This topic describes how a Resource Access Management (RAM) user uses the RAM console and API to assume a RAM role whose trusted entity is an Alibaba Cloud account.

Prerequisites

The following prerequisites must be met:

  1. A RAM user is created. For more information, see Create a RAM user.
  2. An AccessKey pair is created or a logon password is set for the RAM user.
  3. The RAM user is granted the required permissions. For more information, see Grant permissions to a RAM user.
    • You can attach the AliyunSTSAssumeRoleAccess system policy to the RAM user. This allows the RAM user to assume all RAM roles.
    • You can attach a custom policy to the RAM user to specify the RAM role that the RAM user can assume. For more information, see FAQ about RAM roles and STS tokens.

Method 1: Use the RAM console

To assume a RAM role, a RAM user must log on to the RAM console and then switch the logon identity to the RAM role. The RAM user can either log on to the console by using a password or using role-based single sign-on (SSO).

  1. Log on to the RAM console as a RAM user.
  2. Move the pointer over the profile picture in the upper-right corner. Find and copy the value of the Current Alias field.
  3. Click Switch Role.
  4. On the Switch Role page, enter the alias that you copied earlier.
    Note On the Switch Role page, you can also enter the default domain name in the Enterprise Alias / Default Domain Name field. For more information about the default domain name, see Manage the default domain name.
  5. Specify the Role Name field.
  6. Click Switch.

    After the switch is complete, your logon identity changes to the RAM role and you have the permissions that are granted to the RAM role.

    You can view the logon identity and current identity when you move the pointer over the profile picture in the upper-right corner of the console. The following table describes the logon identity and current identity. The current identity is indicated by the My Identity field.

    Logon method Logon identity Current identity
    Password-based logon

    The format is <Username of the logon RAM user>.

    The format is <RoleName>/<RoleSessionName>.

    • RoleName: the name of the role that is assumed by the RAM user
    • RoleSessionName: the username of the RAM user
    Role-based SSO

    After you log on to the console as a RAM role, the current identity is displayed and the logon identity is not displayed.

    If you switch the identity to another RAM role, the logon identity is displayed in the format of <RoleName>/<RoleSessionName>.

    • RoleName: the name of the role that is used for SSO
    • RoleSessionName: the RoleSessionName attribute in the role-based SSO authentication response

    For example, the tom@example.local user of a trusted IdP logs on to the Alibaba Cloud Management Console as the RAM role test-saml-role1 and switches the identity to the RAM role alice-testrole. In this case, the logon identity is test-saml-role1/tom@example.local.

    The format is <RoleName>/<RoleSessionName>.

    • RoleName: the name of the role that is assumed
    • RoleSessionName: the RoleSessionName attribute in the role-based SSO authentication response

    For example, the tom@example.local user of a trusted IdP logs on to the console as the RAM role test-saml-role1 and switches the identity to the RAM role alice-testrole. In this case, the current identity is alice-testrole/tom@example.local. The value of RoleSessionName remains unchanged.

    The maximum duration of the logon session depends on the smaller value of the Maximum Session Duration and Logon Session Valid For parameters. For more information, see Set the maximum session duration for a RAM role and Set security policies for RAM users.

Method 2: Use the API

An authorized RAM user can use an AccessKey pair to call the AssumeRole operation. This way, the RAM user obtains an STS token. The RAM user can then use the STS token to access Alibaba Cloud resources.

Note If STS tokens that you obtain after assuming RAM roles are disclosed, you can disable all of the STS tokens. For more information, see FAQ about RAM roles and STS tokens.

References

For information about how to log on to the console by using role-based SSO, see Overview of role-based SSO.