Elastic Container Instance:Pull ACR images without secrets

When an ACR instance and an ECI resource are in the same Alibaba Cloud account, secret-free access is enabled by default for Personal Edition instances and for Enterprise Edition instances that use a default domain name. You can optionally configure a Resource Access Management (RAM) role to restrict this access, for example, to allow pulls from only a specific ACR instance.

This configuration consists of two steps.

Step 1: Create and authorize a RAM role

1. Create a RAM role for a trusted Alibaba Cloud service. For more information, see Create a RAM role for a trusted Alibaba Cloud service.

   Note the following parameters:

   • Principal type: Cloud Service

   • Principal name: Elastic Container Instance

   • Role name: acr-test (example)

2. Create a custom permission policy. For more information, see Create a custom permission policy.

   The following policy allows image pulls only from the specified ACR instance. For more information about how to write a permission policy, see Policy elements.

   {
       "Version": "1",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "cr:Get*",
                   "cr:List*"
               ],
               "Resource": "*"
           },
           {
               "Effect": "Allow",
               "Action": [
                   "cr:Pull*"
               ],
               "Resource": [
                   "acs:cr:cn-hangzhou:1609982529******:instance/cri-nwj395hgf6f3****"
               ]
           }
       ]
   }

3. Attach the custom permission policy to the RAM role. For more information, see Grant permissions to a RAM role.

4. Find the new acr-test role and click its name to open the details page. Verify the permissions and get the ARN.

   In the Basic Information section, find the ARN field (formatted as acs:ram::<AccountID>:role/acr-test) and click the copy button next to it. On the Permissions tab, verify that the custom policy acr is attached.

Step 2: Specify the RAM role

When calling the CreateContainerGroup operation to create an ECI instance or the CreateImageCache operation to create an image cache, set the AcrRegistryInfo.N.ArnService parameter to specify the RAM role to use for creating the resource. The parameter is described in the following table. For more information, see CreateContainerGroup and CreateImageCache.

The following example shows how to pass parameters via the OpenAPI to create an ECI instance:

ContainerGroupName=test-acr
#Container
Container.1.Name=test
Container.1.Image=test****-registry.cn-hangzhou.cr.aliyuncs.com/eci_test/nginx:1.0
#AcrRegistryInfo
AcrRegistryInfo.1.ArnService=acs:ram::1609982529******:role/acr-test

Step 1: Create and authorize RAM roles

1. In Account A, which owns the ECI resource, create and authorize a RAM role.

   1. Create a RAM role for a trusted Alibaba Cloud service. For more information, see Create a RAM role for a trusted Alibaba Cloud service.

      Note the following parameters:

      • Principal type: Cloud Service

      • Principal name: Elastic Container Instance

      • Role name: role-assume (example)

   2. Grant the role-assume role permissions to call the AssumeRole operation of Security Token Service (STS). For more information, see Grant permissions to a RAM role.

      Attach the AliyunSTSAssumeRoleAccess system policy.

   3. Find the newly created role-assume role, click its name to go to the details page, and then verify the permissions and trust policy and obtain the ARN.

      • Permissions and ARN

        The ARN of the RAM role is acs:ram::<AccountID>:role/role-assume. The role is granted the AliyunSTSAssumeRoleAccess system policy, which allows it to call the STS AssumeRole operation.

      • Trust policy

        {
          "Statement": [
            {
              "Action": "sts:AssumeRole",
              "Effect": "Allow",
              "Principal": {
                "Service": [
                  "eci.aliyuncs.com"
                ]
              }
            }
          ],
          "Version": "1"
        }

2. In Account B, which owns the ACR instance, create and authorize a RAM role.

   1. Create a RAM role for a trusted Alibaba Cloud account. For more information, see Create a RAM role for a trusted Alibaba Cloud account.

      Note the following parameters:

      • Principal type: Alibaba Cloud Account

      • Principal name: Other Alibaba Cloud Account. Enter the ID of Account A, which owns the ECI resource.

      • Role name: role-acr (example)

   2. Grant the role-acr role permissions to pull ACR images. For more information, see Grant permissions to a RAM role.

      Attach the AliyunContainerRegistryFullAccess system policy.

   3. Modify the trust policy to allow the role-assume role to assume the role-acr role. For more information, see Modify the trust policy of a RAM role.

      By default, the role-acr role can be assumed by any authorized RAM user or RAM role in Account A. We recommend that you modify the trust policy for precise authorization.

      In the Principal section, change the value of the RAM field to the ARN of the role-assume role. This ensures that only the role-assume role can assume the role-acr role. Example:

      "Principal": {
      	"RAM": [
      		"acs:ram::1609982529******:role/role-assume"
      	]
      }

   4. Verify the permissions and trust policy, and obtain the ARN.

      • Permissions and ARN

        The ARN of the role-acr role is acs:ram::<AccountID>:role/role-acr. You can click the copy button to copy the value. On the Permissions tab, verify that the AliyunContainerRegistryFullAccess system policy is attached and the resource scope is at the account level.

      • Trust policy

        {
          "Statement": [
            {
              "Action": "sts:AssumeRole",
              "Effect": "Allow",
              "Principal": {
                "RAM": ["acs:ram::10051309xxxx:role/role-assume"]
              }
            }
          ],
          "Version": "1"
        }

Step 2: Specify the RAM roles

When you call the CreateContainerGroup or CreateImageCache operation, you can set AcrRegistryInfo parameters to specify an ACR instance from another Alibaba Cloud account. Note the following:

• If the ACR instance belongs to another Alibaba Cloud account, you must set the ArnService and ArnUser parameters to specify the RAM roles for permission configuration.

• If the ACR Enterprise Edition instance uses a custom domain name, you must also set the InstanceId parameter.

For more information, see CreateContainerGroup and CreateImageCache.

The following example shows how to pass parameters via the OpenAPI to create an ECI instance:

ContainerGroupName=test-acr
#Container
Container.1.Name=test
Container.1.Image=test****-registry.cn-hangzhou.cr.aliyuncs.com/eci_test/nginx:1.0
#AcrRegistryInfo
AcrRegistryInfo.1.ArnService=acs:ram::1609982529******:role/role-assume
AcrRegistryInfo.1.ArnUser=acs:ram::1298452580******:role/role-acr