Elastic Compute Service
Elastic Compute Service
Elastic Compute Service
Document
Elastic Compute Service
What's New
Announcement
OpenAPI related
Pricing and quotas are related
About products and plugins
Feature discontinuation
Overview
Billing
Billable items
Billing methods
Billing methods change
Getting Started
User Guide
Instances
Instance types
X86 Computing
Elastic Bare Metal Server
Heterogeneous Computing
Select instance billing method
Spot instance
Elastic Scheduled Instance
Offsetting Resources
Reserved Instances
Buying ECS instances
Logging in to an instance
Logging in to a Linux instance
Managing instance status
Modifying instance types
Using instance user data and metadata
Instance metadata
Images
Public images
veLinux images
Custom images
Importing custom images
Creating custom images
Image detection
End of life (EOL) of image
Elastic Block Storage
Basic volume operations
Partitioning and formatting a volume
Extending a volume
EBS Agent
Snapshots
Basic snapshot operations
Auto snapshot policies
DataInsights
Network
Network interface and IP address
IP Address
IPv4 address
Security group
Security
Passwords and key pairs
Deployment and scaling
Monitoring
Monitoring metrics
Event monitoring
Local volume event O&M
Method 1: Solve the local volume failure by replacing the faulty volume
O&M
Cloud assistant
Managing agents
Process choreography
Common operation and maintenance tasks
Batch operations on instances
Batch operations on EBS Volumes
Batch operations on images
Temporary upgrade of bandwidth
Managing application updates
orchestration plan
Patch management
Managing patch plans
Managing patch baselines
IAM
Tags and projects
Best Practices
AI applications
OpenClaw (formerly Moltbot)
Quickly deploying OpenClaw via application templates
Quickly deploying OpenClaw via marketplace images
Manually deploying OpenClaw
Self-service website creation
Building environments
Building a Web environment (Windows)
Building applications
Building FTP site
Deploying databases
Building game servers
Building websites
Building a WordPress blog
Building multiple websites
Manage software sources for Linux instances
AIGC practices
Performance test
Network performance test
Instance configuration
Setting up AD Domain Services on Windows OS
Windows Multi - User Login
Changing screen resolution
Instance data
Uploading or downloading files
Data restoration
ECS instance local time synchronization
Volume
Monitoring
Security
Images
Kernel fine-tuning
O&M
Troubleshooting
Remote log in issue
Linux operating system issue
Windows operating system issue
SSH log in issue
Operating system issue
veLinux operating system issue
Linux operating system issue
Windows operating system issue
Instance status issue
Instance unable to start issue
High instance load issue
GPU instances issue
Network connection issue
Network configuration issue
Storage classes issue
EBS Volume issue
Local Disk issue
Logs and monitoring issue
Third - party software issue
API Reference
Regions and availability zones
Instances
Images
HPC clusters
Key pairs
Tags
Volumes
Reserved storage capacity
Snapshot
Auto snapshot policy
Monitoring
Deployment sets
Launch templates
Cloud assistant
Patch management
SDK reference
CLI Reference
FAQ
Dedicated Host DDH
What's New
Billing
User Guide
Manage Dedicated Host
Manage Dedicated Host Cluster
Manage ECS instances
Monitoring and O&M
API reference
proprietary host
- Documentation
Elastic Compute ServiceElastic Compute ServiceUser GuideIAMECS custom policy examples
Copy page
Download PDFIAM
ECS custom policy examples
Copy pageDownload PDFECS custom policy examples
If the system default policies provided by the platform cannot meet your needs, you can create custom policies based on the principle of least privilege. This enables fine-grained permission control and enhances secure access by IAM identities to resources under the root account. This topic shows examples of common custom policies related to ECS instances as a reference.
Background
- For specific steps to create a custom policy, refer to Creating custom policies.
- When creating a custom policy, you need to follow the basic structure and syntax. For details of policy element configuration, refer to Policy syntax.
- The general custom policy example article provides a variety of common custom policy syntax examples for your reference.
- In the following examples, the API operation names listed under Action can be obtained from the API list.
- For the TRN format of ECS-authorized resources, refer to Resources.
Custom policy examples
Allow access to resources under specified projects
{
"Statement": [
{
"Effect": "Allow",
"Action": [
"ecs:DescribeInstances"
],
"Resource": [
"trn:ecs:*:210005****:instance/*",
"trn:iam::210005****:project/default"
]
}
]
}
This policy allows viewing instances belonging to the "default" project under Account 210005****. When you grant authorizations by project, you need to select a project scope in addition to the existing authorization policy, thereby restricting permissions to the specified project.
Deny ECS instance deletion
tip
Deny takes precedence over Allow. If an identity has Deny permissions for certain actions, the Allow permissions for those same actions will not take effect. To resolve this, remove the relevant Deny statements or modify them to Allow.
Deny all instance deletion
{
"Statement": [
{
"Effect": "Deny",
"Action": [
"ecs:DeleteInstance",
"ecs:DeleteInstances"
],
"Resource": [
"*"
]
}
]
}
Deny ECS resource deletion for instances with IDs i-yczzpbpgqoqc6ilc**** and i-yczv4tg64gqc6iks**** under account 200000000X
{
"Statement": [
{
"Effect": "Deny",
"Action": [
"ecs:Delete*"
],
"Resource": [
"trn:ecs:*:200000000X:instance/i-yczzpbpgqoqc6ilc****,i-yczv4tg64gqc6iks****"
]
}
]
}
Allow ECS instance creation
{
"Statement": [
{
"Effect": "Allow",
"Action": [
"ecs:RunInstances"
],
"Resource": [
"*"
]
}
]
}
Deny ECS instance information change
{
"Statement": [
{
"Effect": "Deny",
"Action": [
"ecs:ModifyInstanceAttribute"
],
"Resource": [
"*"
]
}
]
}
Restrict ECS instance access
Allow actions on the ECS instance with the ID i-yczzpbpgqoqc6ilc**** under account 200000000X
{
"Statement": [
{
"Effect": "Allow",
"Action": [
"ecs:*"
],
"Resource": [
"trn:ecs:*:200000000X:instance/i-yczzpbpgqoqc6ilc****"
]
}
]
}
Allow ECS resource viewing
{
"Statement": [
{
"Effect": "Allow",
"Action": [
"ecs:Describe*"
],
"Resource": [
"*"
]
}
]
}
Access ECS from a specific IP address
{
"Statement": [
{
"Effect": "Allow",
"Action": [
"ecs:*"
],
"Resource": [
"*"
],
"Condition": {
"IpAddress": {
"volc:SourceIp": [
"210.22.XX.XX"
]
}
}
}
]
}
Only ECS resources with the tag key "ecs" and a condition value of "use" can be accessed
{
"Statement": [
{
"Effect": "Allow",
"Action": [
"ecs:*"
],
"Resource": [
"*"
],
"Condition": {
"StringEquals": {
"volc:ResourceTag/ecs": [
"use"
]
}
}
}
]
}
Allow access to tag feature
{
"Statement": [
{
"Effect": "Allow",
"Action": [
"ecs:CreateTags",
"ecs:DeleteTags",
"ecs:DescribeTags"
],
"Resource": [
"*"
]
}
]
}
Deny key pair deletion
{
"Statement": [
{
"Effect": "Deny",
"Action": [
"ecs:DeleteKeyPairs"
],
"Resource": [
"*"
]
}
]
}
Only allow O&M orchestration tasks to apply for, query, and associate Elastic IPs (EIPs)
{
"Statement":[
{
"Effect":"Allow",
"Action":[
"vpc:AllocateEipAddress",
"vpc:DescribeEipAddresses",
"vpc:AssociateEipAddress"
],
"Resource":["*"]
}
]
}
Restrict the use of target custom commands to the specified IAM users
{
"Statement": [
{
"Effect": "Allow",
"Action": [
"ecs:Describe*",
"ecs:ModifyCommand",
"ecs:InvokeCommand"
],
"Resource": [
"trn:ecs:cn-beijing:210001*****:command/cmd-ycn5dc9qf9l8j0v*****",
"trn:ecs:cn-beijing:210001*****:command/cmd-tsx0gy9rslp90k3z*****"
]
}
]
}
Last updated: 2026.10.29 14:11:45
All rights reserved © Beijing Volcano Engine Technology Co., Ltd2024
