Cross-account access to OSS using a RAM role - Object Storage Service

By default, only the owner of an Object Storage Service (OSS) resource can access it. You can use a Resource Access Management (RAM) role and the role assumption feature to securely grant cross-account access to your OSS resources. This is useful for business scenarios that require collaboration between internal departments or access for external partners.

Solution overview

For example, to grant Alibaba Cloud Account B access to resources owned by Account A, you can follow these core steps:

Account A creates a RAM role that trusts Account B and grants the role permissions to access OSS.
Account B grants a RAM user the permission to assume roles. The user then assumes the RAM role of Account A to access the specified OSS resources.

Implementation

Step 1: Create a RAM role and grant permissions

Account A must create a RAM role that trusts Account B and assign OSS access permissions to the role. After the configuration is complete, Account B can securely access the OSS resources of Account A by assuming this role.

Create a RAM role
1. Go to the RAM Roles page and click Create Role.
2. For Principal Type, select Cloud Account. For Principal Name, select Other Alibaba Cloud Account, and enter the ID of Alibaba Cloud Account B, such as 170593091407****.
  
  Note
  After the RAM role is created, it can be assumed by all RAM users and RAM roles that belong to Account B by default. If you want to allow only specific RAM users or roles to assume this role, you must modify the trust policy of the RAM role. For more information, see Modify the trusted entity of a RAM role to an Alibaba Cloud account.
3. Click OK. Enter a role name, and then click OK to create the role.
Grant permissions to the RAM role

The following steps describe how to grant permissions using the read-only system policy for OSS. To grant a custom policy, see Grant a custom policy.
1. Go to the RAM Roles page. Locate the target RAM role, and in its Actions column, click Attach Policy.
2. Search for and select the AliyunOSSReadOnlyAccess policy, and then click OK.

Step 2: Assume the RAM role for cross-account access

Account B must create a RAM user or use an existing one, and grant the user permission to assume roles. After the permission is granted, the RAM user can assume the RAM role of Account A to access the OSS resources.

Create a RAM user
1. Go to the RAM Users page and click Create User.
2. Enter a Logon Name and select an Access Mode. For this example, select Console Access.
3. Click OK to create the user.
Grant the RAM user permission to assume roles
1. Go to the RAM Users page. Locate the target RAM user, and in its Actions column, click Add Permissions.
2. Search for and select the AliyunSTSAssumeRoleAccess policy, and then click OK.

Step 3: Verify cross-account access

After you configure the permissions, you can use the RAM user of Account B to access the OSS resources of Account A. The following steps describe how to verify access from the console.

Go to the Alibaba Cloud logon page and log on as the RAM user from Account B.
In the upper-right corner, click your profile picture and then click Switch Identity. Enter the information for Alibaba Cloud Account A and the RAM role name, and then click Submit.
Go to the Buckets page to access the OSS resources authorized by Account A.

References

Use a bucket policy for cross-department data sharing