Grant permissions across Alibaba Cloud accounts by using a RAM role

Solution

Step 1: Create a RAM role and grant permissions to the role

1. Use the Alibaba Cloud account of Enterprise A to log on to the RAM console and then create a RAM role for the Alibaba Cloud account of Enterprise B.
   For more information, see Create a RAM role for a trusted Alibaba Cloud account.
2. Optional:Create a custom policy for the RAM role by using the Alibaba Cloud account of Enterprise A.

   For more information, see Create a custom policy.

   Message Queue for Apache RocketMQ allows you to configure permissions for instances, topics, and groups. For more information, see Policies and examples.

3. The RAM role that is created in Step 1 does not have permissions. Therefore, Enterprise A must grant permissions to the RAM role. Enterprise A can attach a system policy or a custom policy to the RAM role.
   For more information, see Grant permissions to a RAM role.
4. Use the Alibaba Cloud account of Enterprise B to log on to the RAM console and then create a RAM user.

   For more information, see Create a RAM role for a trusted Alibaba Cloud account.

5. Enterprise B attaches the AliyunSTSAssumeRoleAccess permission policy to the RAM user.

   For more information, see Grant permissions to a RAM user.

   Enterprise B must attach the AliyunSTSAssumeRoleAccess permission policy to a RAM user of Alibaba Cloud account B. This way, the RAM user can assume the RAM role that is created by Enterprise A.

Step 2: Access resources across Alibaba Cloud accounts

• Access resources by using SDKs
  RAM users of Enterprise B can access the Message Queue for Apache RocketMQ resources of Enterprise A and publish and subscribe to messages by using SDKs. To access resources by using SDKs, you can use one of the following two methods to configure the SDK code:

  • Configure the SDK code by using a token that is generated by Security Token Service (STS): When you configure the SDK code by using a token that is generated by STS, you must provide the AccessKey ID and AccessKey secret of the RAM user and the temporary security token that is generated by STS for the RAM user. The temporary security token must be updated on a regular basis. For more information about how to obtain a temporary security token by using STS, see AssumeRole.
    Notice This method is applicable only to Message Queue for Apache RocketMQ SDK for Java V 1.7.8. Final or later.
    Example of configuring the SDK code by using a token that is generated by STS

    • When you initialize the Message Queue for Apache RocketMQ client, specify the AccessKey ID, AccessKey secret, and security token as shown in the following code:

      Properties properties = new Properties();
      // The AccessKey ID of the RAM user. 
      properties.put(PropertyKeyConst.AccessKey, "STS.XXX");
      // The AccessKey secret of the RAM user. 
      properties.put(PropertyKeyConst.SecretKey, "XXX");
      // The security token that is generated by STS for the RAM user. 
      properties.put(PropertyKeyConst.SecurityToken, "XXX");
      // Other attributes. 
      properties.put(PropertyKeyConst.NAMESRV_ADDR, "XXX");
      ......
      Producer client = ONSFactory.createProducer(properties);
      client.start();                    

    • If the security token expires, call the updateCredential method to dynamically update the token.

      Properties properties = new Properties();
      // The AccessKey ID of the RAM user. 
      properties.put(PropertyKeyConst.AccessKey,"STS.XXX");
      // The AccessKey secret of the RAM user. 
      properties.put(PropertyKeyConst.SecretKey, "XXX");
      // The security token that is generated by STS for the RAM user. 
      properties.put(PropertyKeyConst.SecurityToken, "XXX");
      client.updateCredential(properties);                    

  • Configure the SDK code by using the RAM role that is assigned to your Elastic Compute Service (ECS) instance: If a RAM role is assigned to your ECS instance, you do not need to provide the AccessKey ID, AccessKey secret, or security token of the RAM user in the SDK code. You only need to enter the name of the RAM role. This simplifies code configuration. However, you must assign the RAM role to the ECS instance where your application is deployed to grant the permissions of the RAM role to the ECS instance. For more information, see Bind an instance RAM role.
    Notice This method is applicable only to Message Queue for Apache RocketMQ SDK for Java 1.8.7.3. Final or later.
    Example of configuring the SDK code by using the RAM role that is assigned to your ECS instance

    Properties properties = new Properties();
    // The name of the RAM role that you create and assign to the ECS instance. 
    properties.put(PropertyKeyConst.RAM_ROLE_NAME,"XXX");

• Access resources in the console
  RAM users of Enterprise B can log on to the console to access Message Queue for Apache RocketMQ resources of Enterprise A by performing the following steps.

  1. Open the RAM Account Login page in your browser.
  2. On the RAM Account Login page, enter the logon name of the RAM user, and then click Next. Enter the password, and then click Log On.
     Note The logon name of the RAM user is in the format of <$username>@<$AccountAlias> or <$username>@<$AccountAlias>.onaliyun.com. <$AccountAlias> is the account alias. If an account alias is not specified, the ID of the Alibaba Cloud account is used by default.
  3. In the upper-right corner of the homepage of the console, move the pointer over the profile icon and click Switch Identity.
  4. On the Switch Role page, enter the alias, domain name, or Alibaba Cloud account ID of Enterprise A. Enter a role name, and then click Submit.
  5. Manage the Message Queue for Apache RocketMQ resources of Enterprise A.
• Access resources by calling API operations

  RAM users of Enterprise B can access the resources of Enterprise A by calling the API operations provided by Message Queue for Apache RocketMQ. For more information about how to call an API operation, see Make API requests.

References

• Grant permissions to RAM users
• Policy overview
• What is RAM?
• Terms
• Create a custom policy
• Create a RAM user
• Grant permissions to a RAM user
• Bind an instance RAM role