Configure a RAM policy for custom domains - Container Registry

To allow Container Registry (ACR) to access and manage SSL certificates for a custom domain name, you must create a RAM role and grant it the necessary permissions.

Step 1: Create a RAM role

To use a custom domain name with Container Registry (ACR), you must create a RAM role named AliyunContainerRegistryCustomizedDomainRole for your Alibaba Cloud account.

Log on to the RAM console as a RAM administrator.
In the left-side navigation pane, choose Identities > Roles.
On the Roles page, click Create Role.
On the Create Role page, set Principal Type to Cloud Account. Configure the trusted account and click OK.

For Principal Name, choose one of the following:
- Current Account: Allows all RAM users and roles within the current account to assume this role.
- Other Account: Allows RAM users and roles from a different Alibaba Cloud account to assume this role. Enter the ID of the trusted account. You can find an account ID on the Security Settings page. For more information about cross-account access, see Access resources across Alibaba Cloud accounts.
For Role Name, enter AliyunContainerRegistryCustomizedDomainRole, add a description, select Current Alibaba Cloud Account as the trusted cloud account, and then click Confirm.
Note
If you select Other Alibaba Cloud Account, you must enter the ID of the other cloud account.

Step 2: Configure the RAM role policy

Attach a policy to the RAM role to grant it permission to read SSL certificates.

Log on to the RAM console as a RAM administrator.
In the left-side navigation pane, choose Identities > Roles.
On the Role page, find AliyunContainerRegistryCustomizedDomainRole and click Authorize in the Actions column.
In the Authorize panel, set Resource Scope to Account. In the Policies search box, search for and select AliyunYundunCertReadOnlyAccess.
Note
On the right, you can remove a selected policy by clicking × next to the policy name.
Click OK.
Click Close.

Step 3: Configure the trust policy

Add Container Registry (ACR) to the RAM role's trust policy to allow ACR to access Alibaba Cloud SSL certificates.

Log on to the RAM console as a RAM administrator.
In the left-side navigation pane, choose Identities > Roles.
On the Role page, click AliyunContainerRegistryCustomizedDomainRole in the Role Name column.
On the Trust Policy tab, click Edit Trust Policy.

Copy the following policy into the text box and then click Confirm.

{
    "Statement": [
        {
            "Action": "sts:AssumeRole",
            "Effect": "Allow",
            "Principal": {
                "Service": [
                    "cr.aliyuncs.com"
                ]
            }
        }
    ],
    "Version": "1"
}