Elastic Compute Service:Connect to an instance through Workbench

What is Workbench?

Workbench introduction

Workbench is a web-based remote connection tool provided by Alibaba Cloud. It allows you to connect to ECS instances directly from a browser without any installation. The following figure illustrates the process of connecting to an ECS instance using Workbench.

Basic usage process of Workbench

The diagram below describes the steps for using Workbench to connect to an instance:

1. Find the Instance to Connect.

2. Establish Network Connectivity Between Workbench and the ECS Instance.

   This involves configuring security group and firewall rules to allow inbound traffic from Workbench to the instance.

3. Use Workbench to Connect to the Instance.

   In the console, select the instance and connect through Workbench using the necessary credentials, such as username and password or a key pair.

4. Create the Service-Linked Role.

   If the service-linked role is not already created, Workbench will prompt you to authorize its creation to access the ECS instance.

5. Successfully Connect to the Instance and Perform Operations and Maintenance (O&M).

Service-linked role of Workbench

Workbench requires permissions to manage your ECS instances. When you first connect to an instance using Workbench, you'll be prompted to create a service-linked role named AliyunServiceRoleForECSWorkbench, which grants Workbench the necessary access to your ECS instance. For more information about service-linked roles, see Service-linked roles.

The following dialog box appears when you first connect to an instance. Click OK, and the system will automatically create the service-linked role.

If you are a RAM user, you must contact the primary account or administrator to grant you the AliyunECSWorkbenchFullAccess system policy. Only users with this permission can create the service-linked role for Workbench.

Permission settings for RAM users using Workbench

After creating the service-linked role, RAM users must assign the following policy to utilize Workbench. This policy grants users the ability to connect to all ECS instances via Workbench.

{
  "Version": "1",
  "Statement": [
    {
      "Action": "ecs-workbench:LoginInstance",
      "Resource": "*",
      "Effect": "Allow"
    }
  ]
}

To restrict the instances that users can connect to through Workbench, modify the Resource field as follows:

{
  "Version": "1",
  "Statement": [
    {
      "Action": "ecs-workbench:LoginInstance",
      "Resource": [
        "acs:ecs-workbench:{#regionId}:{#accountId}:instance/{#instanceId}",
        "acs:ecs-workbench:{#regionId}:{#accountId}:instance/{#instanceId}"
      ],
      "Effect": "Allow"
    }
  ]
}

The parameters are described as follows:

• {#regionId}: The region ID where the instance is located. It can be set to the wildcard character *.

• {#accountId}: The primary account ID. It can be set to the wildcard character *.

• {#instanceId}: The destination instance ID. It can be set to the wildcard character *.

{
  "Version": "1",
  "Statement": [
    {
      "Action": "ecs-workbench:LoginInstance",
      "Resource": [
        "acs:ecs-workbench:*:*:instance/i-001",
        "acs:ecs-workbench:*:*:instance/i-002"
      ],
      "Effect": "Allow"
    }
  ]
}

Security group settings related to Workbench

To establish a connection to instances via SSH or RDP using Workbench, you must set up the instance's security group to permit inbound traffic from the Workbench server. Consult the table below to identify the correct security group rules based on your network type. For more information, see how to add a security group rule.