Cross-account push authorization | ApsaraMQ for MNS - Simple Message Queue (formerly MNS)

Configure cross-account push authorization for ApsaraMQ for MNS topics to enable message delivery across Alibaba Cloud accounts.

Prerequisites

You must have two Alibaba Cloud accounts: Account A and Account B.

This example uses Account A to push messages to Account B.

Create a Resource Access Management (RAM) role that Account A can assume.
1. Log on to the RAM console with Alibaba Cloud account B or a RAM user with administrative permissions.
2. In the left-side navigation pane, choose Identities > Roles.
3. On the Roles page, click Create Role.
4. On the Create Role page, set the Principal Type to Cloud Service, select the Alibaba Cloud service, and then click OK.
5. In the Create Role dialog box, enter a role name and click OK.
Modify the trust policy of the RAM role.
1. On the Trust Policy tab, click Edit Trust Policy.
2. Modify the trust policy in the editor and click OK.
  Note
  Change "Service": "mns.aliyuncs.com" to "Service": "testAccountID@mns.aliyuncs.com". Replace testAccountID with the ID of Alibaba Cloud account A.

Log on to the RAM console with Alibaba Cloud account B or a RAM user with administrative permissions.
In the left-side navigation pane, choose Permissions > Policies.
On the Policies page, click Create Policy.
On the Create Policy page, click the Visual Editor tab.
Configure the permission policy and click OK.
1. For Effect, select Allow.
2. For Service, select ApsaraMQ for MNS.
3. For Action, select Select action(s), and then select the mns:SendMessage checkbox in the Write section.
4. For Resource, select All resource(s) or Specified resource(s).
In the Create Policy dialog box, enter a Policy Name name and Description, and then click OK.
In the left-side navigation pane, choose Identities > Roles.
On the Roles page, click the name of the RAM role created in Step 1.
On the Permissions tab, click Precise Permission.
In the Precise Permission dialog box, configure the following settings and click OK:
- policy type: Select Custom Policy.
- Policy Name: Enter the custom policy name.

Log on to the RAM console with Alibaba Cloud account B or a RAM user with administrative permissions.
In the left-side navigation pane, choose Identities > Roles.
On the Roles page, click the name of the RAM role created in Step 1.
On the Permissions tab, click Add Permissions.
In the Add Permissions dialog box, configure the following settings and click OK.
- Resource Scope: Select Account.
- Policies: Select the AliyunFCInvocationAccess checkbox.

Log on to the RAM console with Alibaba Cloud account B or a RAM user with administrative permissions.
In the left-side navigation pane, choose Permissions > Policies.
On the Policies page, click Create Policy.

On the Create Policy page, click the JSON Editor tab, replace the content with the following policy, and then click OK.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "eventbridge:*EventStreaming",
      "Resource": "*"
    }
  ]
}

In the Create Policy dialog box, enter a Policy Name name and Description, and then click OK.
In the left-side navigation pane, choose Identities > Roles.
On the Roles page, click the name of the RAM role created in Step 1.
On the Permissions tab, click Precise Permission.
In the Precise Permission dialog box, configure the following settings and click OK:
- policy type: Select Custom Policy.
- Policy Name: Enter the custom policy name.

Note

When Account A creates a cross-account subscription, enter the RAM role ARN in the Service-linked Role field.

Log on to the RAM console with Alibaba Cloud account B or a RAM user with administrative permissions.
In the left-side navigation pane, choose Identities > Roles.
On the Roles page, click the name of the RAM role created in Step 1.
In the Basic Information section, click Copy next to the ARN.