All Products
Search

This Product

    Simple Message Queue (formerly MNS):Cross-account push authorization

    Document Center

    Simple Message Queue (formerly MNS):Cross-account push authorization

    Last Updated:Jun 04, 2026

    Configure cross-account push authorization for ApsaraMQ for MNS topics to enable message delivery across Alibaba Cloud accounts.

    Prerequisites

    You must have two Alibaba Cloud accounts: Account A and Account B.

    • Alibaba Cloud account A: The account ID is testAccountID.

    • Alibaba Cloud account B: The account ID is testAccountID1.

    This example uses Account A to push messages to Account B.

    Step 1: Create a RAM role for Account B

    1. Create a Resource Access Management (RAM) role that Account A can assume.

      1. Log on to the RAM console with Alibaba Cloud account B or a RAM user with administrative permissions.

      2. In the left-side navigation pane, choose Identities > Roles.

      3. On the Roles page, click Create Role.

      4. On the Create Role page, set the Principal Type to Cloud Service, select the Alibaba Cloud service, and then click OK.

      5. In the Create Role dialog box, enter a role name and click OK.

    2. Modify the trust policy of the RAM role.

      1. On the Trust Policy tab, click Edit Trust Policy.

      2. Modify the trust policy in the editor and click OK.

        Note

        Change "Service": "mns.aliyuncs.com" to "Service": "testAccountID@mns.aliyuncs.com". Replace testAccountID with the ID of Alibaba Cloud account A.

    Step 2: Grant cross-account permissions to the RAM role

    Push to an ApsaraMQ for MNS queue

    1. Log on to the RAM console with Alibaba Cloud account B or a RAM user with administrative permissions.

    2. In the left-side navigation pane, choose Permissions > Policies.

    3. On the Policies page, click Create Policy.

    4. On the Create Policy page, click the Visual Editor tab.

    5. Configure the permission policy and click OK.

      1. For Effect, select Allow.

      2. For Service, select ApsaraMQ for MNS.

      3. For Action, select Select action(s), and then select the mns:SendMessage checkbox in the Write section.

      4. For Resource, select All resource(s) or Specified resource(s).

    6. In the Create Policy dialog box, enter a Policy Name name and Description, and then click OK.

    7. In the left-side navigation pane, choose Identities > Roles.

    8. On the Roles page, click the name of the RAM role created in Step 1.

    9. On the Permissions tab, click Precise Permission.

    10. In the Precise Permission dialog box, configure the following settings and click OK:

      • policy type: Select {type}.

      • Policy Name: Enter the custom policy name.

    Push to Function Compute

    1. Log on to the RAM console with Alibaba Cloud account B or a RAM user with administrative permissions.

    2. In the left-side navigation pane, choose Identities > Roles.

    3. On the Roles page, click the name of the RAM role created in Step 1.

    4. On the Permissions tab, click Add Permissions.

    5. In the Add Permissions panel, configure the following settings and click OK.

      • Resource Scope: Select Account.

      • Policies: Select the AliyunFCInvocationAccess checkbox.

    Push to Message Queue for Apache Kafka

    1. Log on to the RAM console with Alibaba Cloud account B or a RAM user with administrative permissions.

    2. In the left-side navigation pane, choose Permissions > Policies.

    3. On the Policies page, click Create Policy.

    4. On the Create Policy page, click the JSON Editor tab, replace the content with the following policy, and then click OK.

      {
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "eventbridge:*EventStreaming",
      "Resource": "*"
    }
  ]
}

    5. In the Create Policy dialog box, enter a Policy Name name and Description, and then click OK.

    6. In the left-side navigation pane, choose Identities > Roles.

    7. On the Roles page, click the name of the RAM role created in Step 1.

    8. On the Permissions tab, click Precise Permission.

    9. In the Precise Permission dialog box, configure the following settings and click OK:

      • policy type: Select {type}.

      • Policy Name: Enter the custom policy name.

    Step 3: Obtain the ARN of the RAM role

    Note

    When Account A creates a cross-account subscription, enter the RAM role ARN in the Service-linked Role field.

    1. Log on to the RAM console with Alibaba Cloud account B or a RAM user with administrative permissions.

    2. In the left-side navigation pane, choose Identities > Roles.

    3. On the Roles page, click the name of the RAM role created in Step 1.

    4. In the Basic Information section, click Copy next to the ARN.

    Related topics

    Cross-account subscription guides for ApsaraMQ for MNS: