Agent Sandbox:Authorize RAM users to access the console

Prerequisites

• Agent Sandbox is activated for the Alibaba Cloud account.

• The target RAM user is created. For more information, see Quick start: Create a RAM user and grant permissions.

• The operator is an Alibaba Cloud account (root account) or a RAM identity. The RAM identity must have the permissions to manage RAM user logon settings, create permission policies, and grant permissions to RAM users.

Step 1: Enable console logon

Skip this step if console logon is already enabled for the user. For more information, see Manage RAM user logon settings.

1. Log on to the RAM console, and choose Identities > Users, and click the name of the target RAM user.

2. On the Authentication tab, in the Login Profile section, click Enable Console Logon.

3. Turn on Console Access, set a logon password, configure password reset at first logon and multi-factor authentication (MFA) if your enterprise requires them, and then click OK.

Step 2: Create a permission policy

Select a policy based on the scope of the user's work, and retain only the permissions that are required:

Action specifies the operations that are allowed; Resource specifies the resources on which operations can be performed; Condition specifies the conditions under which the policy takes effect, such as a region or a resource group.

In the following examples, <region> is the region in which the resource resides. <account-id> is the unique identifier (UID) of the Alibaba Cloud account to which the resource belongs. <team-id> is the ID of the target Team. Replace the placeholders with actual values before you use the policy.

Manage all Agent Sandbox resources

This policy applies to platform administrators who are responsible for all Agent Sandbox resources in the account. The following policy grants permissions on all Agent Sandbox operations in all regions of the account:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sandbox:*",
      "Resource": "*"
    }
  ]
}

To limit the region, change Resource to acs:sandbox:<region>:<account-id>:*. This policy grants only Agent Sandbox permissions. Access to other cloud services requires separate authorization.

Manage a specified Team

This policy applies to personnel who manage a specific project or environment. The following policy allows operations on the specified Team and the resources under it:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sandbox:*",
      "Resource": [
        "acs:sandbox:<region>:<account-id>:teams/<team-id>",
        "acs:sandbox:<region>:<account-id>:teams/<team-id>/*"
      ]
    }
  ]
}

The first Alibaba Cloud Resource Name (ARN) matches the Team itself, and the second matches the sub-resources under the Team. This policy includes permissions to modify and delete the specified Team, but does not grant permissions to create other Teams.

Querying the Team list and account information in the console requires additional query permissions, which the preceding Team-specific policy does not include. See the RAM Action list at the end of this topic to grant the required query permissions. If you grant Team list queries by resource group, the user can view the Teams in that resource group. You must still grant permissions on other Teams separately.

Grant fine-grained permissions by operation

Based on the operations that the user needs to perform, select the required permissions from the RAM Action list at the end of this topic. Limit the scope of operations by using resource ARNs. Action and Resource must match at the same time. An API name may differ from the RAM Action. Use the Action values in the list as the reference.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sandbox:GetTeam",
      "Resource": "acs:sandbox:<region>:<account-id>:teams/<team-id>",
      "Condition": {
        "StringEquals": {
          "acs:ResourceGroupId": "<resource-group-id>"
        }
      }
    }
  ]
}

Save the policy in the RAM console

1. In the RAM console, choose Permissions > Policies, and click Create Policy.

2. Click the JSON Editor tab, enter the adjusted JSON policy, and then click OK.

3. In the Create Policy panel, enter a policy name (for example, SandboxTeamAccess) and a description, and then click OK.

For more information, see Create a custom policy.

Step 3: Grant permissions to the RAM user

1. In the RAM console, choose Identities > Users.

2. Find the target RAM user, and click Grant Permission in the Actions column.

3. Set Resource scope to Account level, and confirm that the principal is the target RAM user.

4. In the permission policy list, select Custom Policy, search for the policy created in the previous step, and then select it.

5. Click OK to complete the authorization.

Although you select Account level here, the permissions granted by each policy are still limited by its Resource and Condition. For more information, see Manage RAM user permissions.

Step 4: Log on and verify

1. Log on to the Alibaba Cloud console as the target RAM user, and go to the Agent Sandbox console.

2. Switch to the region and resource group to which the authorized resources belong, and then select the target Team.

3. Verify that the required query and management operations are available, and confirm that unauthorized operations or resources are still denied access.

If the logon fails, check the console logon settings. If an insufficient-permission message appears after the logon, check the current identity, region, resource group, and the operations and resource scope in the policy. The permissions that the user obtains from other policies or RAM user groups also take effect during authentication. When you verify fine-grained authorization, check these grants as well.

References

• To call operations by using Alibaba Cloud SDKs or CLI, see Alibaba Cloud SDK and API Guide.

• To use Sandboxes by using the E2B SDK, the E2B CLI, or a compatible API, authenticate with an Agent Sandbox API Key. For more information, see Create an API Key.

• For information about the RAM role and its permissions that a Sandbox requires to access cloud services such as storage, see Configure a RAM role.

RAM Action list

This section lists the resource ARN expressions and the RAM Actions required by resource type. For more information about how to call each operation, see the Sandbox API portal for the public API operations.

acs:sandbox:<region>:<account-id>:<resource-path>