Docs

Elastic Compute Service

Tags and projects

Managing projects

Overview

When you use ECS instances, each time you perform a creation operation, a corresponding resource may be created, such as instances, images, key pairs, volumes, snapshots, elastic network interfaces, and security groups. Project management is a resource management method provided by the platform. This method allows you to group and manage resources based on businesses or projects. With Identity and Access Management (IAM), you can grant permissions to users by project (i.e., a group of resources) to ensure resource isolation and data security. You can also view resource bills by project to facilitate the calculation of cloud resource costs.

For more information about projects, see Managing projects.

Considerations

ECS-related resources that can be managed by projects include: instances, volumes, custom images, key pairs, RIs, ESIs, launch templates, orchestration, and cloud assistant.

A resource can belong to only one project.

For a newly created resource, if you have not associated it with a project, it will be associated with the "default" project.

After you associate the resource with a project, only users with permissions on the project can use the resource.

Associations between resources do not change due to project assignments.

If you need to associate resources from multiple projects, you need to have permissions for all projects that contain resources to be associated. For example, if you want to associate an EIP from Project B to an instance in Project A, you are required to have permissions for both Project A and Project B. For authorization, refer to Managing permissions for projects.

When you create and manage resources using an IAM user, the IAM user must have corresponding permissions granted by the root account. For detailed operations to grant global permission or project-level permission for an IAM user, refer to Creating and authorizing users.

Project management process

The general process for project management is as follows (instances are used as an example here). If you need to associate projects with other newly created resources (such as images, key pairs, volumes, and RIs), select the target resource in the left-side navigation pane.

Create a project: Create a project to manage instances.

Add the project permission for an IAM user: Grant project permission for the IAM user.

Create an instance: Use the IAM user to create an instance and associate the instance with the project.

(Optional) Move the instance into/out of a project: When the project associated with the instance changes, you can move the instance into or out of the project.

tip

When you change the project an instance belongs to, resources associated with the instance are moved to the specified project along with the instance. Such resources include system and data volumes, primary network interfaces, and EIPs associated with the primary network interface.

We recommend that you avoid changing the project for an instance right after you associate sub-resources with the instance (such as data volumes or EIPs). Otherwise, the instance and its sub-resources may belong to different projects. You can wait a few seconds after the association is complete before changing the project.

We recommend that you avoid changing the project for an instance right after you disassociate sub-resources from the instance (such as data volumes or EIPs). Otherwise, the instance and its disassociated sub-resources may belong to the same project. You can wait a few seconds after the disassociation is complete before changing the project.

(Optional) View bill details by project: You can filter bills by projects.

View resource details of projects

View projects that resources belong to

On the Instances page, click the target instance to enter the instance Overview page. In the "Basic information" section, you can view associated project of the instance.

Search for resources by projects

In the top menu bar, select the region and choose the project based on the description below.

Select All Resources to view all resources under this account.

Select a specific project to view all resources associated with the project.

Select Manage projects to go to the project list and manage the projects.

tip

When you log in with the root account or an IAM user, the system defaults to displaying all resources under that account.

If the IAM user is not granted permissions, after you select "All Resources", the system does not display all resources under the account. Follow the interface instructions to switch to another project or contact the root account to obtain the required permissions.