Auto Scaling:Ölçeklendirme gruplarını yönetmek için kaynak gruplarını kullanın

Test ve üretim ortamları için kaynak grupları oluşturun.

Bu örnekte, üretim ortamı için ProdResourceGroup adında ve test ortamı için TestResourceGroup adında birer kaynak grubu kullanılmaktadır. Daha fazla bilgi için bkz. Kaynak grubu oluşturma.

İşlemi tamamladıktan sonra kaynak grubunun durumu Creating... olarak görünür. Yaklaşık 3 saniye sonra simgesine tıklayın. Durum Available olarak değişirse kaynak grubu başarıyla oluşturulmuş demektir.

Test ortamı için bir ölçeklendirme grubu oluşturun.

Ölçeklendirme grubundaki ECS örneklerinin, ölçeklendirme grubuyla aynı kaynak grubunda yer aldığından emin olmak için TestScalingGroup gibi bir ölçeklendirme grubu oluştururken aşağıdaki yöntemleri kullanın. İzlenecek yöntem, seçilen Instance Configuration Source değerine bağlıdır.

• Instance Configuration Source değerini Launch Template olarak ayarlarsanız, başlatma şablonunu oluştururken Advanced configurations (optional) adımında Resource Group değerini TestResourceGroup olarak belirtin. Daha fazla bilgi için bkz. Başlatma şablonu oluşturma.

• Instance Configuration Source değerini Select Existing Instance olarak ayarlarsanız, ECS örneğini oluştururken Advanced configurations (optional) bölümünde Resource Group değerini TestResourceGroup olarak belirtin. Daha fazla bilgi için bkz. Sihirbazı kullanarak örnek oluşturma.

• If you set Instance Configuration Source to Create from Scratch, specify the Resource Group as TestResourceGroup in the Advanced Settings section when you create the scaling configuration. For more information, see Create a scaling configuration for ECS instances.

When you configure the scaling group parameters, set Resource Group to TestResourceGroup to create the scaling group for the test environment. For more information, see Create a scaling group.

Create a scaling group for the production environment.

To ensure that the ECS instances in the scaling group belong to the same resource group as the scaling group, use the following methods when you create a scaling group, for example, ProdScalingGroup. The method depends on the selected Instance Configuration Source.

• If you set Instance Configuration Source to Launch Template, specify the Resource Group as ProdResourceGroup in the Advanced configurations (optional) step when you create the launch template. For more information, see Create a launch template.

• If you set Instance Configuration Source to Select Existing Instance, specify the Resource Group as ProdResourceGroup in the Advanced configurations (optional) section when you create the ECS instance. For more information, see Create an instance by using the wizard.

• If you set Instance Configuration Source to Create from Scratch, specify the Resource Group as ProdResourceGroup in the Advanced Settings section when you create the scaling configuration. For more information, see Create a scaling configuration for ECS instances.

When you configure the scaling group parameters, set Resource Group to ProdResourceGroup to create the scaling group for the production environment. For more information, see Create a scaling group.

Log on to the Auto Scaling konsolu.

In the upper-left corner of the top navigation bar, select different resource groups to verify the visibility of scaling groups and their instances.

• When you select All resources, both the test scaling group (TestScalingGroup) and the production scaling group (ProdScalingGroup) appear in the scaling group list. If the scaling groups scaled out new ECS instances, you can view all instances from both the test (TestResourceGroup) and production (ProdResourceGroup) resource groups on the Instances tab.

• When you select TestResourceGroup, only the TestScalingGroup scaling group appears in the list. If the scaling group scaled out new ECS instances, you can view only the instances that belong to the test resource group (TestResourceGroup) on the Instances tab.

• When you select ProdResourceGroup, only the ProdScalingGroup scaling group appears in the list. If the scaling group scaled out new ECS instances, you can view only the instances that belong to the production resource group (ProdResourceGroup) on the Instances tab.

In RAM, create a custom policy named ApiWithoutResourcePolicy.

Some Auto Scaling API operations do not support resource group-based authentication, so you must create a custom policy to grant permissions for these operations. For more information, see Create a custom policy.

• The following API operations do not support resource group-based authentication:

  • DescribeRegions

  • DescribeLimitation

  • DescribeNotificationTypes

  • ListTagKeys

  • ListTagValues

• Use the following content for the ApiWithoutResourcePolicy custom policy:

  {
    "Version": "1",
    "Statement": [
       {
          "Action": [
             "ess:DescribeRegions",
             "ess:DescribeLimitation",
             "ess:DescribeNotificationTypes",
             "ess:ListTagKeys",
             "ess:ListTagValues"
            ],
           "Resource": "*",
           "Effect": "Allow"
         }
      ]
  }

Create RAM users for the administrators of Department A and Department B and grant them permissions at the Alibaba Cloud account scope.

This step provides an example for the Department A administrator. Select the RAM user for the Department A administrator as the Principal. Attach the ApiWithoutResourcePolicy custom policy created in Step 1 and the AliyunECSFullAccess system policy. For more information, see Grant permissions to a RAM user.

• Grant the custom policy to the Department A administrator:

  On the Add permissions panel, set Authorized scope to Alibaba Cloud account, confirm that the principal is the target RAM user, click the Custom policy tab, and then search for and select the ApiWithoutResourcePolicy policy.

• On the Add permissions page, set Authorized scope to Alibaba Cloud account, confirm that the principal is the target RAM user, click the System policy tab, and then search for and select AliyunECSFullAccess (permissions to manage Elastic Compute Service).

Create a resource group named DepartmentA for Department A and a resource group named DepartmentB for Department B.

For more information, see Create a resource group.

Grant the Department A administrator the AliyunESSFullAccess policy, scoped to the DepartmentA resource group.

For more information, see Grant permissions on a resource group to a RAM identity or Grant permissions to a RAM user.

Repeat Step 4 to grant the Department B administrator the AliyunESSFullAccess policy, scoped to the DepartmentB resource group.

Set Permission Scope to the specific resource group DepartmentB, and select the RAM user for the Department B administrator as the Principal.

Log on to the Auto Scaling konsolu.

In the upper-left corner of the top navigation bar, select different resource groups and attempt to create a scaling group.

For more information, see Create a scaling group.

• When you select DepartmentA, the Department A administrator can successfully create a scaling group in the DepartmentA resource group.

  On the Scaling Groups page, the scaling group ScalingGroup-A is displayed with type ECS and status Enabled.

• When you select DepartmentB, the Department A administrator does not have permission to create a scaling group in the DepartmentB resource group.

  The console returns the error code Forbidden.Unauthorized. The policy type is Identity-based policy (resource-group-level), and the permission decision is Implicitly denied.

Verify whether the Department A administrator can view scaling groups in different resource groups.

For more information, see View scaling groups.

• The Department A administrator can successfully view scaling groups in the DepartmentA resource group.

  The Scaling Groups page displays ScalingGroup-A with type ECS, status Enabled, a maximum of 1 instance, and no running instances.

• When the Department A administrator attempts to view scaling groups in the DepartmentB resource group, permission is denied.

  The error details show the error code Forbidden.Unauthorized, authentication action ess:DescribeScalingGroups, policy type Identity-based policy (resource-group-level), and permission decision Implicitly denied.