All Products
Search

This Product

    CloudSSO:Assign access to a member account

    Document Center

    CloudSSO:Assign access to a member account

    Last Updated:Jul 17, 2026

    Assign access configurations to users or groups on member accounts in your resource directory. This example grants user1 VPC-only permissions on the Sandbox Account through an access configuration.

    Prerequisites

    • An access configuration is created.

      This example uses an access configuration that includes the AliyunVPCFullAccess system policy and no inline policies. Manage system policies and inline policies.

    • A user is created or synchronized.

      This example uses user1 created in the CloudSSO console. Create a user.

    Procedure

    1. Log on to the CloudSSO console.

    2. In the left-side navigation pane, click Multi-account Permission Configuration.

    3. On the Multi-account Permission Configuration page, select the target member account.

      This example uses Sandbox Account.

    4. Click Configure Access Assignments.

    5. In the Configure Access Assignments panel, select the target user or group, and then click Next.

      This example uses user1.

    6. Select the target access configuration, and then click Next.

    7. Review the configuration details and click Start Configuration.

    8. Wait for provisioning to complete and click Finish.

    Verify the assignment result

    1. Log on to the CloudSSO user portal as user1.

    2. On the Log on as RAM role tab, find the member account named Sandbox Account and click Show Details in the Access Assignment column.

    3. In the permissions panel, find the target access configuration and click Log On in the Actions column.

    4. Access VPC resources in Sandbox Account as a Resource Access Management (RAM) role.

      Note

      Only VPC resources are accessible because this access configuration grants VPC permissions only. To access other resources, update the access configuration policy and re-provision it.