Example for Cross-account Access - Developer Guide| Alibaba Cloud Documentation Center

Premise

Assume that the user xiaoming@aliyun.com has created an Server Load Balancer instance whose LoadBalancerId is 139a00604ad-cn-east-hangzhou-01；

Objective

Now, xiaoming@aliyun.com wants to authorize beibei@aliyun.com to manage the instance.

beibei@aliyun.com is only allowed to perform such four operations as SetLoadBalancerStatus (configuring the LoadBalancer status), DescribeLoadBalancerAttribute (querying the LoadBalancer information), AddBackendServers (adding the backend server) and RemoveBackendServers (deleting the backend server) on the instance via Server Load Balancer API.

Authorization steps

To authorize the preceding operations, XiaoMing needs to execute the following steps:

Add Beibei into the user space of Xiaoming in RAM.

Call the AddUser interface of RAM in Xiaoming’s identity.

Parameter UserName=ALIYUN$beibei@aliyun.com;
```
     https://ram.aliyuncs.com/?Action=AddUser
     &UserName=ALIYUN$beibei@aliyun.com
     &<other common request parameter>
```

Prepare the authorization Policy.

Policy is a JSON string containing the following elements:

     {
     "Version": "1",
     "Statement":[
     {
         "Effect": "Allow",
         "Action": ["slb:SetLoadBalancerStatus","slb:DescribeLoadBalancerAttribute", "slb: AddBackendServers","slb:RemoveBackendServers"],
             "Resource": ["acs:slb:*:LoadBalancerId/139a00604ad-cn-east-hangzhou-01"]
     }]
     }

Xiaoming calls the PutPolicy interface of RAM and sets the Policy for Beibei;

web_front_server_policy, the value of the parameter PolicyName, is the name given to the policy by Xiaoming.

  https://ram.aliyuncs.com/?Action=PutUserPolicy
  &UserName=ALIYUN$beibei@aliyun.com
  &PolicyName=web_slb_policy
  &PolicyDocument=$the policy prepared in Step 2
  &<other common request parameter>

By this time, Beibei initiates the Server Load Balancer API call to operate the Server Load Balancer instance, for example, SetLoadBalancerStatus (configuring the LoadBalancer status).

To execute this call, use the parameter ResourceOwnerAccount to indicate that this API is called to operate Xiaoming’s resources.
```
  https://slb.aliyuncs.com/?Action=SetLoadBalancerStatus
  &LoadBalancerId=139a00604ad-cn-east-hangzhou-01
  &ResourceOwnerAccount=xiaoming@aliyun.com
  &<other common request parameter>
```

Revoke authorization

To revoke Beibei’s authority, Xiaoming needs to call DeleteUserPolicy of RAM to delete the policy.

      https://ram.aliyuncs.com/?Action=DeleteUserPolicy
      &UserName=ALIYUN$beibei@aliyun.com
      &PolicyName=web_slb_policy
      &<other common request parameter>

Now, to call Server Load Balancer API to access this Server Load Balancer instance again, Beibei will be denied and receive the following response:

      {
      "RequestId": "7463B73D-35CC-4D19-A010-6B8D65D242EF",
      "HostId": "slb.aliyuncs.com",
      "Code": " Forbidden",
      "Message": " User not authorized to operate on the specified resource."
      }