How does ECS grant certain access rights to instances - RAM role

The content of this article is about how ECS gives certain access rights to instances. It has certain reference value. Friends in need can refer to it. I hope it will be helpful to you.

What is an instance RAM role

The ECS instance RAM (Resource Access Management) role (hereinafter referred to as the instance RAM role) is a type of RAM role, which allows the ECS instance to act as an instance with certain permissions. Role, thereby granting certain access rights to the instance.

The instance RAM role allows you to associate a role to an ECS instance and access the APIs of other cloud products based on STS (Security Token Service) temporary credentials inside the instance (the temporary credentials will be updated periodically). In this way, on the one hand, the security of AccessKey can be ensured, and on the other hand, RAM can be used to achieve refined control and management of permissions.

Design background

Generally, the application of ECS instance accesses Alibaba Cloud through the user account or the user's AccessKey (AccessKeyId AccessKeySecret) API for each product.

In order to meet the calling requirements, the AccessKey needs to be solidified directly in the instance, such as written in the configuration file. However, this method has problems such as excessive permissions, information leakage, and difficulty in maintenance. Therefore, we designed the instance RAM role to address these issues.

Functional advantages

Using the instance RAM role, you can:

With the instance RAM role, you can combine the role and the ECS instance Relate.

Securely use STS temporary credentials in ECS instances to access other Alibaba Cloud cloud services, such as OSS, ECS, RDS, etc.

Assign roles with different authorization policies to different instances so that they have different access rights to different cloud resources to achieve more fine-grained permission control.

There is no need to save the AccessKey in the instance. You can change the permissions by modifying the authorization of the role, and quickly maintain the access permissions owned by the ECS instance.

Fees Details

Cloud Server ECS does not charge additional fees for instance RAM roles.

Usage restrictions

There are the following restrictions on using the instance RAM role:

Only dedicated network (VPC) network type Only instances can use instance roles.

An ECS instance can only be granted the RAM role to one instance at a time.

Using the instance RAM role

There are currently two ways to use the RAM role:

Using the instance RAM through the console Role

Use instance RAM role

via API

The above is the detailed content of How does ECS grant certain access rights to instances - RAM role. For more information, please follow other related articles on the PHP Chinese website!