Cloud Enterprise Network:Grant permissions to a CCN instance

Case 1: Instances in the same account

1. Log on to the CEN console.

2. On the Instances page, click the ID of the CEN instance that you want to manage.

3. On the Basic Information > Transit Router tab, find the transit router in the same region as the VPC associated with Private Zone and click its ID.

4. On the details page of the transit router, click the Private Zone tab and click Authorize Now. On the quick authorization page of Resource Access Management (RAM), click Authorize.

   Note

   Grant permissions to Smart Access Gateway (SAG) only when you configure access to Private Zone for the first time. After you grant the permissions, the CCN instance that is connected to the transit router can access Private Zone. The CCN instance is a component of SAG.

   After you grant the permissions, a RAM role named AliyunSmartAGAccessingPVTZRole is automatically created for the current account. Go to the RAM console and on the Identities > Roles page, search for the role to view its information.

Case 2: CCN in a different account

1. In the account that owns the VPC, grant permissions to allow CCN instances within that account to access Private Zone.

   1. Log on to the CEN console using the account that owns the VPC.

   2. On the Instances page, find the CEN instance that you want to manage and click its ID.

   3. On the Basic Information > Transit Router tab, find the transit router in the same region as the VPC associated with Private Zone and click its ID.

   4. On the details page of the transit router, click the Private Zone tab and then click Authorize Now. On the quick authorization page of Resource Access Management (RAM), click Authorize.

      Note

      Grant permissions to Smart Access Gateway (SAG) only when you configure access to Private Zone for the first time. After you grant the permissions, the CCN instance that is connected to the transit router can access Private Zone. The CCN instance is a component of SAG.

2. Modify the trust policy of the AliyunSmartAGAccessingPVTZRole role in the account that owns the VPC to allow the cross-account CCN instance to access Private Zone.

   1. Log on to the RAM console using the account that owns the VPC.

   2. In the navigation pane on the left, choose Identities > Roles.

   3. On the Roles page, enter AliyunSmartAGAccessingPVTZRole in the search box to find the role, and then click the role name.

   4. On the role details page, click the Trust Policy tab and then click Edit Trust Policy.

   5. In the Service section, add the following record: "Alibaba Cloud account ID of the CCN instance@smartag.aliyuncs.com". Then, click OK.

      

Case 3: TR in a different account

1. Log on to the RAM console using the account that owns the VPC.

2. In the navigation pane on the left, choose Identities > Roles.

3. On the Roles page, click Create Role.

4. In the Create Role panel, create a role based on the following information.

   1. For Principal Type, select Cloud Service.

   2. For Principal Name, select Smart Access Gateway.

   3. Click OK. Enter AliyunSmartAGAccessingPVTZRole for Role Name and click OK.

   4. Return to the Roles page.

5. On the Roles page, search for the AliyunSmartAGAccessingPVTZRole role that you created and click the role name.

6. On the Permissions tab, click Grant Permission to open the Grant Permission panel.

7. In the search box under Policy, enter the keyword pvtz. Select the AliyunPvtzReadOnlyAccess policy and click Grant Permission.

8. In the Grant Permission panel, click Close to return to the role details page.

9. On the role details page, click the Trust Policy tab to view the authorization information.

   

Case 4: Each instance in a separate account

1. Follow the steps in Scenario 3 to create a role and grant permissions in the account that owns the VPC.

2. Follow the steps in Scenario 2 to grant permissions to the CCN instance in the account that owns the VPC.

What to do next

Configure access to Private Zone