Virtual Private Cloud：使用資源群組進行精細化資源控制-最新

資源群組授權的工作原理

您可以使用資源群組（Resource Group）對阿里雲帳號內的資源進行分組管理。例如，為不同的專案建立對應的資源群組，並將資源轉移到對應的組中，以便集中管理各專案的資源。更多資訊，請參見什麼是資源群組。

在完成資源分組後，您可以為不同的RAM授權主體（RAM使用者、RAM使用者組或RAM角色）授予指定資源群組範圍的許可權，從而限定這個授權主體只能管理該資源群組內的資源。更多資訊，請參見資源分組和授權。

這種授權方式的優點有：

• 許可權精細化：確保每個身份能獲得最準確的資源存取權限，避免帳號下的多重專案的資源混合管理。

• 良好的擴充性：後續新增資源時，只需將其加入該資源群組，RAM身份便會自動獲得新資源的相應許可權，無需再次授權。

為RAM使用者授予資源群組層級的許可權

下面以RAM使用者為例，介紹授予指定資源群組內Virtual Private Cloud資源許可權的操作步驟。

支援資源群組的資源類型

Virtual Private Cloud支援資源群組的資源類型如下表所示：

不支援資源群組層級授權的操作

Virtual Private Cloud中不支援資源群組層級授權的操作（Action）如下：

對於不支援資源群組授權的操作，授權時資源範圍選取資源群組層級將無效。如果仍需要RAM使用者有上述操作許可權，您需要建立自訂權限原則，授權時資源範圍選取帳號層級。

以下是兩個自訂權限原則樣本，您可以根據實際需要調整策略內容。

• 允許不支援資源群組層級授權的全部唯讀操作：Action中列舉不支援資源群組層級授權的所有隻讀操作。

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "vpc:DescribeAccessPoints",
          "vpc:DescribeBandwidthPackageMonitorData",
          "vpc:DescribeGlobalAccelerationInstances",
          "vpc:DescribeGrantRulesToCbn",
          "vpc:DescribeIPv6TranslatorAclListAttributes",
          "vpc:DescribeIPv6TranslatorAclLists",
          "vpc:DescribeIPv6TranslatorEntries",
          "vpc:DescribeNetworkQuotas",
          "vpc:DescribePublicIpAddress",
          "vpc:DescribeRouterInterfacesForGlobal",
          "vpc:DescribeServerRelatedGlobalAccelerationInstances",
          "vpc:DescribeVpnGatewayAvailableZones",
          "vpc:DiagnoseVpnConnections",
          "vpc:DiagnoseVpnConnectionsHistory",
          "vpc:DiagnoseVpnGateway",
          "vpc:GetFlowLogServiceStatus",
          "vpc:GetPhysicalConnectionServiceStatus",
          "vpc:GetPublicIpAddressPoolServiceStatus",
          "vpc:GetTrafficMirrorServiceStatus",
          "vpc:GetVpcIpamServiceStatus",
          "vpc:GetVpnGatewayDiagnoseResult",
          "vpc:InnerVpcDescribeCrossBorderRouterInterface",
          "vpc:ListBusinessAccessPointPortUsage",
          "vpc:ListBusinessAccessPoints",
          "vpc:ListBusinessRegions",
          "vpc:ListGeographicSubRegions",
          "vpc:ListNatGatewayEcsMetric",
          "vpc:ListVpcCloudInstance",
          "vpc:ListVpcEndpointServicesByEndUser",
          "vpc:QueryPconnTrafficPrice",
          "vpc:QueryPhysicalConnectionPrice"
        ],
        "Resource": "*"
      }
    ]
  }
  

• 允許不支援資源群組層級授權的全部操作：Action中列舉不支援資源群組層級授權的全部操作。

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "vpc:AddBandwidthPackageIps",
          "vpc:AddGlobalAccelerationInstanceIp",
          "vpc:AddIPv6TranslatorAclListEntry",
          "vpc:AllocateVpcIpv6Cidr",
          "vpc:CancelExpressCloudConnection",
          "vpc:CheckVpnBgpEnabled",
          "vpc:ConvertBandwidthPackage",
          "vpc:CreaeNatGateway",
          "vpc:CreateBandwidthPackage",
          "vpc:CreateBondRouterInterfaceConnection",
          "vpc:CreateEnhancedVpnGateway",
          "vpc:CreateExpressCloudConnection",
          "vpc:CreateGlobalAccelerationInstance",
          "vpc:CreateIPv6Translator",
          "vpc:CreateIPv6TranslatorAclList",
          "vpc:CreateIPv6TranslatorEntry",
          "vpc:CreateNqa",
          "vpc:CreateRouteTargetGroup",
          "vpc:DeleteBandwidthPackage",
          "vpc:DeleteEnhancedVpnGateway",
          "vpc:DeleteGlobalAccelerationInstance",
          "vpc:DeleteIPv6Translator",
          "vpc:DeleteIPv6TranslatorAclList",
          "vpc:DeleteIPv6TranslatorEntry",
          "vpc:DeleteIpv6EgressOnlyRule",
          "vpc:DescribeAccessPoints",
          "vpc:DescribeBandwidthPackageMonitorData",
          "vpc:DescribeGlobalAccelerationInstances",
          "vpc:DescribeGrantRulesToCbn",
          "vpc:DescribeIPv6TranslatorAclListAttributes",
          "vpc:DescribeIPv6TranslatorAclLists",
          "vpc:DescribeIPv6TranslatorEntries",
          "vpc:DescribeInstances",
          "vpc:DescribeNetworkQuotas",
          "vpc:DescribePublicIpAddress",
          "vpc:DescribeRouterInterfacesForGlobal",
          "vpc:DescribeServerRelatedGlobalAccelerationInstances",
          "vpc:DescribeVPCs",
          "vpc:DescribeVpnGatewayAvailableZones",
          "vpc:DescribeVrouters",
          "vpc:DescribeZones",
          "vpc:DiagnoseVpnConnections",
          "vpc:DiagnoseVpnConnectionsHistory",
          "vpc:DiagnoseVpnGateway",
          "vpc:DisableNatGatewayEcsMetric",
          "vpc:EnableNatGatewayEcsMetric",
          "vpc:GetBusinessAccessPointDetail",
          "vpc:GetFlowLogServiceStatus",
          "vpc:GetObject",
          "vpc:GetPhysicalConnectionServiceStatus",
          "vpc:GetPublicIpAddressPoolServiceStatus",
          "vpc:GetRouteTargetGroup",
          "vpc:GetTrafficMirrorServiceStatus",
          "vpc:GetVpcIpamServiceStatus",
          "vpc:GetVpnGatewayDiagnoseResult",
          "vpc:GrantInstanceToCbn",
          "vpc:InnerVpcCreateDscp",
          "vpc:InnerVpcDeleteDscp",
          "vpc:InnerVpcDescribeCrossBorderRouterInterface",
          "vpc:InnerVpcDescribeDscp",
          "vpc:InnerVpcModifyDscp",
          "vpc:InnerVpcRefreshDscp",
          "vpc:ListBusinessAccessPointPortUsage",
          "vpc:ListBusinessAccessPoints",
          "vpc:ListBusinessRegions",
          "vpc:ListGeographicSubRegions",
          "vpc:ListNatGatewayEcsMetric",
          "vpc:ListVpcCloudInstance",
          "vpc:ListVpcEndpointServicesByEndUser",
          "vpc:ModifyBandwidthPackageSpec",
          "vpc:ModifyBypassToaAttribute",
          "vpc:ModifyExpressCloudConnectionAttribute",
          "vpc:ModifyGlobalAccelerationInstanceAttributes",
          "vpc:ModifyGlobalAccelerationInstanceSpec",
          "vpc:ModifyIPv6TranslatorAclAttribute",
          "vpc:ModifyIPv6TranslatorAclListEntry",
          "vpc:ModifyIPv6TranslatorAttribute",
          "vpc:ModifyIPv6TranslatorBandwidth",
          "vpc:ModifyIPv6TranslatorEntry",
          "vpc:ModifyIpv6GatewaySpec",
          "vpc:OpenFlowLogService",
          "vpc:OpenPhysicalConnectionService",
          "vpc:OpenPublicIpAddressPoolService",
          "vpc:OpenTrafficMirrorService",
          "vpc:OpenVpcIpamService",
          "vpc:QueryPconnTrafficPrice",
          "vpc:QueryPhysicalConnectionPrice",
          "vpc:RejectVpcPeerConnection",
          "vpc:RemoveBandwidthPackageIps",
          "vpc:RemoveGlobalAccelerationInstanceIp",
          "vpc:RemoveIPv6TranslatorAclListEntry",
          "vpc:RevokeInstanceFromCbn",
          "vpc:SetHaVipMasterInstance",
          "vpc:TransformEipSegmentToPublicIpAddressPool",
          "vpc:UnAssociateEipAddress",
          "vpc:UnassociateGlobalAccelerationInstance",
          "vpc:UpdateCrossBoarderStatus",
          "vpc:UpdateEnhancedVpnGateway",
          "vpc:UpdateRouteTargetGroup",
          "vpc:associatevpccidrblock",
          "vpc:createvpc",
          "vpc:deleteBgpNetwork",
          "vpc:describeVpcs",
          "vpc:releaseIpv6Address"
        ],
        "Resource": "*"
      }
    ]
  }
  

常見問題