CloudSSO:Use the service-linked role for CloudSSO

Scenarios

The service-linked role AliyunServiceRoleForCloudSSO has permissions to manage Resource Access Management (RAM) roles, policies, and service providers (SPs). This role allows you to configure resource directory permissions in a centralized manner.

For more information about service-linked roles, see Service-linked roles.

Description

Role name: AliyunServiceRoleForCloudSSO

Policy: AliyunServiceRolePolicyForCloudSSO

 {
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "ram:CreateSAMLProvider",
                "ram:CreatePolicy",
                "ram:ListRoles",
                "ram:ListPolicies"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "ram:ListPolicyVersions",
                "ram:DeletePolicyVersion",
                "ram:CreatePolicyVersion",
                "ram:DeletePolicy"
            ],
            "Resource": [
                "acs:ram:*:*:policy/AliyunReservedSSO*"
            ],
            "Effect": "Allow"
        },
        {
            "Action": [
                "ram:GetSAMLProvider",
                "ram:DeleteSAMLProvider",
                "ram:GetRole",
                "ram:CreateRole",
                "ram:DeleteRole",
                "ram:GetPolicy",
                "ram:AttachPolicyToRole",
                "ram:DetachPolicyFromRole",
                "ram:ListPoliciesForRole"
            ],
            "Resource": [
                "acs:ram:*:*:saml-provider/AliyunReservedSSO*",
                "acs:ram:*:*:role/aliyunreservedsso*",
                "acs:ram:*:*:policy/*"
            ],
            "Effect": "Allow"
        },
        {
            "Action": [
                "ram:DeleteServiceLinkedRole",
                "ram:GetServiceLinkedRoleDeletionStatus"
            ],
            "Resource": "*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": "cloudsso.aliyuncs.com"
                }
            }
        }
    ]
}

Role creation

The service-linked role AliyunServiceRoleForCloudSSO is automatically created.

• When you create the CloudSSO directory, the service-linked role is automatically created within the enterprise management account.
• When you assign an access configuration for a member account in your resource directory for the first time in the CloudSSO console, the service-linked role is automatically created within the member account.

Role deletion

After you delete the CloudSSO directory, you can manually delete the service-linked role AliyunServiceRoleForCloudSSO. For more information, see Delete a RAM role.

If a member account is removed from your resource directory, the service-linked role AliyunServiceRoleForCloudSSO created for the member account is automatically deleted.