All Products
Search

This Product

    CloudOps Orchestration Service:Create and authorize a RAM role for OOS

    Document Center

    CloudOps Orchestration Service:Create and authorize a RAM role for OOS

    Last Updated:Apr 10, 2026

    CloudOps Orchestration Service (OOS) requires different API permissions to run different templates. Use the OOS API operation GenerateExecutionPolicy to determine the permissions a template requires, which helps you follow the principle of least privilege. Alternatively, you can grant the OOS service role FullAccess permissions for other cloud services. This topic describes how to configure permissions for OOS to access other cloud services.

    Background information

    Note

    If you want to authorize users to access OOS, you can perform access control. For more information, see Access control.

    OOS uses temporary Security Token Service (STS) tokens to access the APIs of other cloud services. You must authorize OOS to access your resources by assuming a RAM role.

    • If no RAM role is specified in a template, OOS uses the permissions of the current Alibaba Cloud account.

    • If a RAM role is specified in a template, OOS assumes the specified role.

    Procedure

    Step 1: Create a RAM role assumed by OOS

    1. Go to the RAM console>Identities>Roles page and click Create Role.

    2. On the Create Role page, set Principal Type to Cloud Service, set Principal Name to CloudOps Orchestration Service, and then click OK.

      创建角色

      Note

      Available Alibaba Cloud services for the Principal Name parameter are subject to the RAM console.

    3. In the dialog box that appears, specify a role name and click OK.

    Step 2: Grant permissions to the RAM role assumed by OOS

    After a RAM role is created, the RAM role has no permissions. You need to grant permissions to the RAM role.

    1. Go to the RAM console> Identities> Roles page.

    2. In the role list, find the RAM role that you created for OOS, such as OOSServiceRole, and in the Actions column, click Grant Permission.

    3. In the Grant Permission panel, set the parameters to create a policy for the RAM role and click Grant permissions.

      授权

      Parameters:

      • Principal: The system automatically selects the current RAM role by default.

      • Policy: Select the policies required by the CloudOps Orchestration Service template that you want to run. To obtain the required policies, see Obtain the RAM policy required to execute a template. For example, the AliyunECSFullAccess system policy allows the role to run tasks related to ECS APIs.

    4. After the permissions are granted to the user, click Close.