Use access control to manage access to OOS resources at the account level - CloudOps Orchestration Service

Use Resource Access Management (RAM) to control access to CloudOps Orchestration Service (OOS) resources at the account level by creating RAM users or RAM groups and attaching specific permission policies.

Use cases

RAM is an access control service provided by Alibaba Cloud. Common use cases for controlling access to OOS include:

System O&M administrator: You can create an CloudOps Orchestration Service administrator and grant this administrator group full permissions for CloudOps Orchestration Service, including the ability to create, edit, and execute templates.
Template developer: Template developers need permissions to edit templates. You can grant a policy to a developer or developer group that allows members to call actions such as CreateTemplate and UpdateTemplate.
Template operator: You can restrict users to only running OOS templates.
Template-level authorization: You can authorize specific RAM users or RAM groups to run a template.

Grant the PassRole permission to a RAM user

Note

After you set a RAM role for the OOS service and grant it permissions, only CloudOps Orchestration Service is authorized to use this RAM role. Sub-accounts of CloudOps Orchestration Service are not automatically authorized. A sub-account can use the target RAM role through CloudOps Orchestration Service only after it is granted the PassRole permission for the target RAM role.

To allow a sub-account to use all RAM roles that are entrusted to CloudOps Orchestration Service, create the following policy and grant it to the sub-account.

Policy to grant the PassRole permission

{
  "Version": "1",
  "Statement": [
    {
      "Action": "ram:PassRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "acs:Service": "oos.aliyuncs.com"
        }
      }
    }
  ]
}

For security purposes, you may need to restrict a sub-account to a specific RAM role (such as the default OOSServiceRole) when using CloudOps Orchestration Service. In this case, create the following policy.
Policy to restrict which RAM role can be passed
```
{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ram:PassRole",
      "Resource": "acs:ram::{parent_uid}:role/OOSServiceRole"
    }
  ]
}
```

Notes:

If a RAM role is hardcoded in a template (for example, the default OOSServiceRole) and is not passed as a parameter, the RAM user does not need the PassRole permission to run the template but needs it to create or update the template.
If a RAM role is dynamically specified as a parameter during template execution and the template itself does not define a RAM role, the RAM user does not need the PassRole permission to create or update the template but needs it to run the template with the specified role.
In the preceding policies, replace {parent_uid} with your Alibaba Cloud account ID.

Policies

Step 1: Create a custom policy

Log on to the RAM console.
In the left-side navigation pane, choose Permissions > Policies.
Click Create Policy.

Click the JSON tab, paste the policy content, and then click OK.

Example 1: Allow a RAM user to run templates but not edit them

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "oos:List*",
                "oos:Get*",
                "oos:StartExecution",
                "oos:CancelExecution",
                "oos:NotifyExecution"
            ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

Example 2: Allow a RAM user to create and edit templates but not run them

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "oos:List*",
                "oos:Get*",
                "oos:CreateTemplate",
                "oos:UpdateTemplate",
                "oos:ValidateTemplateContent"
            ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

Example 3: Administrator permissions for CloudOps Orchestration Service

{
    "Version": "1",
    "Statement": [
        {
            "Action": "oos:*",
            "Effect": "Allow",
            "Resource": "*"
        },
        {
            "Action": "ram:PassRole",
            "Resource": "*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "acs:Service": "oos.aliyuncs.com"
                }
            }
        }
    ]
}

On the Create Policy page, enter a name and description, and then click OK.

After the policy is created, click Policy Details to view its information. To modify the policy, click Modify Policy Document.

Step 2: Grant permissions to a RAM user

In the left-side navigation pane, choose Identities > Users.
Find the target RAM user and click Add Permissions in the Actions column.
In the Policies section, select the required system or custom policies.
Click OK.