All Products
Search

This Product

    Compute Nest:Grant PassRole permission to a RAM user

    Document Center

    Compute Nest:Grant PassRole permission to a RAM user

    Last Updated:Jun 20, 2026

    When creating a fully managed service, Compute Nest uses a role in your Alibaba Cloud account to create resources. To allow a RAM user to do this, you must grant the PassRole permission to that user.

    Prerequisites

    You have created a RAM role for the trusted service Compute Nest. For instructions, see Create a role for the trusted service Compute Nest.

    Procedure

    1. Log on to the RAM console with your Alibaba Cloud account.

    2. Create a custom policy.

      1. In the left-side navigation pane, choose Permissions > Policies.

      2. Click Create Policy.

      3. On the Create Policy page, click the JSON tab.

      4. In the policy editor, enter the following content.

        {
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ram:PassRole"
      ],
      "Resource": [
        "*"
      ],
      "Condition": {
        "StringEquals": {
          "acs:Service": [
            "supplier.computenest.aliyuncs.com"
          ]
        }
      }
    }
  ]
}

      5. Click OK. Then, enter a name for the policy and click OK.

    3. Attach the policy to the RAM user or user group.

      When you attach the policy, select Custom Policy and then select the policy you just created. For more information, see Manage permissions for a RAM user and Grant permissions to a user group.