Elastic Container Instance:Use tags to authenticate a RAM user

Scenario

The scenario in this topic is used to describe how to perform tag-based authentication.

For example, you want to grant a RAM user the permissions only on the Elastic Container Instance resources that have the env:test tag, as shown in the following figure:

You have the following specific requirements:

• Requirement 1: The RAM user can successfully create Elastic Container Instance resources only if the RAM user binds the env:test tag to the resources.

• Requirement 2: The RAM user can operate only the Elastic Container Instance resources that are created by the RAM user. The resources must have the env:test tag.

• Requirement 3: The RAM user can view only the Elastic Container Instance resources that are created by the RAM user. The resources must have the env:test tag.

Step 1: Create a custom policy and attach the policy to the RAM user

1. Use your Alibaba Cloud account to log on to the RAM console.

2. In the left-side navigation pane, choose Permissions > Policies.

3. On the Policies page, click Create Policy.

4. Configure the parameters to create a custom policy.

   1. Click the Import Policy tab.

   2. In the dialog box that appears, select System Policy from the Policy Template drop-down list, enter AliyunECIFullAccess in the "Filter templates" search box, select the AliyunECIFullAccess policy, and then click Import.

      AliyunECIFullAccess is the default policy for managing Elastic Container Instance resources. AliyunECIFullAccess contains the permissions to operate Elastic Container Instance resources, query resources such as security groups and virtual private clouds (VPCs), and create the service-linked role for Elastic Container Instance.

   3. Click the JSON tab.

   4. Modify the policy document in the code editor and then click Next to edit policy information.

      Note

      A policy contains a set of permissions. Each policy includes a version number and authorization statements. Each statement includes the following elements: Effect, Action, Resource, and Condition. The Condition element is optional. For more information, see Policy structure and syntax and Policy elements.

      You can specify authentication tags in the Condition element of a policy to restrict the operation permissions of the RAM user. The following table describes the conditions that can be specified in a policy.

      Tag-based authentication condition	Description
      acs:RequestTag	Specifies that an API request must contain a tag. You can use the acs:RequestTag condition in an API request only if the API request contains tag-related parameters.
      acs:ResourceTag	Specifies that the resource specified in an API request must have a tag. You can use the acs:ResourceTag condition in an API request only if the API request contains resource ID-related parameters.

      Note

      When you configure a policy, you can use the acs:RequestTag or acs:ResourceTag condition based on whether the API request supports tags or requires resource IDs. For more information, see Authenticate a RAM user when the RAM user initiates an API request.

      You can configure the following policies to meet your business requirements for the preceding scenario:

      Requirement	Policy
      The RAM user can successfully create Elastic Container Instance resources only if the RAM user binds the env:test tag to the resources.	{ "Effect": "Allow", "Action": "eci:Create*", "Resource": "*", "Condition": { "StringEquals": { "acs:RequestTag/env": "test" } } }
      The RAM user can operate only the Elastic Container Instance resources that have the env:test tag.	{ "Effect": "Allow", "Action": "eci:*", "Resource": "*", "Condition": { "StringEquals": { "acs:ResourceTag/env": "test" } } }
      The RAM user can view only the Elastic Container Instance resources that have the env:test tag.	{ "Effect": "Allow", "Action": "eci:Describe*", "Resource": "*", "Condition": { "StringEquals": { "acs:RequestTag/env": "test" } } }

      The following example shows a complete policy that contains the permissions provided by AliyunECIFullAccess.

      {
       "Version": "1",
       "Statement": [{
         "Effect": "Allow",
         "Action": "eci:Create*",
         "Resource": "*",
         "Condition": {
          "StringEquals": {
           "acs:RequestTag/env": "test"
          }
         }
        },
        {
         "Effect": "Allow",
         "Action": "eci:*",
         "Resource": "*",
         "Condition": {
          "StringEquals": {
           "acs:ResourceTag/env": "test"
          }
         }
        },
        {
         "Effect": "Allow",
         "Action": "eci:Describe*",
         "Resource": "*",
         "Condition": {
          "StringEquals": {
           "acs:RequestTag/env": "test"
          }
         }
        },
        {
         "Action": [
          "ecs:DescribeSecurityGroups"
         ],
         "Resource": "*",
         "Effect": "Allow"
        },
        {
         "Action": [
          "vpc:DescribeVSwitches",
          "vpc:DescribeVpcs",
          "vpc:DescribeEipAddresses"
         ],
         "Resource": "*",
         "Effect": "Allow"
        },
        {
         "Action": "ram:CreateServiceLinkedRole",
         "Resource": "*",
         "Effect": "Allow",
         "Condition": {
          "StringEquals": {
           "ram:ServiceName": [
            "eci.aliyuncs.com",
            "vnode.eci.aliyuncs.com"
           ]
          }
         }
        }
       ]
      }

      Note

      If you want the RAM user to operate Elastic Container Instance resources by calling API operations, you can grant the RAM user the permissions provided by the AliyunECIFullAccess policy. If you want the RAM user to operate Elastic Container Instance resources by using the Elastic Container Instance console, you must grant the RAM user the permissions provided by the AliyunECIFullAccess policy and the permissions provided by other policies. For more information, see Grant permissions to RAM users.

   5. Enter a name for the policy and click OK.

5. Attach the custom policy to the RAM user.

   1. In the left-side navigation pane, choose Identities > Users.

   2. Create a RAM user.

      Create a RAM user based on your management requirements. For more information, see Create a RAM user. If you already created a RAM user, skip this step.

   3. Grant permissions to the RAM user.

      Attach the custom policy that you created to the RAM user. For more information, see Grant permissions to a RAM user.

Step 2: Check whether the policy is in effect

1. Log on to the OpenAPI Explorer console as a RAM user.

2. Check whether the policy is in effect.

   An elastic container instance is used in the following tests:

   • Create an elastic container instance

     • If you bind the env:test tag to an instance when you create the instance, the instance can be created.

     • If you do not bind the env:test tag to an instance or you bind another tag to the instance when you create the instance, the instance cannot be created. The system prompts that you do not have the permissions to create the instance.

   • Delete an elastic container instance

     • If the instance that you want to delete has the env:test tag, the instance can be deleted.

     • If the instance that you want to delete does not have the env:test tag, the instance cannot be deleted. The system prompts that you do not have the permissions to delete the instance.

   • Query an elastic container instance

     • If you specify an instance that has the env:test tag but you do not specify the tag in the request, the specified instance is queried.

     • If you specify an instance that does not have the env:test tag in the request, the query result is empty.

     • If you do not specify an instance but you specify the env:test tag in the request, all instances that have the env:test tag are queried.

     • If no instances and tags are specified, the query result is empty.