Create a RAM role for a trusted Alibaba Cloud account - Resource Access Management

A Resource Access Management (RAM) role whose trusted entity is an Alibaba Cloud account is used to implement cross-account access and temporary authorization. The RAM role can be assumed by a RAM user that belongs to a trusted Alibaba Cloud account.

Procedure

Log on to the RAM console by using an Alibaba Cloud account or a RAM user that has administrative rights.
In the left-side navigation pane, choose Identities > Roles.
On the Roles page, click Create Role.
In the Create Role panel, select Alibaba Cloud Account for the Select Trusted Entity parameter and click Next.
Configure parameters for the RAM role.
1. Specify RAM Role Name.
2. Specify Note.
3. Select Current Alibaba Cloud Account or Other Alibaba Cloud Account.
  - Current Alibaba Cloud Account: If you want a RAM user that belongs to your Alibaba Cloud account to assume the RAM role, select Current Alibaba Cloud Account.
  - Other Alibaba Cloud Account: If you want a RAM user that belongs to a different Alibaba Cloud account to assume the RAM role, select Other Alibaba Cloud Account and enter the ID of the Alibaba Cloud account. This option is provided to grant permissions on resources that belong to different Alibaba Cloud accounts. For more information, see Use a RAM role to grant permissions across Alibaba Cloud accounts.
  Important
  If you want a specific RAM user instead of all RAM users that belong to your Alibaba Cloud account to assume the RAM role, you can use one of the following methods:
  Modify the trust policy of the RAM role. For more information, see Example 1: Change the trusted entity of a RAM role to an Alibaba Cloud account.
  Modify the role-assuming policy that is attached to the RAM user. For more information, see Can I specify the RAM role that a RAM user can assume?.
  You can view the ID of your Alibaba Cloud account on the Security Settings page.
Click OK.
Click Close.

What to do next

Grant permissions to the RAM role.
After you create a RAM role, the RAM role does not have any permissions. You must grant permissions to the RAM role. For more information, see Grant permissions to a RAM role.
Assume the RAM role.
You can assume the RAM role as a RAM user that belongs to the trusted Alibaba Cloud account by using the Alibaba Cloud Management Console or the RAM API and access relevant cloud resources. For more information, see Assume a RAM role.