Hologres:RAM role authorization mode in Hologres

Background information

Enterprise users can use their Alibaba Cloud accounts and passwords to log on to the Alibaba Cloud Management Console and then manage and use cloud resources. However, enterprises that have stricter security requirements may prefer to use the role-based SSO method. For more information, see Overview.

Scenarios

Access methods supported by Hologres

In Hologres, RAM roles have equal status with Alibaba Cloud accounts and RAM users. Therefore, in Hologres, a RAM role is regarded as an ordinary available account. A superuser must grant permissions, such as the SELECT, INSERT, and UPDATE permissions, to the RAM role, instead of the Alibaba Cloud account or RAM user that assumes the role. After that, the RAM role can use Hologres based on the granted permissions.

Introduction to role-based SSO

The access to Hologres by using role-based SSO is implemented based on Alibaba Cloud STS. STS is a cloud service that provides temporary access control for Alibaba Cloud accounts or RAM users. You can use STS to issue an access credential that has a custom validity period and access permissions to a user that is managed by your on-premises account system. The user can use an STS temporary access credential to connect to Hologres and use authorized resources.

Step 1: Create a RAM role

Assign a RAM role to a RAM user and grant permissions

If you want a RAM user to assume a RAM role by switching the identity in the Alibaba Cloud Management Console, log on to the RAM console and create a RAM role. In the Create Role panel, set the Select Trusted Entity parameter to Alibaba Cloud Account.

1. Create a RAM role for a trusted Alibaba Cloud account.

   1. Log on to the RAM console. In the left-side navigation pane, choose Identities > Roles.

   2. On the Roles page, click Create Role. In the Create Role panel, set the Select Trusted Entity parameter to Alibaba Cloud Account.

   3. Click Next. In the Configure Role step, specify a name for the RAM role and set the Select Trusted Alibaba Cloud Account parameter to Current Alibaba Cloud Account.

   4. Click OK. The Finish step shows that the RAM role is created.

2. Modify the trust policy of the RAM role.

   1. On the Roles page, click the name of the RAM role whose trust policy you want to modify to go to the details page of the RAM role.

   2. On the Trust Policy tab, click Edit Trust Policy and replace the policy content with the following script.

      • Parameters

        When you configure the policy, replace the Alibaba Cloud account ID in acs:ram::Alibaba Cloud account ID:root in the following script with the ID of the Alibaba Cloud account to which you want to grant permissions. You can go to the Security Settings page to obtain the account ID.

      • Script

        {
            "Statement": [
                {
                    "Action": "sts:AssumeRole",
                    "Effect": "Allow",
                    "Principal": {
                        "RAM": [
                            "acs:ram::Alibaba Cloud account ID:root"
                        ]
                    }
                },
                {
                    "Action": "sts:AssumeRole",
                    "Effect": "Allow",
                    "Principal": {
                        "Service": [
                            "dataworks.aliyuncs.com"
                        ]
                    }
                }
            ],
            "Version": "1"
        }

   3. Click Save trust policy document.

3. Create a RAM user and grant the RAM user the permissions to assume a role.

   To assign a RAM role to a RAM user, you must first create a RAM user and grant the RAM user the permissions to assume a role.

   1. Log on to the RAM console. In the left-side navigation pane, choose Identities > Users.

   2. Optional. Click Create User to create one or more RAM users at a time. If a RAM user is available, skip this step. For more information about how to create a RAM user, see Create a RAM user.

   3. On the Users page, find the RAM user that you created and click Add Permissions in the Actions column.

   4. In the Add Permissions panel, attach the AliyunSTSAssumeRoleAccess policy to the RAM user that you created. After that, the RAM user has the permissions to call the AssumeRole operation of STS.

   5. Click OK.

Assign a RAM role to an IdP and grant permissions

If you want an on-premises IdP to log on to the Alibaba Cloud Management Console to assume a RAM role, log on to the RAM console and create a RAM role. In the Create Role panel, set the Select Trusted Entity parameter to IdP.

1. Create a RAM role for a trusted IdP.

   1. Log on to the RAM console. In the left-side navigation pane, choose Identities > Roles.

   2. On the Roles page, click Create Role. In the Create Role panel, set the Select Trusted Entity parameter to IdP.

   3. Click Next. In the Configure Role step, set the RAM Role Name and Note parameters.

   4. Configure the IdP Type and Select IdP parameters, view the conditions, and then click OK. The Finish step shows that the RAM role is created.

2. Modify the trust policy of the RAM role.

   1. On the Roles page, click the name of the RAM role whose trust policy you want to modify to go to the details page of the RAM role.

   2. On the Trust Policy tab, click Edit Trust Policy and replace the policy content with the following script.

      • Parameters

        When you configure the policy, replace the Alibaba Cloud account ID in acs:ram::Alibaba Cloud account ID:saml-provider/IDP in the following script with the ID of the Alibaba Cloud account to which you want to grant permissions. You can go to the Security Settings page to obtain the account ID.

      • Script

        "Statement": [
                {
                    "Action": "sts:AssumeRole",
                    "Condition": {
                        "StringEquals": {
                            "saml:recipient": "https://signin.aliyun.com/saml-role/sso"
                        }
                    },
                    "Effect": "Allow",
                    "Principal": {
                        "Federated": [
                            "acs:ram::Alibaba Cloud account ID:saml-provider/IDP"
                        ]
                    }
                },
                {
                    "Action": "sts:AssumeRole",
                    "Effect": "Allow",
                    "Principal": {
                        "Service": [
                            "dataworks.aliyuncs.com"
                        ]
                    }
                }
            ],
            "Version": "1"
        }
        }

   3. Click Save trust policy document.

Step 2: Add the RAM role to a Hologres instance and grant permissions to the role

Before the RAM role can use Hologres based on the granted permissions, the role must obtain the required development permissions on the Hologres instance. By default, the RAM role does not have the permissions to view or manage instances in the Hologres console. Therefore, you must first use your Alibaba Cloud account to grant the required permissions to the RAM role. For more information, see Grant permissions on Hologres to RAM users. After you add the RAM role to a Hologres instance, you can use one of the following methods to grant permissions to the RAM role:

1. Grant permissions to the RAM role in the Hologres console.

   1. On the Instances page, click the Hologres instance that you want to manage. In the navigation pane, click Account Management. On the User Management page, click Add New User. In the Add New User dialog box, select a RAM role and add it to the Hologres instance.

   2. In the left-side navigation pane, click Database Authorization. On the Database Authorization page, grant permissions to the RAM role.

2. Use an SQL statement to grant permissions to the RAM role.

   For more information, see Permission management overview.

3. By default, a RAM role does not have the permissions to perform operations in the Hologres console. If you want a RAM user to assume the RAM role, you must use your Alibaba Cloud account to attach the AliyunRAMReadOnlyAccess policy to the RAM user. Otherwise, you cannot use the RAM role to perform operations in the Hologres console. For more information, see Grant permissions on Hologres to RAM users.

Step 3: Log on to Alibaba Cloud and use Hologres