Cloud Enterprise Network:Grant a CCN instance permissions on PrivateZone

Scenario 1: All instances belong to the same Alibaba Cloud account

1. Log on to the CEN console.

2. On the Instances page, click the ID of the CEN instance that you want to manage.

3. On the Basic Settings > Transit Router tab, click the ID of the transit router in the region of the VPC that is associated with PrivateZone.

4. On the details page of the transit router, click the PrivateZone tab and click Authorize Now. On the Cloud Resource Access Authorization page, click Conform Authorization Policy.

   

   Note

   You must grant permissions to Smart Access Gateway (SAG) only if this is the first time that you configure access to PrivateZone. After you grant permissions to SAG, the CCN instance (a component of SAG) that is attached to the CEN instance can access PrivateZone.

   After you grant the permissions, the system automatically creates the AliyunSmartAGAccessingPVTZRole Resource Access Management (RAM) role for the current Alibaba Cloud account. To search and view the details about RAM roles, you can log on to the RAM console and go to the Identities > Roles page.

Scenario 2: The CCN instance belongs to another Alibaba Cloud account

1. Use the Alibaba Cloud account of the VPC to authorize the CCN instance to access PrivateZone.

   1. Log on to the CEN console CEN console with the Alibaba Cloud account to which the VPC belongs.

   2. On the Instances page, click the ID of the CEN instance that you want to manage.

   3. On the Basic Settings > Transit Router tab, click the ID of the transit router in the region of the VPC in which the PrivateZone service is deployed.

   4. On the details page of the transit router, click the PrivateZone tab and click Authorize Now. On the Cloud Resource Access Authorization page, click Conform Authorization Policy.

      Note

      You must grant permissions to Smart Access Gateway (SAG) only if this is the first time that you configure access to PrivateZone. After you grant permissions to SAG, the CCN instance (a component of SAG) that is attached to the CEN instance can access PrivateZone.

2. Modify the trust policy AliyunSmartAGAccessingPVTZRole to allow the CCN instance which belongs to another Alibaba Cloud account to access PrivateZone.

   1. Log on to the RAM console with the Alibaba Cloud account to which the VPC belongs.

   2. In the left-side navigation pane, choose Identities > Roles.

   3. On the Roles page, enter AliyunSmartAGAccessingPVTZRole in the search box to search the RAM role and click the role name.

   4. On the details page of the RAM role, click the Trust Policy tab, and click Edit Trust Policy.

   5. Add the following record to the Service parameter: "The ID of the Alibaba Cloud account to which the CCN instance belongs@smartag.aliyuncs.com", and click Save trust policy document.

      

Scenario 3: The transit router belongs to another Alibaba Cloud account

1. Log on to the RAM console with the Alibaba Cloud account to which the VPC belongs.

2. In the left-side navigation pane, choose Identities > Roles.

3. On the Roles page, click Create Role.

4. In the Create Role panel, set the following parameters.

   1. In the Select Role Type step, select Alibaba Cloud Service and click Next.

   2. In the Configure Role step, set the following parameters and click OK.

      

      • Role Type: Select Normal Service Role.

      • RAM Role Name: Enter AliyunSmartAGAccessingPVTZRole.

      • Select Trusted Service: Select Smart Access Gateway.

      For more information, see Create a RAM role for a trusted Alibaba Cloud service.

   3. In the Create Role panel, click Close to return to the Roles page.

5. On the Roles page, enter AliyunSmartAGAccessingPVTZRole in the search box to search for the role, and click the role name.

6. On the Permissions tab, click Grant Permission. The Grant Permission panel appears.

7. Enter the keyword pvtz in the search box below System Policy to search for the policy AliyunPvtzReadOnlyAccess. Then, click the policy name, add the read-only permission on PrivateZone, and then click OK.

   

8. In the Grant Permission panel, click OK to return to the details page of the RAM role.

9. On the details page, click the Trust Policy tab to view authorization information.

   

Scenario 4: All instances belong to different Alibaba Cloud accounts

1. Refer to Scenario 3 and create a role for the Alibaba Cloud account to which the VPC belongs, and then attach the policy to the role.

2. Refer to Scenario 2 to grant the CCN instance permissions on PrivateZone.

What to do next

Manage access to PrivateZone