Modify the trust policy of a RAM role - Resource Access Management

Modify the trust policy of a RAM role to change its principal to an Alibaba Cloud account, an Alibaba Cloud service, or an identity provider (IdP).

Background

When you create a RAM role, you specify the principals that can assume it: an Alibaba Cloud account, an Alibaba Cloud service, or an identity provider (IdP). You typically do not need to change the trust policy after creation, but you can modify it if necessary.

Warning

Modifying the principal in a RAM role's trust policy changes who can assume the role and may disrupt your services. We strongly recommend that you test the changes in a test account to ensure they work as expected before you apply them to a production account.

Procedure

Log on to the RAM console as a RAM administrator.
In the left-side navigation pane, choose Identities > Roles.
On the Roles page, click the name of the target RAM role.
On the Trust Policy tab, click Edit Trust Policy.
In the editor, modify the trust policy, and then click OK.

Example 1: Change the principal to an Alibaba Cloud account

If the Principal element contains a RAM field, the principal of the RAM role is an Alibaba Cloud Account. The role can be assumed by RAM users or RAM roles that belong to the trusted Alibaba Cloud account.

Allow all RAM users and RAM roles in the trusted Alibaba Cloud account to assume the RAM role

The following trust policy allows any RAM user or RAM role in the Alibaba Cloud account 123456789012**** to assume the role.

{
    "Statement": [
        {
            "Action": "sts:AssumeRole",
            "Effect": "Allow",
            "Principal": {
                "RAM": [
                    "acs:ram::123456789012****:root"
                ]
            }
        }
    ],
    "Version": "1"
}

Allow only a specified RAM user in the trusted Alibaba Cloud account to assume the RAM role

The following Principal element allows only the RAM user testuser under the Alibaba Cloud account 123456789012**** to assume the role.
```
            "Principal": {
                "RAM": [
                    "acs:ram::123456789012****:user/testuser"
                ]
            }                   
```
Note
When you modify this trust policy, ensure that the corresponding RAM user testuser has been created.
Allow only a specified RAM role in the trusted Alibaba Cloud account to assume the RAM role

The following Principal element allows only the RAM role testrole under Alibaba Cloud account 123456789012**** to assume the role.
```
            "Principal": {
                "RAM": [
                    "acs:ram::123456789012****:role/testrole"                
                ]
            }                                 
```
Note
When you modify this trust policy, ensure that the RAM role testrole has been created.

Example 2: Change the principal to an Alibaba Cloud service

If the Principal element contains a Service field, the principal of the RAM role is an Alibaba Cloud Service. The role can be assumed by a trusted Alibaba Cloud service.

The following trust policy allows the ECS service in the current Alibaba Cloud account to assume the role.

{
    "Statement": [
        {
            "Action": "sts:AssumeRole",
            "Effect": "Allow",
            "Principal": {
                "Service": [
                    "ecs.aliyuncs.com"
                ]
            }
        }
    ],
    "Version": "1"
}

Note

The trust policy of a service-linked role is defined by the associated cloud service. You cannot modify the trust policy of a service-linked role. For more information, see Service-linked roles.

Example 3: Change the principal to an identity provider (IdP)

If the Principal element contains a Federated field, the principal of the RAM role is an IdP. The role can be assumed by users from the trusted identity provider.

In the following example, the RAM role can be assumed by users under the identity provider testprovider in the current Alibaba Cloud account (AccountID=123456789012****).

{
    "Statement": [
        {
            "Action": "sts:AssumeRole",
            "Effect": "Allow",
            "Principal": {
                "Federated": [
                    "acs:ram::123456789012****:saml-provider/testprovider"
                ]
            },
            "Condition":{
                "StringEquals":{
                    "saml:recipient":"https://signin.alibabacloud.com/saml-role/sso"
                }
            }
        }
    ],
    "Version": "1"
}