Docs

Elastic Compute Service

IAM

Cross-service authorization

Before using an ECS instance, you need to complete cross-service access authorization first to enable your instance to access other services (such as VPC and TOS). This topic describes the steps for cross-service access authorization.

Background

VolcanoEngine IAM supports policy management. You can authorize ECS instances to access other services by attaching the ServiceRoleForECS role to your ECS service account and then attaching the ServicePolicyForECS policy to that role. The definition of the ServicePolicyForECS policy is as follows:

{​
  "Statement": [​
    {​
      "Effect": "Allow",​
      "Action": [​
        "tos:GetObject",​
        "tos:HeadObject",​
        "tos:PutObject",​
        "tos:HeadBucket",​
        "tos:CreateMultipartUpload",​
        "tos:CompleteMultipartUpload",​
        "vpc:DescribeNetworkInterfaces",​
        "vpc:DescribeNetworkInterfaceAttributes",​
        "vpc:DeleteNetworkInterface",​
        "vpc:DescribeVpcAttributes",​
        "vpc:DescribeSubnetAttributes",​
        "vpc:DescribeSecurityGroupAttributes",​
        "vpc:DescribeEipAddresses",​
        "vpc:AllocateEipAddress",​
        "vpc:AssociateEipAddress",​
        "vpc:ModifyEipAddressAttributes",​
        "vpc:DisassociateEipAddress",​
        "vpc:ReleaseEipAddress",​
        "vpc:DescribeVpcs",​
        "vpc:CreateVpc",​
        "vpc:DescribeSubnets",​
        "vpc:CreateSubnet",​
        "vpc:ModifyNetworkInterfaceAttributes",​
        "vpc:CreateSecurityGroup",​
        "vpc:DescribeSecurityGroups",​
        "vpc:AuthorizeSecurityGroupEgress",​
        "vpc:DescribeEipAddressAttributes"​
      ],​
      "Resource": [​
        "*"​
      ]​
    },​
    {​
      "Effect": "Allow",​
      "Action": [​
        "Volc_InfluxDB_Proxy:Write",​
        "cloudmonitor:Write"​
      ],​
      "Resource": [​
        "*"​
      ]​
    }​
  ]​
}​

tip

For more information about IAM roles and policies, see Role management and Policy management.

Usage notes

If you need to perform cross-service authorization using an IAM user, the user must have IAMFullAccess permission. Otherwise, errors will occur during authorization. For steps to grant permissions to an IAM user, see User management.

Authorization methods

tip

After authorization, you can log in to the IAM console. If the ServiceRoleForECS role exists in the role list, the authorization succeeds.

If you have authorized previously, you do not need to authorize again.

Authorize via the console

On the "Cross-service access request" page that appears, confirm the access role and associated policy information, then click the "Authorize now" button to complete authorization.

Authorize via an authorization link

Click the ServiceRoleForECS link, and then click the "Authorize now" button to complete authorization.

Authorize via API

You can call the IAM CreateServiceLinkedRole API to complete cross-service authorization. During authorization, specify ServiceName as ecs.

Last updated: 2026.06.18 17:48:27