsearch:ListDistinctEventInstanceIds	-
elasticsearch:ListEcsInstances	-
elasticsearch:ListEventRecords	-
elasticsearch:ListInstanceHistoryEvents	-
elasticsearch:ListMigrationJobs	-
elasticsearch:ListNodes	-
elasticsearch:ListStatsEventRecords	-
elasticsearch:ListTags	-
elasticsearch:ModifyDeployMachine	-
elasticsearch:PostEmonAck	-
elasticsearch:PostEmonCheckin	-
elasticsearch:PostEmonTryAlarmRule	-
elasticsearch:QueryEmonMetrics	-
elasticsearch:ReinstallCollector	-
elasticsearch:RestartCollector	-
elasticsearch:StartCollector	-
elasticsearch:StopCollector	-
elasticsearch:SuggestEmonMetric	-
elasticsearch:SuggestEmonMetricTagKey	-
elasticsearch:SuggestEmonMetricTagValue	-
elasticsearch:TagResources	-
elasticsearch:UntagResources	-
elasticsearch:UpdateCollector	-
elasticsearch:UpdateCollectorName	-
elasticsearch:UpdateComponentIndex	-
elasticsearch:UpdateEmonAlarmGroup	-
elasticsearch:UpdateEmonAlarmRule	-
elasticsearch:UpdateEmonContact	-
elasticsearch:UpdateEmonContactGroup	-
elasticsearch:UpdateEmonProject	-
elasticsearch:UpdateKeystores	-
elasticsearch:UpdateMigrationJob	-
elasticsearch:UpdateWhiteListTemplate	-
elasticsearch:ValidateSlrPermission	-
elasticsearch:createInstance	-

對於不支援資源群組授權的操作，授權時資源範圍選取資源群組層級將無效。如果仍需要RAM使用者有上述操作許可權，您需要建立自訂權限原則，授權時資源範圍選取帳號層級。

以下是兩個自訂權限原則樣本，您可以根據實際需要調整策略內容。

允許不支援資源群組層級授權的全部唯讀操作：Action中列舉不支援資源群組層級授權的所有隻讀操作。

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "elasticsearch:ActivePhone",
        "elasticsearch:CreateComponentIndex",
        "elasticsearch:CreateEmonAlarmGroup",
        "elasticsearch:CreateEmonAlarmRule",
        "elasticsearch:CreateEmonContact",
        "elasticsearch:CreateEmonContactGroup",
        "elasticsearch:CreateEmonContactGroupContact",
        "elasticsearch:CreateEmonProject",
        "elasticsearch:DeleteEmonAlarmGroup",
        "elasticsearch:DeleteEmonAlarmRule",
        "elasticsearch:DeleteEmonProject",
        "elasticsearch:DescribeAckOperator",
        "elasticsearch:DescribeCollector",
        "elasticsearch:DescribeMigrationMergeConfig",
        "elasticsearch:DescribeVpcs",
        "elasticsearch:DescribeVswitches",
        "elasticsearch:DisableEmonAlarmRule",
        "elasticsearch:DisableEmonContact",
        "elasticsearch:DisableEmonContactGroup",
        "elasticsearch:EnableEmonAlarmRule",
        "elasticsearch:EnableEmonContact",
        "elasticsearch:EnbaleEmonContactGroup",
        "elasticsearch:FeedbackReport",
        "elasticsearch:GetClusterDataInformation",
        "elasticsearch:GetEmonAlarmEventList",
        "elasticsearch:GetEmonAlarmEventStatistics",
        "elasticsearch:GetEmonAlarmGroup",
        "elasticsearch:GetEmonAlarmGroupList",
        "elasticsearch:GetEmonAlarmRecordList",
        "elasticsearch:GetEmonAlarmRecordStatistics",
        "elasticsearch:GetEmonAlarmRecordStatisticsDistribute",
        "elasticsearch:GetEmonAlarmRule",
        "elasticsearch:GetEmonAlarmRuleList",
        "elasticsearch:GetEmonConsoleConfig",
        "elasticsearch:GetEmonContact",
        "elasticsearch:GetEmonContactGroup",
        "elasticsearch:GetEmonContactGroupList",
        "elasticsearch:GetEmonContactList",
        "elasticsearch:GetEmonGrafanaAlerts",
        "elasticsearch:GetEmonGrafanaDashboards",
        "elasticsearch:GetEmonProject",
        "elasticsearch:GetEmonProjectList",
        "elasticsearch:GetEmonUserConfig",
        "elasticsearch:GetMigrationJob",
        "elasticsearch:GetSinleEmonUserConfig",
        "elasticsearch:GetWhiteListTemplates",
        "elasticsearch:InitializeOperationRole",
        "elasticsearch:InstallAckOperator",
        "elasticsearch:ListAckClusters",
        "elasticsearch:ListAckNamespaces",
        "elasticsearch:ListCollectors",
        "elasticsearch:ListDefaultCollectorConfigurations",
        "elasticsearch:ListEventRecords",
        "elasticsearch:ListInstanceHistoryEvents",
        "elasticsearch:ListMigrationJobs",
        "elasticsearch:ListNodes",
        "elasticsearch:ListTags",
        "elasticsearch:PostEmonAck",
        "elasticsearch:PostEmonCheckin",
        "elasticsearch:PostEmonTryAlarmRule",
        "elasticsearch:QueryEmonMetrics",
        "elasticsearch:ReinstallCollector",
        "elasticsearch:RestartCollector",
        "elasticsearch:SuggestEmonMetric",
        "elasticsearch:SuggestEmonMetricTagKey",
        "elasticsearch:SuggestEmonMetricTagValue",
        "elasticsearch:UpdateEmonAlarmGroup",
        "elasticsearch:UpdateEmonAlarmRule",
        "elasticsearch:UpdateEmonContact",
        "elasticsearch:UpdateEmonContactGroup",
        "elasticsearch:UpdateEmonProject",
        "elasticsearch:ValidateSlrPermission"
      ],
      "Resource": "*"
    }
  ]
}

允許不支援資源群組層級授權的全部操作：Action中列舉不支援資源群組層級授權的全部操作。

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "elasticsearch:ActivePhone",
        "elasticsearch:AddWhiteListTemplate",
        "elasticsearch:AttachMigrationJob",
        "elasticsearch:CreateCollector",
        "elasticsearch:CreateComponentIndex",
        "elasticsearch:CreateEmonAlarmGroup",
        "elasticsearch:CreateEmonAlarmRule",
        "elasticsearch:CreateEmonContact",
        "elasticsearch:CreateEmonContactGroup",
        "elasticsearch:CreateEmonContactGroupContact",
        "elasticsearch:CreateEmonProject",
        "elasticsearch:CreateMigrationJob",
        "elasticsearch:DeleteCollector",
        "elasticsearch:DeleteEmonAlarmGroup",
        "elasticsearch:DeleteEmonAlarmRule",
        "elasticsearch:DeleteEmonProject",
        "elasticsearch:DeleteMigrationJobResource",
        "elasticsearch:DeleteWhiteListTemplate",
        "elasticsearch:DescribeAckOperator",
        "elasticsearch:DescribeCollector",
        "elasticsearch:DescribeMigrationMergeConfig",
        "elasticsearch:DescribeVpcs",
        "elasticsearch:DescribeVswitches",
        "elasticsearch:DisableEmonAlarmRule",
        "elasticsearch:DisableEmonContact",
        "elasticsearch:DisableEmonContactGroup",
        "elasticsearch:EnableEmonAlarmRule",
        "elasticsearch:EnableEmonContact",
        "elasticsearch:EnbaleEmonContactGroup",
        "elasticsearch:FeedbackReport",
        "elasticsearch:GetClusterDataInformation",
        "elasticsearch:GetEmonAlarmEventList",
        "elasticsearch:GetEmonAlarmEventStatistics",
        "elasticsearch:GetEmonAlarmGroup",
        "elasticsearch:GetEmonAlarmGroupList",
        "elasticsearch:GetEmonAlarmRecordList",
        "elasticsearch:GetEmonAlarmRecordStatistics",
        "elasticsearch:GetEmonAlarmRecordStatisticsDistribute",
        "elasticsearch:GetEmonAlarmRule",
        "elasticsearch:GetEmonAlarmRuleList",
        "elasticsearch:GetEmonConsoleConfig",
        "elasticsearch:GetEmonContact",
        "elasticsearch:GetEmonContactGroup",
        "elasticsearch:GetEmonContactGroupList",
        "elasticsearch:GetEmonContactList",
        "elasticsearch:GetEmonGrafanaAlerts",
        "elasticsearch:GetEmonGrafanaDashboards",
        "elasticsearch:GetEmonProject",
        "elasticsearch:GetEmonProjectList",
        "elasticsearch:GetEmonUserConfig",
        "elasticsearch:GetMigrationJob",
        "elasticsearch:GetRegionConfiguration",
        "elasticsearch:GetSinleEmonUserConfig",
        "elasticsearch:GetWhiteListTemplates",
        "elasticsearch:InitCustomModel",
        "elasticsearch:InitializeOperationRole",
        "elasticsearch:InstallAckOperator",
        "elasticsearch:ListAckClusters",
        "elasticsearch:ListAckNamespaces",
        "elasticsearch:ListApm",
        "elasticsearch:ListCollectors",
        "elasticsearch:ListDefaultCollectorConfigurations",
        "elasticsearch:ListDistinctEventInstanceIds",
        "elasticsearch:ListEcsInstances",
        "elasticsearch:ListEventRecords",
        "elasticsearch:ListInstanceHistoryEvents",
        "elasticsearch:ListMigrationJobs",
        "elasticsearch:ListNodes",
        "elasticsearch:ListStatsEventRecords",
        "elasticsearch:ListTags",
        "elasticsearch:ModifyDeployMachine",
        "elasticsearch:PostEmonAck",
        "elasticsearch:PostEmonCheckin",
        "elasticsearch:PostEmonTryAlarmRule",
        "elasticsearch:QueryEmonMetrics",
        "elasticsearch:ReinstallCollector",
        "elasticsearch:RestartCollector",
        "elasticsearch:StartCollector",
        "elasticsearch:StopCollector",
        "elasticsearch:SuggestEmonMetric",
        "elasticsearch:SuggestEmonMetricTagKey",
        "elasticsearch:SuggestEmonMetricTagValue",
        "elasticsearch:TagResources",
        "elasticsearch:UntagResources",
        "elasticsearch:UpdateCollector",
        "elasticsearch:UpdateCollectorName",
        "elasticsearch:UpdateComponentIndex",
        "elasticsearch:UpdateEmonAlarmGroup",
        "elasticsearch:UpdateEmonAlarmRule",
        "elasticsearch:UpdateEmonContact",
        "elasticsearch:UpdateEmonContactGroup",
        "elasticsearch:UpdateEmonProject",
        "elasticsearch:UpdateKeystores",
        "elasticsearch:UpdateMigrationJob",
        "elasticsearch:UpdateWhiteListTemplate",
        "elasticsearch:ValidateSlrPermission",
        "elasticsearch:createInstance"
      ],
      "Resource": "*"
    }
  ]
}

重要

獲得帳號層級許可權的RAM使用者或RAM角色，能夠操作整個帳號範圍內的相關資源。請務必確認所授與權限是否符合預期，遵從最小授權原則謹慎分配許可權。

常見問題

如何查看當前資源屬於哪個資源群組？

方式一：單擊資源名稱，進入資源的詳情頁面，即可查看到當前資源的資源群組。
方式二：登入資源管理主控台，單擊資源中心 > 資源搜尋，在左側選擇目標資源所屬帳號（預設為當前帳號），通過篩選條件定位目標資源，即可查看其所屬資源群組。

如何查看當前產品在某個資源群組下的所有資源？

方式一：登入資源管理主控台，單擊資源中心 > 資源搜尋，然後在左側的資源所屬帳號（預設為當前帳號）下選擇單擊目標資源群組名稱，最後在右側的選擇資源類型中選擇當前產品，即可查看當前產品在某個資源群組下的所有資源。
方式二：登入資源管理主控台，單擊資源群組 > 資源群組，然後找到目標資源群組，單擊其所在行的操作列下的資源管理，最後在資源管理頁面上方的產品下拉框中選擇當前產品，即可查看當前產品在某個資源群組下的所有資源。

如何批量修改多個資源的資源群組？

登入資源管理主控台，單擊資源群組 > 資源群組，在目標資源群組所在行的操作列下，單擊資源管理以進入資源管理頁面。通過篩選條件定位多個目標資源，批量勾選第一列的複選框後單擊下方轉移資源群組，並按頁面提示完成資源群組修改。