All Products
Search

This Product

    CloudOps Orchestration Service:Create and authorize a RAM role for OOS

    Document Center

    CloudOps Orchestration Service:Create and authorize a RAM role for OOS

    Last Updated:Sep 10, 2026

    CloudOps Orchestration Service (OOS) requires different API permissions to run different templates. Use the OOS API operation GenerateExecutionPolicy to retrieve the permissions each template requires, applying least privilege. Alternatively, grant the OOS service role FullAccess permissions for other cloud services. The following steps grant OOS access to other cloud services.

    Background

    Note

    To grant a RAM user (sub-account) the permissions to access OOS, see Account access control.

    OOS uses temporary Security Token Service (STS) tokens to access other cloud service APIs. Authorize OOS to access your resources by assuming a RAM role.

    • If no RAM role is specified, OOS uses the existing permissions of the account that runs the template.

    • If a RAM role is specified, OOS assumes the role that you specify.

    Procedure

    Step 1: Create a RAM role assumed by OOS

    1. Go to the RAM console>Identities>Roles page and click Create Role.

    2. On the Create Role page, set Principal Type to Cloud Service, set Principal Name to CloudOps Orchestration Service, and then click OK.

      Note

      Available services for Principal Name parameter depend on the RAM console.

    3. In the dialog box that appears, specify a role name and click OK.

    Step 2: Grant permissions to the RAM role

    A newly created RAM role has no permissions. Grant permissions to the RAM role.

    1. Go to the RAM console>Identities>Roles page.

    2. In the role list, find the RAM role that you created for OOS (for example, OOSServiceRole). In the Actions column, click Attach Policy.

    3. In the Attach Policy panel, set the parameters to attach permission policies to the RAM role and click Grant permissions. The following section describes the main parameters:

      • Principal: Automatically set to the current RAM role, which is the OOS service role.

      • Policies: Select the policies the CloudOps Orchestration Service template requires. Obtain the RAM policy required to execute a template. For example, AliyunECSFullAccess grants access to all ECS APIs.

    4. After granting permissions, click close.