Docs

Elastic Compute Service

O&M

Performing orchestration with the least permissions

To access resources specified by an orchestration task, the orchestration feature first needs to assume a role in your account that is granted with read and write permissions on ECS resources. This topic mainly describes how to restrict role permissions through the custom policies stated in the Policy management to ensure the security of cloud resources.

Procedure

In the top menu bar, select the region where your business is located.

In the left-side navigation pane, select "Maintenance & Monitoring > Orchestration" to go to the orchestration list page.

Click the "Orchestrate tasks" tab.

Click the "Create orchestration task" button.

Enter task information except for the "Role" field, based on the guide for creating an O&M orchestration task.

Click the "View permissions required for the task" button, and then, on the permissions page, click the button. Copy the permission policy required to execute the configuration in "Step 6".

warning

Proceed to this step only after the above steps are completed. If subsequent task steps are adjusted, recopy the permissions required for the task and update the policy permissions by following the guide for editing custom policies.

Click the "Navigate to role management" button to enter the Role Management page.

In the left-side directory, select "Permission policies".

Click the "Create custom policy" button, enter the following content on the new policy page, and then click the "Create Policy" button to complete the creation.

Parameter
Description
Sample value
Strategy name
Enter the policy name.
VOS_1_Access
Edit policy content
Replace the policy with the content copied in "Step 7".
-

In the left-side directory, select "Role management" to go to the role list page. Create a role based on the guide for permission management.

warning

When you grant permissions, search for and add the custom policy created in "Step 10".

Return to the Create orchestration task page, and then select the role created in "Step 11" in "Role".

Click the "Confirm" button to complete the operation. The system then executes the O&M orchestration task based on the principle of least permissions.

You can view the execution details of the O&M orchestration task afterward, based on the guide for viewing task details.

Last updated: 2026.06.29 14:20:35

Parameter	Description	Sample value
Strategy name	Enter the policy name.	VOS_1_Access
Edit policy content	Replace the policy with the content copied in "Step 7".	-