This topic describes how to use Resource Access Management (RAM) to authorize CloudOps Orchestration Service (OOS) to access other cloud services. If you want to authorize users to access OOS, you can perform access control. For more information, see Access control.
OOS uses temporary Security Token Service (STS) tokens to access the APIs of other cloud services. You must authorize OOS to access your resources by assuming a RAM role.
If no RAM role is specified in a template, OOS assumes the default role OOSServiceRole.
If a RAM role is specified in a template, OOS assumes the specified role.
Temporary tokens are updated on a periodic basis.
Required permissions for OOS
The set of cloud service API-specific permissions varies based on the specified OOS template to be executed. You can call the GenerateExecutionPolicy operation of OOS to obtain a set of permissions that are required to execute a specific template. Then, grant the RAM role the required permissions to execute the template based on the principle of least privilege. You can also grant all the permissions to access the related cloud services to the RAM role.
Create a RAM role for OOS
For more information, see Create a RAM role for a trusted Alibaba Cloud service. To create a RAM role for OOS, perform the following steps:
On the Create Role page, select Alibaba Cloud Service as the trusted entity and click Next.
Select Normal Service Role as the role type and enter a role name. Select CloudOps Orchestration Service as the trusted service. You can specify this role in a template. If no RAM role is specified in a template, OOS assumes the default role OOSServiceRole.
Click OK.
Attach the required policy to the OOS-trusted role
For more information, see Grant permissions to a RAM role. To attach the required policy to the OOS-trusted role, perform the following steps:
Log on to the RAM console by using your Alibaba Cloud account.
In the left-side navigation pane, choose Identities > Roles.
On the Roles page, find the RAM role to which you want to grant permissions and click Grant Permission in the Actions column.
In the Grant Permission panel, grant permissions to the RAM role.
Principal: Select the RAM role that you created, such as OOSServiceRole.
Select Policy: Select one or more policies based on the permissions that are required to execute an OOS template. For example, you can attach the AliyunECSFullAccess policy to the RAM role. This allows the role to execute tasks that involve calling the Elastic Compute Service (ECS) API.
Click Grant permissions.