AnalyticDB:Account authorization

How it works

1. Create a RAM role with Trusted Entity Type set to Alibaba Cloud Service and Select Trusted Service set to Cloud-native Data Warehouse AnalyticDB For MySQL.

2. Attach only the policies required by your Spark jobs.

3. Reference the role ARN in the spark.adb.roleArn parameter when submitting a job.

How it works

1. Account B creates a RAM role and configures its trust policy to allow account A's Spark service to assume it.

2. Account A creates a RAM user and grants it the ram:PassRole permission.

3. When submitting a Spark job, reference account B's role ARN in spark.adb.roleArn.

Step 1: Create a RAM role for account B and grant permissions

Perform the following steps using account B or a RAM administrator of account B.

1. Create a RAM role and allow account A to assume it.

   1. Log on to the RAM console using Alibaba Cloud account B or a RAM administrator of account B.

   2. In the left-side navigation pane, choose Identity Management > Roles.

   3. On the Roles page, click Create Role.

   4. On the Create Role page, set Trusted Entity Type to Alibaba Cloud Account, specify the account, and click OK.

   5. Configure the role:

      • Role Name: Enter a name, such as admin-oss.

      • Note (optional): Enter a description.

      • Other Alibaba Cloud Account: Select Other Alibaba Cloud Account and enter the UID of account A (testAccountIDA).

   6. Click Finish.

   Skip this step if a RAM role already exists that allows account A to assume it. Record the role ARN — you will need it in Step 2.

   Important

   Record the role ARN shown on the role details page. The format is acs:ram::<testAccountIDB>:role/<role-name>. You will reference this value in the spark.adb.roleArn parameter.

2. Grant permissions to the RAM role.

   1. Click Precise Authorization.

   2. In the Precise Authorization panel, set the policy type to System Policy or Custom Policy and enter a policy name.

      Access OSS

      • AliyunOSSReadOnlyAccess: Grants read-only permissions on OSS.

      • AliyunOSSFullAccess: Grants full control over OSS. You must grant this permission to the RAM role to perform data update operations, such as INSERT, on OSS external tables.

      Access VPC resources

      To access resources in a specific VPC, you must create a custom policy. In the Resource parameter of the policy, specify the security group and vSwitch to which the resources belong. For more information, see Create a custom permission policy.

      This example grants permissions to access only an ApsaraDB RDS for MySQL instance in a specific VPC. The name of the custom policy is eni_policy. The following code shows the policy document:

      Note

      You must add a security group to the ApsaraDB RDS for MySQL instance. The inbound and outbound rules of the security group must allow access on the port of the ApsaraDB RDS for MySQL instance.

      {
          "Version": "1",
          "Statement": [
              {
                  "Effect": "Allow",
                  "Action": "ecs:*",
                  "Resource": "acs:ecs:*:*:securitygroup/<The ID of the security group to which the RDS instance belongs>"
              },
              {
                  "Effect": "Allow",
                  "Action": "vpc:*",
                  "Resource": "acs:vpc:*:*:vswitch/<The ID of the vSwitch to which the RDS instance belongs>"
              }
          ]
      }

   3. Click OK.

   4. Click Close.

3. Update the trust policy to allow account A's Spark service to assume the role.

   1. In the left-side navigation pane, choose Identity Management > Roles.

   2. On the Roles page, click the name of the role you created.

   3. On the Trust Policy tab, click Edit Trust Policy.

   4. Replace the policy document with the following and click OK:

      {
          "Statement": [
              {
                  "Action": "sts:AssumeRole",
                  "Effect": "Allow",
                  "Principal": {
                      "RAM": [
                          "acs:ram::testAccountIDA:root"
                      ]
                  }
              },
              {
                  "Action": "sts:AssumeRole",
                  "Effect": "Allow",
                  "Principal": {
                      "Service": [
                          "testAccountIDA@ads.aliyuncs.com"
                      ]
                  }
              }
          ],
          "Version": "1"
      }

      Replace testAccountIDA with the actual UID of account A.

Step 2: Create a RAM user for account A and grant permissions

Perform the following steps using account A or a RAM administrator of account A.

1. Create a RAM user.

   1. In the User Account Information section, configure the following parameters:

      Parameter	Description
      Logon Name	Up to 64 characters. Allowed characters: letters, digits, periods (.), hyphens (-), and underscores (_).
      Display Name	Up to 128 characters.
      Tag (optional)	Click the edit icon and enter a tag key and value to help manage the user.

      Note

      Click Add User to create multiple RAM users at once.

   2. In the Access Mode section, select Console Password Logon and configure the logon password, password reset policy, and multi-factor authentication (MFA) settings as needed. For details, see Console access.

   3. Click OK.

   

2. Create a permission policy that allows the RAM user to pass roles.

   1. In the left-side navigation pane, choose Permission Management > Policies.

   2. On the Policies page, click Create Policy.

   3. On the Create Policy page, click the Script Editor tab.

   4. Enter the following policy document and click OK:

      {
          "Version": "1",
          "Statement": [
              {
                  "Action": "ram:PassRole",
                  "Resource": "*",
                  "Effect": "Allow"
              }
          ]
      }

   5. In the Create Policy dialog box, enter a Policy Name and optional Note, then click OK.

3. Grant the policy to the RAM user.

   1. In the left-side navigation pane, choose Identity Management > Users.

   2. On the Users page, find the RAM user and click Add Permissions in the Actions column.

   3. In the Add Permissions panel, select the policy you created in the previous step.

   4. Click OK, then click Close.