Modify the trust policy of a RAM role - Resource Access Management

You can modify the trust policy of a RAM role to change its principal. This topic shows how to change the principal of a RAM role to an Alibaba Cloud account, an Alibaba Cloud service, or an identity provider (IdP).

Background

When you create a RAM role, you specify the principals that can assume the role. These principals can be an Alibaba Cloud account, an Alibaba Cloud service, or an identity provider (IdP). Although you typically do not need to change the trust policy after creation, you can modify it if necessary.

Warning

Modifying the principal in a RAM role's trust policy changes who can assume the role and may disrupt your services. We strongly recommend that you test the changes in a test account to ensure they work as expected before you apply them to a production account.

Procedure

Log on to the RAM console as a RAM administrator.
In the left-side navigation pane, choose Identities > Roles.
On the Roles page, click the name of the target RAM role.
On the Trust Policy tab, click Edit Trust Policy.
In the editor, modify the trust policy, and then click OK.

Example 1: Change the principal to an Alibaba Cloud account

If the Principal element contains a RAM field, the principal of the RAM role is an Alibaba Cloud Account. The role can be assumed by RAM users or RAM roles that belong to the trusted Alibaba Cloud account.

Allow all RAM users and RAM roles in the trusted Alibaba Cloud account to assume the RAM role

For example, the following trust policy allows any RAM user or RAM role in the Alibaba Cloud account 123456789012**** to assume the role.

{
    "Statement": [
        {
            "Action": "sts:AssumeRole",
            "Effect": "Allow",
            "Principal": {
                "RAM": [
                    "acs:ram::123456789012****:root"
                ]
            }
        }
    ],
    "Version": "1"
}

Allow only a specified RAM user in the trusted Alibaba Cloud account to assume the RAM role

If you change the Principal element as follows, it means that the RAM role can be assumed by the RAM user testuser under the Alibaba Cloud account 123456789012****.
```
            "Principal": {
                "RAM": [
                    "acs:ram::123456789012****:user/testuser"
                ]
            }                   
```
Note
When you modify this trust policy, ensure that the corresponding RAM user testuser has been created.
Allow only a specified RAM role in the trusted Alibaba Cloud account to assume the RAM role

If you change the content in Principal as follows, this indicates that this RAM role can be assumed by the RAM role testrole under Alibaba Cloud account 123456789012****.
```
            "Principal": {
                "RAM": [
                    "acs:ram::123456789012****:role/testrole"                
                ]
            }                                 
```
Note
When you modify this trust policy, ensure that the RAM role testrole has been created.

Example 2: Change the principal to an Alibaba Cloud service

If the Principal element contains a Service field, the principal for the RAM role is an Alibaba Cloud Service. This means the role can be assumed by a trusted Alibaba Cloud service.

For example, the following trust policy allows the ECS service in the current Alibaba Cloud account to assume the role.

{
    "Statement": [
        {
            "Action": "sts:AssumeRole",
            "Effect": "Allow",
            "Principal": {
                "Service": [
                    "ecs.aliyuncs.com"
                ]
            }
        }
    ],
    "Version": "1"
}

Note

The trust policy of a service-linked role is defined by the associated cloud service. You cannot modify the trust policy of a service-linked role. For more information, see Service-linked roles.

Example 3: Change the principal to an identity provider (IdP)

If the Principal element contains a Federated field, the principal of the RAM role is an IdP. This means the role can be assumed by users from the trusted identity provider.

The following trust policy is used as an example: The RAM role can be assumed by users under the identity provider testprovider in the current Alibaba Cloud account (AccountID=123456789012****).

{
    "Statement": [
        {
            "Action": "sts:AssumeRole",
            "Effect": "Allow",
            "Principal": {
                "Federated": [
                    "acs:ram::123456789012****:saml-provider/testprovider"
                ]
            },
            "Condition":{
                "StringEquals":{
                    "saml:recipient":"https://signin.alibabacloud.com/saml-role/sso"
                }
            }
        }
    ],
    "Version": "1"
}