Microservices Engine:Grant permissions to manage cloud-native gateways

Scenario

An enterprise creates a cloud-native gateway in the MSE console. The enterprise needs to grant different permissions on resources to employees based on their roles. The enterprise has the following requirements:

• To ensure data security, the AccessKey pair of the Alibaba Cloud account of the enterprise must be kept confidential. The enterprise wants to grant permissions to the account of each user.

• Only users who are granted permissions can manage resources. Resource usage and costs are not calculated separately for each user. Bills are generated on the Alibaba Cloud account of the enterprise.

• The owner of the Alibaba Cloud account can revoke the permissions that are granted to users and delete the accounts that are created for users.

• A cloud-native gateway of MSE is a fully managed service that provides two roles: developer and O&M. Developers are responsible for configuration and service management. O&M personnel are responsible for cluster and permission management.

Usage notes

You can grant permissions to a RAM user by using the Resource Access Management (RAM) console or calling an API operation.

Step 1: Create a RAM user

Log on to the RAM console and create a RAM user by using your Alibaba Cloud account.

1. Log on to the RAM console with your Alibaba Cloud account.

2. In the left-side navigation pane, choose Identities > Users.

3. On the Users page, click Create User.

4. In the User Account Information section of the Create User page, configure the following parameters:

   • Logon Name: The logon name can be up to 64 characters in length, and can contain letters, digits, periods (.), hyphens (-), and underscores (_).

   • Display Name: The display name can be up to 128 characters in length.

   • (Optional) Tag: You can click the icon. In the dialog box that appears, specify the Tag Key and Tag Value parameters. You can add one or more tags to the RAM user. This way, you can manage the RAM user based on the tags.

   Note

   You can click Add User to create multiple RAM users at a time.

5. In the Access Mode section, select Console Access or OpenAPI Access.

   • Console Access: If you select this access mode, you must configure the basic settings for logon security. These settings specify whether to use a system-generated logon password or a custom logon password, whether to reset the password on the next logon, and whether to enable multi-factor authentication (MFA).

     Note

     If you select Reset Custom Password in the Console Password section, you must specify a password. The password must meet the complexity requirements that you specified on the Identities > Settings page. For more information about the password complexity requirements, see Configure a password policy for RAM users.

   • OpenAPI Access: If you select this access mode, an AccessKey pair is automatically created for the RAM user. The RAM user can call API operations or use other development tools to access Alibaba Cloud resources.

   Note

   To ensure account security, we recommend that you select only one access mode for the RAM user. This way, the user who uses the RAM user can no longer use an AccessKey pair to access Alibaba Cloud resources after the user leaves your organization.

6. Click OK.

Step 2: Grant permissions to the RAM user

Before you use a RAM user, perform the following steps to grant permissions to the RAM user:

1. Log on to the RAM console with an Alibaba Cloud account.
2. In the left-side navigation pane, choose Identities > Users.
3. On the Users page, find the RAM user to which you want to attach the custom policy, and click Add Permissions in the Actions column.

4. In the Add Permissions panel, grant permissions to the RAM user and click OK.

   1. Select the authorization scope.
      • Alibaba Cloud Account: The permissions take effect on the current Alibaba Cloud account.
      • Specific Resource Group: The permissions take effect in a specific resource group.
        Note If you select Specific Resource Group for Authorized Scope, you must make sure that the required cloud service supports resource groups. For more information, see Services that work with Resource Group.
   2. Specify the principal.
      The principal is the RAM user to which you want to grant permissions.

   3. Attach policies to the RAM user.

      In the Select Policy section, select a policy type, and enter a keyword in the field to search for the policies that you want to add. Then, click one or more policies to add the policies to the Selected list.

      Policies are classified into system polices and custom policies.

      • System policies for coarse-grained authorization

        MSE supports two system policies for coarse-grained authorization. The following table describes the policies.

        Policy	Description
        AliyunMSEFullAccess	The permissions to manage MSE. You can use a RAM user to which this policy is attached to manage all features in the MSE console the same way you use an Alibaba Cloud account to manage MSE.
        AliyunMSEReadOnlyAccess	The read-only permissions on the resources of MSE. A RAM user to which this policy is attached can only read all MSE resources of the Alibaba Cloud account.

        Note

        We recommend that you attach the AliyunMSEFullAccess policy to O&M personnel. This way, O&M personnel can create and delete resources. We recommend that you attach the AliyunMSEReadOnlyAccess policy to developers. This way, developers can view resources but cannot delete or create resources. If you want to manage the permissions of developers in a fine-grained manner, you can use custom policies.

      • Custom policies for fine-grained authorization

        If you want to perform fine-grained authorization, you can create custom policies for access control. For more information about how to create a custom policy, see Create a custom policy.

        • Example 1: Grant a RAM user the read and write permissions on the cloud-native gateway named gw-f23fcdca44c84769a6652245ecc****.

          {
            "Statement": [
              {
                "Action": [
                  "mse:*"
                ],
                "Resource": "acs:mse:*:*:instance/gw-f23fcdca44c84769a6652245ecc****",
                "Effect": "Allow"
              }
            ],
            "Version": "1"
          }

        • Example 2: Grant a RAM user the read-only permissions on all cloud-native gateways.

          {
            "Statement": [
              {
                  "Action": [
                  "mse:List*",
                  "mse:Query*",
                  "mse:Get*",
                  "mse:Pull*"
                ],
                "Resource": "acs:mse:*:*:*",
                "Effect": "Allow"
              }
            ],
            "Version": "1"
          }

        • Example 3: Grant a RAM user the operation permissions on the resources that are prompted by the MSE console.

           {
            "Statement": [
              {
                  "Action": [
                  "mse:UpdateGatewayName"
                ],
                "Resource": "acs:mse:cn-hangzhou:{ID of an Alibaba Cloud account}:instance/{ID of a cloud-native gateway} ",
                "Effect": "Allow"
              }
            ],
            "Version": "1"
          }

5. In the Add Permissions panel, view the summary of the authorization information in the Authorization Result section and click Complete.

What to do next

References

The following table describes the API operations that are supported by MSE cloud-native gateways to help you configure custom policies for RAM users.

• API operations to manage cloud-native gateways

  Action	Description	Read-only
  AddGateway	Creates a pay-as-you-go cloud-native gateway.	No
  ListGateway	Queries gateway clusters.	Yes
  GetGatewayDetail	Queries the details of a cloud-native gateway.	Yes
  GetGateway	Queries the information about a cloud-native gateway.	Yes
  ListGatewaySlb	Queries the Server Load Balancer (SLB) instances of a cloud-native gateway.	Yes
  SelectGatewaySlb	Queries existing SLB instances.	No
  AddGatewaySlb	Associates an SLB instance with a cloud-native gateway.	No
  DeleteGatewaySlb	Disassociates an SLB instance from a cloud-native gateway.	No
  DeleteGateway	Deletes a pay-as-you-go cloud-native gateway.	No

• API operations to manage service sources

  Action	Description	Read-only
  ListServiceSource	Queries service sources.	Yes
  GetKubernetesSource	Queries existing Container Service for Kubernetes (ACK) clusters.	Yes
  GetMseSource	Queries existing MSE registries.	Yes
  AddServiceSource	Adds a service source.	No
  DeleteServiceSource	Removes a service source.	No
  PullServices	Queries existing services.	Yes
  ImportServices	Creates or imports services.	No
  ListGatewayService	Queries the services to which you subscribe.	Yes
  GetGatewayServiceDetail	Queries the details of a service.	Yes
  AddGatewayServiceVersion	Adds a service version.	No
  UpdateGatewayServiceVersion	Updates a service version.	No
  DeleteGatewayServiceVersion	Removes a service version.	No
  UpdateGatewayServiceTrafficPolicy	Modifies the load balancing policy of a service.	No

• API operations to manage routes

  Action	Description	Read-only
  ListGatewayRoute	Queries the routes of a cloud-native gateway.	Yes
  AddGatewayRoute	Creates a route for a cloud-native gateway.	No
  ApplyGatewayRoute	Publishes a route for a cloud-native gateway.	No
  OfflineGatewayRoute	Disables a route for a cloud-native gateway.	No
  DeleteGatewayRoute	Deletes a route from a cloud-native gateway.	No
  GetGatewayRouteDetail	Queries the details of routes for a cloud-native gateway.	Yes
  GetRateLimit	Queries the throttling rules of a route.	Yes
  AddRateLimit	Adds a throttling rule to a route.	No
  UpdateRateLimit	Deletes a throttling rule from a route.	No
  UpdateGatewayRouteHTTPRewrite	Updates the rewrite policy of a route.	No
  UpdateGatewayRouteHeaderOp	Updates the header settings of a route.	No
  UpdateGatewayRouteCORS	Updates the cross-origin resource sharing (CORS) policy of a route.	No
  UpdateGatewayRouteTimeout	Updates the timeout policy of a route.	No
  UpdateGatewayRouteRetry	Updates the retry policy of a route.	No

• API operations to manage certificates and domain names

  Action	Description	Read-only
  ListGatewayDomain	Queries associated domain names.	Yes
  AddGatewayDomain	Associates a domain name.	No
  GetGatewayDomainDetail	Queries the details of associated domain names.	Yes
  UpdateGatewayDomain	Updates the information about an associated domain name.	No
  DeleteGatewayDomain	Disassociates a domain name.	No
  ListSSLCert	Queries existing certificates.	Yes
  AddSSLCert	Associates a certificate with a domain name.	No
  UpdateSSLCert	Updates the certificate of a domain name.	Yes

• Other API operations

  Action	Description	Read-only
  GetBlackWhiteList	Queries the IP addresses in the blacklist and whitelist.	Yes
  AddBlackWhiteList	Adds an IP address to the blacklist or whitelist.	No
  UpdateBlackWhiteList	Updates the blacklist and whitelist.	No
  AddGatewayAuth	Adds an authentication method.	No
  ListGatewayAuth	Queries authentication methods.	Yes
  UpdateGatewayAuth	Updates an authentication method.	No
  DeleteGatewayAuth	Removes an authentication method.	No
  AddAuthResource	Adds an authentication URL.	No
  DeleteAuthResource	Deletes an authentication URL.	No