Function Compute:Grant permissions across Alibaba Cloud accounts by using RAM roles

Scenarios

Use the RAM console

Step 1: Create a RAM role by using Account A

Use Account A to create a RAM role, grant the required permissions to the RAM role, and then authorize Account B to assume this role. You must enter Account B in the Other Alibaba Cloud Account field.

1. Use Account A to log on to the RAM console.
2. In the left-side navigation pane, choose Identities > Roles.
3. On the Roles page, click Create Role.
4. In the Create Role panel, select Alibaba Cloud Account for the Select Trusted Entity parameter and click Next.
5. Configure the RAM role.
   1. Specify RAM Role Name.
   2. Optional:Specify Note.
   3. Enter the ID of Account B in the Other Alibaba Cloud Account field.
      Note You can view the ID of an Alibaba Cloud account on the Security Settings page.
6. Click OK.
7. Click Close.
8. Use Account A to attach the AliyunFCReadOnlyAccess policy to the created RAM role. For more information about how to grant permissions to a RAM role, see Grant permissions to a RAM role.

Step 2: Use Account B to create RAM users

1. Use Account B to create RAM users for employees of Enterprise B. For more information about how to create a RAM user, see Create a RAM user.
2. Use Account B to attach the AliyunSTSAssumeRoleAccess policy to the RAM users. Then, the RAM users can assume the RAM role. For more information about how to grant permissions to a RAM user, see Grant permissions to the RAM user.

Step 3: Switch the logon identity

If a RAM user that belongs to Account B needs to access resources of Account A, Account B can be used to grant the required permissions to the RAM user. The RAM user that belongs to Account B assumes the RAM role in Account A to access the resources of Account A. Procedure:

1. Use the RAM user that belongs to Account B to log on to the RAM console.
   For information about how to log on to the console as a RAM user, see Log on to the Alibaba Cloud Management Console as a RAM user.
2. Move the pointer over the profile picture in the upper-right corner of the console and click Switch Identity.

   1. Enter the enterprise alias (account alias), default domain name, or ID of the Alibaba Cloud account to which the RAM role belongs. For more information, see View and modify the default domain name.

   2. Enter the name of the RAM role. For more information, see View the information about a RAM role.

   For more information, see Assume a RAM role.

(Optional) Revoke the granted permissions

Enterprise A can revoke the permissions granted to Account B when the cooperation between Enterprise A and Enterprise B ends. Then, all RAM users that belong to Account B no longer have the permissions of the RAM role. Procedure:

1. Use Account A to log on to the RAM console.
2. In the left-side navigation pane, choose Identities > Users.
3. On the Users page, find the RAM user that you want to delete and click Delete in the Actions column.
4. In the Delete User dialog box, read the impact of deletion, enter the username of the RAM user, and then click Move to Recycle Bin.

Use an SDK

You can use STS to authorize temporary access to Function Compute. STS is a web service that provides STS tokens for cloud computing users. The following example shows how Account B obtains the permissions to view all services in Account A.

Before you start

Procedure

1. Use Account A to create a RAM role and select Account B as the trusted account.
   For more information, see Create a RAM role for a trusted Alibaba Cloud account.
2. Use Account B to create RAM users and authorize the RAM users to assume the RAM role.
   For more information, see Create a RAM user and Grant permissions to the RAM user.
3. In the function of Account B, enter the following sample code to obtain a temporary access credential. For more information, see STS SDK overview and AssumeRole.
   Node.js

   const Core = require('@alicloud/pop-core');
   
   // Build an Alibaba Cloud client that is used to initiate requests. 
   /*
       The AccessKey pair of an Alibaba Cloud account has permissions on all API operations. Using the AccessKey pair to perform operations is a high-risk operation. We recommend that you use a RAM user to call API operations or perform routine O&M. 
       We recommend that you do not save the AccessKey ID and AccessKey secret in your project code. Otherwise, the AccessKey pair may be leaked and the security of all resources under your account may be compromised. 
       In this example, the AccessKey pair is stored in environment variables to implement identity verification. 
       Configure the ALIBABA_CLOUD_ACCESS_KEY_ID and ALIBABA_CLOUD_ACCESS_KEY_SECRET environment variables before you run the sample code. 
       The ALIBABA_CLOUD_ACCESS_KEY_ID and ALIBABA_CLOUD_ACCESS_KEY_SECRET environment variables are automatically configured after you configure the execution permissions in the runtime of Function Compute. 
   */
    var client = new Core({
      accessKeyId: process.env['ALIBABA_CLOUD_ACCESS_KEY_ID'],
      accessKeySecret: process.env['ALIBABA_CLOUD_ACCESS_KEY_SECRET'],
      endpoint: 'https://sts.aliyuncs.com',
      apiVersion: '2015-04-01'
    });
   
    // Configure the parameters. 
    var params = {
      "RegionId": "cn-hangzhou",
      "RoleArn": "<RoleARN>",
      "RoleSessionName": "<RoleSessionName>"
    }
   
    var requestOption = {
      method: 'POST'
    };
   
    // Initiate the request and obtain responses. 
    client.request('AssumeRole', params, requestOption).then((result) => {
      console.log(JSON.stringify(result));
    }, (ex) => {
      console.log(ex);
    })

   Python

   # coding=utf-8
   # encoding: utf-8
   import json
   import os
   from aliyunsdkcore import client as AliyunSDK
   from aliyunsdksts.request.v20150401 import AssumeRoleRequest
   
   def main():
       # Enter the temporary key and temporary token.
       # The AccessKey pair of an Alibaba Cloud account can be used to access all API operations. Using these credentials to perform operations in Function Compute is a high-risk operation. We recommend that you use a RAM user to call API operations or perform routine O&M. 
       # We recommend that you do not save the AccessKey ID and AccessKey secret in your project code. Otherwise, the AccessKey pair may be leaked and the security of all resources under your account may be compromised. 
       In this example, the AccessKey pair is stored in environment variables to implement identity verification. 
       # Configure the ALIBABA_CLOUD_ACCESS_KEY_ID and ALIBABA_CLOUD_ACCESS_KEY_SECRET environment variables in your local environment before you run the sample code. 
       # In the runtime of Function Compute, the ALIBABA_CLOUD_ACCESS_KEY_ID and ALIBABA_CLOUD_ACCESS_KEY_SECRET environment variables are automatically configured after you configure the execution permissions. 
       AccessKeySecret=os.getenv('ALIBABA_CLOUD_ACCESS_KEY_SECRET'))
       AccessKeyId=os.getenv('ALIBABA_CLOUD_ACCESS_KEY_ID')
       regionId ='cn-hangzhou'
   
       sts_client = AliyunSDK.AcsClient(
               AccessKeyId,
               AccessKeySecret,
               regionId)
       request = AssumeRoleRequest.AssumeRoleRequest()
       request.set_RoleArn("<RoleARN>")
       request.set_RoleSessionName('fc-python-sdk')
       response = sts_client.do_action_with_exception(request)
       response_json = json.loads(response)
       result = json.dumps(response_json['Credentials'])
       print(result)
   
   if __name__ == "__main__":
       main()

   The following sample code shows the expected output:

   {
     "RequestId": "964E0EC5-575B-4FF5-8FD0-D4BD8025602A",
     "AssumedRoleUser": {
       "Arn": "acs:ram::****:role/wss/wss",
       "AssumedRoleId": "***********:wss"
     },
     "Credentials": {
       "SecurityToken": "*************",
       "AccessKeyId": "STS.*************",
       "AccessKeySecret": "*************",
       "Expiration": "2021-05-28T11:23:19Z"
     }
   }

   Note For answers to commonly asked questions when you obtain the STS token, see FAQ about RAM roles and STS tokens.
4. Modify the function code of Account B to authorize the RAM user that belongs to Account B to view all services in Function Compute within Account A.
   Sample code:

   const FC = require('@alicloud/fc2');
   // Build a client. 
   // Use the obtained temporary key. /*
       The AccessKey pair of an Alibaba Cloud account has permissions on all API operations. Using the AccessKey pair to perform operations is a high-risk operation. We recommend that you use a RAM user to call API operations or perform routine O&M. 
       We recommend that you do not save the AccessKey ID and AccessKey secret in your project code. Otherwise, the AccessKey pair may be leaked and the security of all resources under your account may be compromised. 
       In this example, the AccessKey pair is stored in environment variables to implement identity verification. 
       Configure the ALIBABA_CLOUD_ACCESS_KEY_ID, ALIBABA_CLOUD_ACCESS_KEY_SECRET, and ALIBABA_CLOUD_SECURITY_TOKEN environment variables in your local environment before you run the sample code. 
       The ALIBABA_CLOUD_ACCESS_KEY_ID, ALIBABA_CLOUD_ACCESS_KEY_SECRET, and ALIBABA_CLOUD_SECURITY_TOKEN environment variables are automatically configured after you configure the execution permissions in the runtime of Function Compute. 
   */
   const client = new FC('<accountID>', {
       region: '<yourRegionID>',
       accessKeyID: process.env['ALIBABA_CLOUD_ACCESS_KEY_ID'],
       securityToken: process.env['ALIBABA_CLOUD_SECURITY_TOKEN'],
       accessKeySecret: process.env['ALIBABA_CLOUD_ACCESS_KEY_SECRET'],
   });
   // Query services. 
   client.listServices().then(res => {
       console.log(JSON.stringify(res, null, ' '))
   }).catch(ex=> console.log(ex))

   Important Make sure that the role that is created by Account A and for which you want to grant the permissions of temporary key has the permission to query services.