Cloud identity management lets you bring multiple Alibaba Cloud accounts and their Resource Access Management (RAM) roles under a single IDaaS instance, so you can control access across accounts from one place instead of managing each account separately.
Prerequisites
Before you begin, ensure that you have:
An IDaaS instance running Enterprise Edition with the M2M extension enabled
The User Portal address for your IDaaS instance — find it in the User Portal column of the IDaaS console. The issuer URL you will enter during account setup follows this format:
https://<portal_address>/api/v2/iauths_system/oauth2For the account being added: confirmed that no existing identity provider in RAM uses the same name or issuer URL
How it works
When you add an Alibaba Cloud account, IDaaS establishes an OpenID Connect (OIDC) trust relationship between itself and the RAM of that account. This trust is what lets IDaaS manage and assign RAM roles — referred to as cloud roles in IDaaS — to your users and applications.
The setup has two phases for each account:
Register the account in IDaaS — provide account information and authorize IDaaS to interact with RAM.
Configure the system role in RAM — create a custom policy, a RAM role, and attach the policy to the role. IDaaS then detects and validates these resources before completing the connection.
The key difference between the two account types is how IDaaS creates the identity provider in RAM:
| Account type | Identity provider creation | Additional step |
|---|---|---|
| Current account | IDaaS creates the OIDC identity provider automatically after you click Authorize | None |
| Other account | You create the identity provider manually in the target account's RAM console | Configure identity provider parameters |
Once connected, an account appears on the Asset Management > Cloud Identity page, where you can manage its cloud roles.
Add an Alibaba Cloud account
Add the current account
Use this path to add the Alibaba Cloud account you are currently logged in to.
In the IDaaS console, select your IDaaS instance and click Console in the Actions column.IDaaS consoleIDaaS consoleIDaaS console
Go to Asset Management > Cloud Identity and click Add Alibaba Cloud Account.
Fill in the account information:
Identity Provider Name: Enter a name. The name and issuer URL must not conflict with any existing identity provider in RAM. To check existing identity providers, see Manage OIDC identity providers.
If the authorization status does not update after you click Authorize, refresh the page and start the process again.
Click Next.
In the RAM console of your account, complete the following in order:
Create a custom policy: Copy the access policy script from the current page and create a policy in RAM. See Create a custom policy.
Create a RAM role: Use the role name provided on the page to create a RAM role for a trusted identity provider. See Create a RAM role for a trusted identity provider.
Grant permissions to the role: Attach the access policy to the RAM role. See Manage permissions of a RAM role.
ImportantWhen granting permissions, configure a precise access policy. Grant only the minimum permissions required for your business tasks. Avoid broad authorizations such as
*:*.Click Start Detection. IDaaS checks your configurations. If any issue is found, review and fix the configuration, then run detection again.
Click Next to complete adding the account.
The account now appears on the Asset Management > Cloud Identity page. To view the system role, click Cloud Role Management in the Actions column.
Add another Alibaba Cloud account
Use this path to add an account other than the one you are currently logged in to.
In the IDaaS console, select your IDaaS instance and click Console in the Actions column.
Go to Asset Management > Cloud Identity and click Add Alibaba Cloud Account.
Fill in the account information:
Account Type: Select Account Type.
Cloud Account Type: Select Alibaba Cloud Account Type.
Alibaba Cloud Account UID: Enter the UID of the root account you want to add.
Identity Provider Name: Enter a name. You will manually create this identity provider in the RAM of the target account in the next step. The issuer URL is
https://<portal_address>/api/v2/iauths_system/oauth2. The name and issuer URL must not conflict with any existing identity provider in that account's RAM. To check existing identity providers, see Manage OIDC IdPs.
Click Next.
In the RAM console of the target account, complete the following in order:
Configure an identity provider: Enter the parameters shown on the current page into the corresponding fields in RAM. See Manage OIDC IdPs.
Create a custom policy: Copy the access policy script from the current page and create a policy in RAM. See Create a custom policy.
Create a RAM role: Use the role name provided on the page. See Create a RAM role for a trusted identity provider.
Grant permissions to the role: Attach the access policy to the RAM role. See Manage permissions of a RAM role.
ImportantWhen granting permissions, configure a precise access policy. Grant only the minimum permissions required for your business tasks. Avoid broad authorizations such as
*:*.Click Start Detection. IDaaS checks your configurations. If any issue is found, review and fix the configuration, then run detection again.
Click Next to complete adding the account.
The account now appears on the Asset Management > Cloud Identity page. To view the system role, click Cloud Role Management in the Actions column.
If you exit the page before completing the configuration, go to Asset Management > Cloud Identity, find the account, and click Cloud Role Management > Details > Configure System Role to resume.
Add a cloud role
A cloud role is a RAM role that you bring under IDaaS management. After adding a cloud role, you can assign it to users and applications through IDaaS.
On the Asset Management > Cloud Identity page, find the target Alibaba Cloud account and click Cloud Role Management in the Actions column. If you have not added an account, you must first add an Alibaba Cloud account.
Click Add Cloud Role and configure the following:
Role Name: Select the RAM role you want to manage in IDaaS.
Trust Policy: Follow the on-screen instructions to update the trust policy in the RAM console of the Alibaba Cloud account. See Create a RAM role for a trusted identity provider or Modify the trust policy of a RAM role.
Click Confirm.
The cloud role appears on the Asset Management > Cloud Identity page under the account. Access it via Cloud Role Management.
Delete a cloud role
Before deleting a cloud role, disable it first to prevent any running applications or users from losing access unexpectedly.
On the Asset Management > Cloud Identity page, find the target account and click Cloud Role Management in the Actions column.
In the cloud role list, find the target role and click the switch in the Cloud Role Status column to disable it.
ImportantDisabling a cloud role immediately prevents applications and users from using it. Confirm the business impact before proceeding.
With the role disabled, click Delete in the Actions column to remove it.
Delete an Alibaba Cloud account
Before deleting an account, delete all user-created cloud roles associated with it.
On the Asset Management > Cloud Identity page, find the target account and click Delete in the Actions column.