Realtime Compute for Apache Flink:Use a RAM role to access cloud resources (Beta)

1. Create a RAM role

1. Log on to the RAM console - Roles page and click Create Role. Keep the default options (the trusted entity is the current Alibaba Cloud account) and click OK.

2. Enter a recognizable role name, for example, FlinkRoleForOSSRead, and click OK.

2. Add a trust policy

Flink assumes the RAM role to obtain temporary credentials. The RAM role must trust Flink to assume it.

After the role is created, on the role details page, click the Trust Policy tab and click Edit Trust Policy. Add "Service": ["stream.aliyuncs.com"] to Principal to trust Flink to assume the role. For more information, see Modify the trust policy of a RAM role.

{
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Effect": "Allow",
      "Principal": {
        "Service": [
          "stream.aliyuncs.com"
        ]
      }
    }
  ],
  "Version": "1"
}

3. Grant permissions to access cloud resources

Flink uses the RAM role identity to access cloud resources. Grant the required permissions to the RAM role in advance to prevent access errors.

On the role details page, click the Permissions tab and click Grant Permission to grant the role permissions to access target cloud resources.

For example, to access OSS, grant AliyunOSSReadOnlyAccess (read-only) or AliyunOSSFullAccess (full) permissions. For more information, see Grant permissions to a RAM role.

Create a permission policy

Log on to the RAM console - Policies page and click Create Policy. Switch to Script mode and edit the policy content.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ram:ListRoles"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "ram:PassRole",
      "Resource": "acs:ram::<account-id>:role/<role-name>",
      "Condition": {
        "StringEquals": {
          "acs:Service": "stream.aliyuncs.com"
        }
      }
    }
  ]
}

Click OK to save the policy, for example, as FlinkPassRolePolicy. For more information, see Create a custom policy.

Grant permissions to the RAM user

1. Log on to the RAM console - Users page. Find the RAM user to authorize and click Add Permissions in the Actions column.

2. In the Add Permissions panel, search for and select the policy created in Step 2 (for example, FlinkPassRolePolicy), then click Confirm. For more information, see Grant permissions to a RAM user.

Add a RAM role reference

1. Log on to the Realtime Compute console and enter the target workspace.

2. In the left-side navigation pane, choose Security Services > Access Security.

3. Click the RAM Roles tab.

4. Click Reference RAM Role.

5. In the dialog box, configure the following:

   Item	Required	Description
   RAM role	Yes	Select the role from the drop-down list. Fuzzy search by role name and multi-select (up to 5 per operation) are supported. Referenced roles cannot be selected again. Note The role list contains regular service roles under the Alibaba Cloud account that owns the current namespace. The operator must belong to the same Alibaba Cloud account as the current namespace and have the ListRoles permission to view the roles.
   Description	No	Role description. Up to 256 characters.

6. Click Test. The system automatically checks the following two items:

   • PassRole permission check: The current user has the ram:PassRole permission on the selected RAM role.

   • Trust policy check: The selected RAM role trusts the current Flink namespace to assume it.

7. After the checks pass, click OK.

Use the RAM role in jobs

After the RAM role is referenced, specify the role name using the akless.assume-role.role-name parameter in the job code. Flink assumes the role to obtain the temporary STS token and accesses cloud resources as the role.

# OSS
fs.oss.bucket.<bucketName>.akless.assume-role.role-name: <your-role-name>
fs.oss.inner.bucket: <workspace-associated-bucket-name>

# OSS-HDFS
fs.oss.jindo.akless.assume-role.role-name: <your-role-name>

Edit a RAM role

1. Under Security Services > Access Security > RAM Roles, find the target role and click Edit in the Actions column.

2. In the dialog box, modify the description. The role name cannot be modified.

3. Click Test. After the checks pass, click OK.

Remove a RAM role

1. Under Security Services > Access Security > RAM Roles, find the target role and click Remove in the Actions column.

2. In the confirmation dialog box, enter the role name and click Confirm Removal.

Refresh role status

Click Refresh in the upper-right corner of the RAM Roles list to check the status of all referenced roles in bulk.

Model 1: Direct assumption (sts:AssumeRole)

• Core action: A trusted entity (such as a RAM user or an application) actively calls the STS AssumeRole API to obtain temporary credentials for a RAM role, effectively "transforming" into that role.

• Authorization chain: Entity A → Calls sts:AssumeRole → Assumes Role R → Obtains Role R permissions.

• Permission requirement: Entity A must be granted the sts:AssumeRole permission.

• Typical scenario: An application running on ECS or a local server needs to temporarily access OSS. The application uses its own AccessKey pair to call AssumeRole, obtains temporary credentials, and then uses them to access OSS. In this scenario, Entity A is the active executor.

Model 2: Delegated authorization (ram:PassRole)

• Core action: An entity (such as a RAM user) "passes" a RAM role to a cloud service (such as Flink), authorizing the service to assume the role. The user does not assume the role.

• Authorization chain: User_B → Passes Role_A → To the cloud service → The cloud service calls sts:AssumeRole to assume Role_A → The cloud service obtains Role_A permissions.

• Permission requirement: User B must be granted the ram:PassRole permission, and Role A must trust the cloud service to assume it.

• Typical scenario: A developer (User_B) develops a job in the Flink console and specifies a role (Role_A). To allow the Flink service to access cloud resources on behalf of the user, the user must have the permission to pass Role_A to the Flink service. In this scenario, the user is the authorizer, and the cloud service is the executor.

Example: Flink accessing OSS

The interaction flow of the delegated authorization (PassRole) model consists of a configuration phase and a runtime phase:

• Configuration phase:

  1. The RAM administrator completes basic setup, including creating the role, configuring its permissions and trust relationship, and granting the PassRole permission to the user.

  2. The user adds a RAM role reference in Flink. The Flink platform verifies that the user is authorized to "pass" the role and that the role trusts Flink to assume it.

• Runtime phase:

  1. Service assumes the role: The Flink service (stream.aliyuncs.com), as the actual role assumer, sends an AssumeRole request to STS.

  2. STS authorization and service execution: STS confirms that Flink is trusted by Role A, then issues temporary credentials. The Flink service uses these credentials to access OSS and complete the task delegated by the user.