Docs

Elastic Compute Service

O&M

Configuring permissions for using custom commands

This topic describes how to grant limited permissions to IAM users for using custom commands via the IAM (Identity and Access Management) feature.

Applicable scenario

Custom commands created via cloud assistant may include operations that require high permissions, such as formatting disks, deleting files, and modifying system parameters. With IAM custom policies, you can restrict IAM user access to specified custom commands and control the scope of command execution.

Operation processes

Step 1: Create a custom policy

Select the custom policy tab to enter the custom policy list page.

Click the "Create custom policy" button and configure the parameters described in the following table.

This practice only describes how to configure permissions for using custom commands. For detailed custom policies, see Policy overview.

Parameter	Description	Sample value
Policy name	Specify the name of the new policy.	DeleteVirtio
Edit policy content	Configure the policy based on the following rules: Effect: Must be set to Allow. "Allow" indicates that operations on the custom commands specified in this policy are permitted. Action: Specify the actions to be performed on custom commands. ecs:InvokeCommand is required. tip Since policies can not restrict IAM users from calling the RunCommand interface to execute custom commands, do not add this interface. Resource: Specify the custom commands for which permission usage needs to be restricted. The format is trn:ecs:[command region]:[root user ID]:command/[custom command ID]. Complete example: The following policy grants permissions to query, modify, and use the custom commands cmd-ycn5dc9qf9l8j0v*** and cmd-tsx0gy9rslp90k3z*** via cloud assistant in China (Beijing). { "Statement": [ { "Effect": "Allow", "Action": [ "ecs:Describe", "ecs:ModifyCommand", "ecs:InvokeCommand" ], "Resource": [ "trn:ecs:cn-beijing:210001**:command/cmd-ycn5dc9qf9l8j0v*", "trn:ecs:cn-beijing:210001*:command/cmd-tsx0gy9rslp90k3z***" ] } ] }	-

Click the "Create policy" button to complete creation.

After the policy is created, if an IAM user without permission tries to use the custom commands covered by the policy, the message "The specified resource is not allowed to operate." is prompted on the job creation page.

Step 2: Grant permission for an IAM user

Select the custom policy tab to enter the custom policy list page.

On the custom policy tab, find the policy you created, and click the "Manage" button in the "Action" column to the right of the target policy.

On the policy details page, select the "Authorization" tab and then choose "Global Authorization".

Click the "Add Authorization" button, select "User", and select the IAM user who can execute the policy-specified custom commands.

Click the "Confirm" button to add permission.

After the permission is added, the IAM user can use the corresponding custom command via cloud assistant. For operation details, see Creating jobs.

Last updated: 2026.06.18 17:49:51