Resource Management:RAM roles in a resource directory

Overview

The following RAM roles are automatically created in management accounts and members.

AliyunServiceRoleForResourceDirectory

Purpose

Resource Directory assumes this role to create Service-linked roles for trusted services, enabling them to access other Alibaba Cloud services.

Permission policy

Policy name: AliyunServiceRolePolicyForResourceDirectory

Content:

{
    "Version": "1",
    "Statement": [
        {
            "Action": "ram:CreateServiceLinkedRole",
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": "ram:DeleteServiceLinkedRole",
            "Resource": "*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": "resourcemanager.aliyuncs.com"
                }
            }
        }
    ]
}

Trust policy

{
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Effect": "Allow",
      "Principal": {
        "Service": [
          "resourcemanager.aliyuncs.com"
        ]
      }
    }
  ],
  "Version": "1"
}

Create the role

This role is created in the following scenarios:

• When you enable a resource directory, this role is created in the management account.

• When you create a member, this role is created in the member.

• When an invited account joins a resource directory, this role is created in the invited account.

Delete the role

The system attempts to delete this role in the following scenarios:

• When you disable a resource directory, this role is deleted from the management account.

• When you remove a member from a resource directory, this role is deleted from the member.

If no cloud resources use this role, you can manually delete it. Delete a RAM role.

ResourceDirectoryAccountAccessRole

Purpose

The resource directory administrator uses this role to log on to a member and perform management operations. The trusted entity is the management account of the resource directory.

Permission policy

Policy name: AdministratorAccess

Content:

{
    "Statement": [
        {
            "Action": "*",
            "Effect": "Allow",
            "Resource": "*"
        }
    ],
    "Version": "1"
}

Trust policy

{
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Effect": "Allow",
      "Principal": {
        "RAM": [
          "acs:ram::151266687691****:root"  // 151266687691**** is the ID of the management account.
        ]
      }
    }
  ],
  "Version": "1"
}

Create the role

This role is created in the following scenarios:

• When you create a member, this role is created in the member.

• When an invited account joins a resource directory, this role is created in the invited account.

Delete the role

This role is automatically deleted from a member when the member is removed from the resource directory.

If no permission policies are attached to the role, you can manually delete it. Delete a RAM role.

AliyunServiceRoleFor***

Purpose

Trusted services use this role to run scheduled tasks and access the Resource Directory service. For more information, see Service-linked roles.

Permission policy

Trusted services define the permission policies. A typical policy includes:

• Permissions to run scheduled tasks on specific Alibaba Cloud services.

• Permissions to delete the service-linked role.

Trust policy

{
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Effect": "Allow",
      "Principal": {
        "Service": [
          "***.aliyuncs.com"  // The asterisks (***) represent a trusted service. Example: config.aliyuncs.com.
        ]
      }
    }
  ],
  "Version": "1"
}

Create the role

When a trusted service is enabled for a resource directory, Resource Directory assumes the AliyunServiceRoleForResourceDirectory role and creates this role in each member where the trusted service is activated.

Delete the role

When you remove a member from a resource directory, Resource Directory notifies the trusted service, which typically deletes this role automatically. If the role is not deleted, log on to the member and delete it manually. Delete a RAM role.