All Products
Search

This Product

    Managed Security Service:Grant Managed Security Service access to cloud resources

    Document Center

    Managed Security Service:Grant Managed Security Service access to cloud resources

    Last Updated:Jun 02, 2026

    Before you use Managed Security Service, complete STS and SSO authorization to grant the service access to your cloud resources.

    STS authorization

    Service-linked role for Managed Security Service

    Alibaba Cloud Security Token Service (STS) manages temporary access permissions. Create the AliyunServiceRoleForMssp service-linked role to authorize Managed Security Service to access your cloud resources, such as ECS, Security Center, OSS, and ApsaraDB RDS.

    Important

    • If you purchased Managed Security Service from the Managed Security Service console, you are prompted to create the AliyunServiceRoleForMssp service-linked role on first logon. You can skip this step.

    • If the Service Authorization dialog box does not appear after you log on to the Managed Security Service console, the service is already authorized. To verify, open the RAM console and check for the AliyunServiceRoleForMssp role on the Identities > Roles page.

    1. Log on to the Managed Security Service console.

    2. In the Service Authorization dialog box, click Authorize and Activate.

    Service-linked role for ESA security hosting

    To enable Managed Security Service security operations for Edge Security Acceleration (ESA), create the AliyunServiceRoleForESAMssp service-linked role. This role grants Managed Security Service access to your ESA and SLS resources.

    1. Log on to the Managed Security Service console.

    2. On the Overview page, click Create ESA MSS ServiceLinkRole in the upper-right corner.

    3. In the Service Authorization dialog box, click Authorize and Activate.

    SSO authorization

    Create a RAM role that uses an IdP as the trusted entity. This enables role-based SSO between your corporate IdP and Alibaba Cloud, allowing Managed Security Service to retrieve complete data for risk assessment and security hardening of your cloud resources.

    Prerequisites

    You have the XML certificate required for Managed Security Service authorization.

    Important

    If you do not have the XML certificate, contact the delivery manager assigned to you at purchase.

    Procedure

    1. Log on to the RAM console with your Alibaba Cloud account.

    2. Create a SAML IdP.

      1. In the left-side navigation pane, choose Integrations > SSO.

      2. On the Role-based SSO tab, click the SAML tab, and then click Create IdP.

      3. On the Create IdP page, enter an IdP Name (for example, aliyun-mssp) and a Description.

      4. In the Metadata File section, click Upload Metadata File to upload the Managed Security Service XML certificate.

      5. Click Create IdP.

    3. Create a RAM role with the aliyun-mssp IdP from the previous step as the trusted entity.

      1. In the left-side navigation pane, choose Identities > Roles.

      2. On the Roles page, click Create Role.

      3. In the upper-right corner of the Create Role page, click Switch to Policy Editor.

      4. In the visual editor, specify the aliyun-mssp IdP created in step 2.

      5. The following table lists the supported service-level condition keys.

        Condition key

        Description

        Required

        Example

        saml:recipient

        Alibaba Cloud verifies this value to ensure the SAML assertion is intended for Alibaba Cloud.

        Yes

        Fixed value: https://signin.alibabacloud.com/saml-role/sso

      6. Click OK. In the Create Role dialog box, enter a Role Name (for example, aliyun-mssp), and then click OK.

    4. Grant permissions to the aliyun-mssp RAM role.

      1. On the page that appears after you create the RAM role, click Grant Permission. Alternatively, in the left-side navigation pane, choose Identities > Roles. Then, find the aliyun-mssp RAM role and click Attach Policy in the Actions column.

      2. In the Grant Permission panel, add the following permissions to the aliyun-mssp RAM role. Manage permissions for a RAM role.

        • ReadOnlyAccess: Collects and verifies security configuration data from cloud products such as ECS, OSS, ApsaraDB RDS, and SLS.

        • AliyunYundunFullAccess: Collects and verifies security configuration data from cloud security products such as Security Center, Cloud Firewall, and Web Application Firewall (WAF). Also deploys inspection rules and performs emergency responses such as blocking threats.

        • AliyunSupportFullAccess: Manages support tickets for product inquiries.

        • AliyunCloudMonitorFullAccess: Configures website monitoring in CloudMonitor.

        • AliyunECSFullAccess (Optional): Required for emergency response and maintenance on hosts, such as creating image snapshots, modifying security group policies, and applying patches.

    Revoke service authorization

    To revoke Managed Security Service authorization, remove permissions from the RAM role and then delete the role.

    1. Revoke permissions from the role. Revoke permissions from a RAM role.

    2. Delete the role. Delete a RAM role.