Hologres:Hologres RAM role authorization mode

Background information

Alibaba Cloud enterprise users typically log on to the console with a username and password. As security requirements become stricter, many enterprises prefer role-based SSO to centralize authentication. For more information, see Overview of SAML-based role SSO.

Scenarios

Supported access methods in Hologres

In Hologres, a RAM role is equivalent to an Alibaba Cloud account (either a root account or a RAM user). Therefore, a RAM role is considered a standard logon account. A superuser must grant permissions, such as SELECT, INSERT, or UPDATE, directly to the RAM role, not to the underlying Alibaba Cloud account. The RAM role can then use Hologres within the scope of its granted permissions.

Role-based SSO (STS)

Role-based SSO for Hologres uses the Alibaba Cloud Security Token Service (STS). STS issues temporary security credentials with custom validity periods and permissions to users managed by your on-premises identity system. Users can use these credentials to directly connect to Hologres and access authorized resources.

Step 1: Create a RAM role

Assume a role as a RAM user

If you need a RAM user to assume a RAM role by switching identities on the Alibaba Cloud Management Console, log on to the Resource Access Management (RAM) console and create a RAM role. For the principal type, select Alibaba Cloud Account.

1. Create a RAM role whose principal type is Alibaba Cloud Account.

   1. Log on to the Resource Access Management (RAM) console. In the left-side navigation pane, choose Identities > Roles.

   2. On the Create Role page, click Create Role. For Principal Type, select Alibaba Cloud Account. For Principal Name, select Current Account. Click OK.

   3. In the Create Role dialog box, enter a Role Name and click OK to create the role.

2. Create and attach a permission policy.

   1. On the RAM role management page, click the name of the target role to go to its details page.

   2. Click the Trust Policy tab. Click Edit Trust Policy and replace the policy with the following script.

      • Parameter description

        When you configure the policy, in the string acs:ram::root_account_ID:root, replace root_account_ID with the ID of the account that you want to authorize. Go to the User Information page to obtain the account ID.

      • Policy example

        {
            "Statement": [
                {
                    "Action": "sts:AssumeRole",
                    "Effect": "Allow",
                    "Principal": {
                        "RAM": [
                            "acs:ram::

   3. Click OK to save the trust policy.

3. Create a RAM user and grant it permissions to assume a role.

   To assume a RAM role as a RAM user, you must create a RAM user and grant it permission to assume roles.

   1. Log on to the Resource Access Management (RAM) console. In the left-side navigation pane, choose Identities > User.

   2. (Optional) If you already have a RAM user, skip this step. Click Create User to create one or more RAM users. For more information, see Create a RAM user.

   3. Click Add Permissions in the Actions column of the target RAM user.

   4. On the Add Permissions page, grant the AliyunSTSAssumeRoleAccess permission to the RAM user to allow the user to call the AssumeRole operation of the STS API. In the permissions section, click the System Policy tab, then search for and select the AliyunSTSAssumeRoleAccess policy.

   5. Click OK to finish the setup.

Assume a role as an IdP user

If you need to log on to Alibaba Cloud by using an on-premises IdP account to assume a RAM role, log on to the Resource Access Management (RAM) console and create a RAM role. For the principal type, select Identity Provider.

1. Create a RAM role whose principal type is Identity Provider.

   1. Log on to the Resource Access Management (RAM) console. In the left-side navigation pane, choose Identities > Role.

   2. On the Role page, click Create Role. For Principal Type, select Identity Provider.

   3. Click OK. Configure the Role Name and Note parameters.

   4. Select an IdP Type and an Select IdP. Review the conditions and click Complete. A message appears, indicating that the role is created.

2. Create and attach a permission policy.

   1. On the role list page, click the name of the target role to go to its details page.

   2. Click the Trust Policy tab. Click Edit Trust Policy and replace the policy with the following script.

      • Parameter description

        When you configure a policy, you must replace RootAccountID in the script acs:ram::RootAccountID:saml-provider/IDP with the information for the account that you want to authorize. Go to the User Information page to obtain the account ID.

      • Policy example

        {
            "Statement": [
                {
                    "Action": "sts:AssumeRole",
                    "Condition": {
                        "StringEquals": {
                            "saml:recipient": "https://signin.alibabacloud.com/saml-role/sso"
                        }
                    },
                    "Effect": "Allow",
                    "Principal": {
                        "Federated": [
                            "acs:ram::

   3. Click OK to save the trust policy.

Step 2: Add and authorize the RAM role

A RAM role must have development permissions on a Hologres instance before it can use Hologres. By default, a RAM role cannot view or manage instances on the Hologres console, so the root account must first grant the required permissions in RAM. For more information, see Grant permissions to a RAM user. You can add the RAM role to a Hologres instance and grant permissions by using one of the following methods.

1. Log on to the Hologres console to grant permissions.

   1. In the left-side navigation pane, go to the Instances page. Click the instance to which you want to grant permissions. On the User Management tab, find the RAM role and add it as a new user to the instance.

   2. On the Database Authorization tab, grant the required instance development permissions to the RAM role.

2. Grant permissions using SQL statements.

   You can grant permissions by using SQL statements. For more information, see Permission management overview.

3. When a RAM user assumes a RAM role, the role does not have permissions to access the Hologres console by default. The root account must grant the AliyunRAMReadOnlyAccess permission to the RAM user on the RAM console. Otherwise, the role cannot perform any operations on the Hologres console. For more information, see Grant permissions to a RAM user.

Step 3: Log on and use Hologres