Configure a RAM policy for custom domains - Container Registry

To allow Container Registry (ACR) to access and manage SSL certificates for a custom domain name, you must create a RAM role and grant it the necessary permissions.

Step 1: Create a RAM role

To use a custom domain name with Container Registry (ACR), you must create a RAM role named AliyunContainerRegistryCustomizedDomainRole for your Alibaba Cloud account.

Log on to the RAM console as a RAM administrator.
In the left-side navigation pane, choose Identities > Roles.
On the Roles page, click Create Role.
On the Create Role page, set Principal Type to Cloud Account, specify the details of the Alibaba Cloud account, and then click OK.
- Current Account: Select this option to allow all RAM users and RAM roles under the current Alibaba Cloud account to assume the role. SelectCurrent Account.
- Other Account: Select this option to allow all RAM users and RAM roles from another Alibaba Cloud account to assume the role. SelectOther Account and then enter the ID of the other Alibaba Cloud account (main account). This is primarily used for cross-account resource access. For more information, see Access resources across Alibaba Cloud accounts.You can find your Alibaba Cloud account (main account) ID on the Security Settings page.
For Role Name, enter AliyunContainerRegistryCustomizedDomainRole, add a description, select Current Alibaba Cloud Account as the trusted cloud account, and then click Confirm.
Note
If you select Other Alibaba Cloud Account, you must enter the ID of the other cloud account.

Step 2: Configure the RAM role policy

Attach a policy to the RAM role to grant it permission to read SSL certificates.

Log on to the RAM console as a RAM administrator.
In the left-side navigation pane, choose Identities > Roles.
On the Role page, find AliyunContainerRegistryCustomizedDomainRole and click Authorize in the Actions column.
In the Authorize panel, set Resource Scope to Account. In the Policies search box, search for and select AliyunYundunCertReadOnlyAccess.
Note
On the right, you can remove a selected policy by clicking × next to the policy name.
Click OK.
Click close.

Step 3: Configure the trust policy

Add Container Registry (ACR) to the RAM role's trust policy to allow ACR to access Alibaba Cloud SSL certificates.

Log on to the RAM console as a RAM administrator.
In the left-side navigation pane, choose Identities > Roles.
On the Role page, click AliyunContainerRegistryCustomizedDomainRole in the Role Name column.
On the Trust Policy tab, click Edit Trust Policy.

Copy the following policy into the text box and then click Confirm.

{
    "Statement": [
        {
            "Action": "sts:AssumeRole",
            "Effect": "Allow",
            "Principal": {
                "Service": [
                    "cr.aliyuncs.com"
                ]
            }
        }
    ],
    "Version": "1"
}