Cross-account access by using a RAM role - Resource Access Management

To authorize another enterprise to manage your business operations, use RAM roles to grant cross-account access to your resources.

Scenarios

Company A uses various Alibaba Cloud resources for its business, such as ECS instances, ApsaraDB RDS instances, SLB instances, and OSS buckets. Company A wants to:

Delegate the responsibility for operating and managing its resources to Company B.
Eliminate the need for Company A to manage permissions when Company B's employees join or leave. Company B can independently grant its own employees and applications fine-grained access to Company A's resources.
Revoke the authorization for Company B at any time if the contract is terminated.

Solution

Assume Company A has an Alibaba Cloud account (Account A, A@company-a.onaliyun.com) and Company B has an Alibaba Cloud account (Account B, B@company-b.onaliyun.com). You can use a RAM role to allow Account B to access resources in Account A.

In Account A, create a RAM role that specifies all RAM identities in Account B as the trusted entity, and grant the RAM role appropriate permissions, such as the permission to manage ECS instances. In Account B, create a RAM user and grant the RAM user permission to access resources in Account A by assuming the role. Account A only needs to define the trusted entity and the permissions for the RAM role, while Account B manages which of its RAM users can assume the role.

For more information, see Grant permissions across Alibaba Cloud accounts .
If the partnership between Company A and Company B ends, Account A only needs to revoke Account B's permission to assume the RAM role. After the revocation, no RAM users in Account B can assume the role to access resources in Account A.

For more information, see Revoke permissions across Alibaba Cloud accounts.

Grant permissions across Alibaba Cloud accounts

In Account A, create a RAM role that specifies Account B as the trusted entity.
1. Log on to the RAM console by using Account A.
2. On the Roles page, create a RAM role.
  
  For Principal Type, select Cloud Account. For Principal Name, select Other Account and enter the ID of Account B. For more information, see Create a RAM role for a trusted Alibaba Cloud account and Modify basic information about an account.
From Account A, grant permissions to the RAM role.

On the Roles page or the Grants page, attach a system policy or custom policy to the RAM role. You must follow the principle of least privilege and grant only the necessary permissions. For example, if you want the RAM role to manage ECS instances, you can attach the AliyunECSFullAccess system policy. For more information, see Manage permissions for a RAM role.
In Account B, create a RAM user.
1. Log on to the RAM console by using Account B.
2. On the Users page, create a RAM user.
  
  For more information, see Create a RAM user.
In Account B, grant the RAM user permission to assume the role.

On the Users page or the Grants page, attach the AliyunSTSAssumeRoleAccess system policy to the RAM user. For more information, see Manage RAM user permissions.
A RAM user in Account B can access the authorized resources in Account A by assuming the role.

You can assume the role in one of the following ways:
- Assume a RAM role in the console
  
  After logging on to the console, the user can assume the RAM role by choosing Switch Identity.
- Assume a RAM role by using the API
  
  The RAM user calls the AssumeRole API operation with an AccessKey pair to obtain an STS token for the RAM role.

Revoke permissions across Alibaba Cloud accounts

Account A can revoke Account B's permission to assume the RAM role. Choose one of the following methods:

Modify the trust policy of the RAM role
1. Log on to the RAM console by using Account A.
2. On the Roles page, modify the trust policy of the role.
  
  Modify the Principal field to revoke trust for Account B. For more information, see Modify the trust policy of a RAM role.
  
  The trust policy is in JSON format. The RAM array under Principal contains the ARNs of trusted principals in the format acs:ram::<AccountUID>:root. To revoke trust, find and delete the ARN entry that corresponds to Account B.
Delete the RAM role
1. Log on to the RAM console by using Account A.
2. On the Roles page, delete the RAM role.
  
  When you delete a RAM role, the permissions attached to the role are also removed. For more information, see Delete a RAM role.