AnalyticDB:Grant permissions to a RAM user

Prerequisites

A RAM user is created.

Procedure

{
  "comments": [
    "-- Here is just an example of using LakeCache. Modify the content and run your spark program."
  ],
  "args": ["oss://testBucketName/data/readme.txt"],
  "name": "spark-oss-test",
  "file": "oss://testBucketName/data/example.py",
  "conf": {
    "spark.adb.lakecache.enabled": "true";
    "spark.adb.roleArn": "acs:ram::testAccountID:role/adbtest";
  }
}

Step 1: Create a RAM role for Alibaba Cloud account B and grant permissions to the role

1. Create a RAM role and allow Alibaba Cloud account A to assume the RAM role.

   Note

   If you already created a RAM role and allowed Alibaba Cloud account A to assume the role, you can skip this step.

   1. Use Alibaba Cloud account B or the RAM administrator to log on to the RAM console.

   2. In the left-side navigation pane, choose Identities > Roles.

   3. On the Roles page, click Create Role.

   4. On the Create Role page, set the Principal Type parameter to Cloud Account, specify an Alibaba Cloud account, and then click OK.

   5. In the Create Role dialog box, configure the Role Name parameter and click OK.

   6. Click OK.

2. Grant permissions to the RAM role.

   1. On the Permissions tab, click Precise Permission.

   2. In the Precise Permission dialog box, set Policy Type to System Policy or Custom Policy and enter a policy name.

      If you want to access a resource in a specific virtual private cloud (VPC), you must create a custom policy and use the Resource parameter to specify the security group to which the resource belongs and the vSwitch to which the resource is connected. For information about how to create a custom policy, see Create custom policies.

      In this example, a custom policy named eni_policy that allows you to access only an ApsaraDB RDS for MySQL instance in a specific VPC is created.

      Note

      You must add the ApsaraDB RDS for MySQL instance to a security group and configure inbound and outbound security group rules that allow requests from the port of the ApsaraDB RDS for MySQL instance.

      {
          "Version": "1",
          "Statement": [
              {
                  "Effect": "Allow",
                  "Action": "ecs:*",
                  "Resource": "acs:ecs:*:*:securitygroup/<ID of the security group to which the ApsaraDB RDS for MySQL instance belongs>"
              },
              {
                  "Effect": "Allow",
                  "Action": "vpc:*",
                  "Resource": "acs:vpc:*:*:vswitch/<ID of the vSwitch to which the ApsaraDB RDS for MySQL instance is connected>"
              }
          ]
      }

   3. Click OK.

   4. Click Close.

3. Modify the trust policy to allow a RAM user that belongs to Alibaba Cloud account A to assume the RAM role.

   1. In the left-side navigation pane, choose Identities > Roles.

   2. On the Roles page, click the name of the RAM role that you created.

   3. On the Trust Policy tab, click Edit Trust Policy.

   4. In the code editor, modify the content of the trust policy and click OK.

      {
        "Statement": [
          {
            "Action": "sts:AssumeRole",
            "Effect": "Allow",
            "Principal": {
              "RAM": [
                "acs:ram::testAccountID:root"
              ]
            }
          },
          {
            "Action": "sts:AssumeRole",
            "Effect": "Allow",
            "Principal": {
              "Service": [
                "testAccountID@ads.aliyuncs.com"
              ]
            }
          }
        ],
        "Version": "1"
      }

Step 2: Create a RAM user for Alibaba Cloud account A and allow the RAM user to assume the RAM role

1. Create a RAM user.

   1. Use Alibaba Cloud account A or the RAM administrator to log on to the RAM console.

   2. In the left-side navigation pane, choose Identities > Users.

   3. On the Users page, click Create User.

   4. In the User Account Information section of the Create User page, configure the following parameters:

      • Logon Name: The logon name can be up to 64 characters in length, and can contain letters, digits, periods (.), hyphens (-), and underscores (_).

      • Display Name: The display name can be up to 128 characters in length.

      • Tag: Click the icon and enter a tag key and a tag value. You can add one or more tags to the RAM user. This way, you can manage the RAM user based on the tags.

      Note

      You can click Add User to create multiple RAM users at a time.

   5. In the Access Mode section, select Console Access and configure the logon security settings. The settings specify whether to use a system-generated or custom logon password, reset the password upon the next logon, and enable multi-factor authentication (MFA). For more information, see the "Console Access" section of the Create a RAM user topic.

   6. Click OK.

2. Create a policy that allows the RAM user to assume any role.

   1. In the left-side navigation pane, choose Permissions > Policies.

   2. On the Policies page, click Create Policy.

   3. On the Create Policy page, click the JSON tab.

   4. Enter the policy content in the code editor and click OK.

      {
          "Version": "1",
          "Statement": [
              {
                  "Action": "ram:PassRole",
                  "Resource": "*",
                  "Effect": "Allow"
              }
          ]
      }

   5. In the Create Policy dialog box, configure the Name and Description parameters and click OK.

3. Attach the policy to the RAM user.

   1. In the left-side navigation pane, choose Identities > Users

   2. On the Users page, find the required RAM user, and click Add Permissions in the Actions column.

   3. In the Add Permissions panel, select the policy that you created.

   4. Click Grant permissions.

   5. Click Close.