Create a RAM role for a trusted Alibaba Cloud account - Resource Access Management

RAM roles whose trusted entity is an Alibaba Cloud account enable cross-account access and temporary authorization. A RAM user or RAM role from the trusted account can assume such a role to access your resources.

Procedure

Log on to the RAM console as a RAM administrator.
In the left-side navigation pane, choose Identities > Roles.
On the Roles page, click Create Role.
On the Create Role page, set Principal Type to Cloud Account, specify the details of the Alibaba Cloud account, and then click OK.
- Current Account: Select this option to allow all RAM users and RAM roles under the current Alibaba Cloud account to assume the role. SelectCurrent Account.
- Other Account: Select this option to allow all RAM users and RAM roles from another Alibaba Cloud account to assume the role. SelectOther Account and then enter the ID of the other Alibaba Cloud account (main account). This is primarily used for cross-account resource access. For more information, see Access resources across Alibaba Cloud accounts.You can find your Alibaba Cloud account (main account) ID on the Security Settings page.
(Optional) To restrict the role to specific RAM users or RAM roles, click Switch to Policy Editor to modify the trust policy.

The editor supports two modes: Visual Editor and JSON Editor. In the following example, the RAM role can only be assumed by the RAM user Alice under the current Alibaba Cloud account (AccountID=100******0719).
- Visual Editor
  
  In the Principal section, add the RAM user.
  
  Click the Edit link next to Cloud Account and enter the ID of the trusted account.
  
  In the Add Principal dialog box, select Current Account for Cloud Account and RAM User for Identity Type. Enter the target username, such as Alice, in the User Name field, and then click OK.
- JSON Editor
  
  In the RAM field of the Principal object, enter the full ARN of the RAM user.
```
{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "RAM": "acs:ram::100******0719:user/Alice"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
```
In the Create Role dialog box, enter a Role Name, and then click OK.

Next steps

Grant permissions to the RAM role.

A new RAM role has no permissions by default. You must grant permissions to the role before you can use it. For instructions, see Manage permissions for a RAM role.
Use the RAM role.

A principal in the trusted account can assume this role through the console or by calling an API to obtain a temporary security token (STS token), and then access your authorized resources. For detailed instructions, see Assume a RAM role.