Resource Orchestration Service:Grant self-managed permissions

Method 1: Use the RAM console

1. Configure permissions for the execution account.

   1. Log on to the RAM console with an execution account.

   2. Create a RAM role named AliyunROSStackGroupExecutionRole and set the administrator account as the trusted entity.

      1. In the left-side navigation pane, choose Identities > Roles.

      2. On the Roles page, click Create Role.

      3. On the Create Role page, set Trusted Entity Type to Cloud Account.

      4. Set Trusted Cloud Account to Other Cloud Account, and enter the ID of the administrator account.

      5. Click OK. In the dialog box that appears, enter AliyunROSStackGroupExecutionRole in the Role Name field.

      6. Click OK to complete the creation.

   3. Grant the AdministratorAccess permission to AliyunROSStackGroupExecutionRole.

      1. On the Roles page, find the AliyunROSStackGroupExecutionRole RAM role and click Grant Permission in the Actions column.

      2. In the Grant Permission panel, set Resource Scope to Account Level. The principal is automatically populated.

      3. Select System Policy and then select the AdministratorAccess policy.

      4. Click Confirm Grant Permission.

2. Configure permissions for the administrator account.

   1. Log on to the RAM console with the administrator account.

   2. Create a RAM role named AliyunROSStackGroupAdministrationRole and set Resource Orchestration Service as the trusted entity.

      1. In the left-side navigation pane, choose Identities > Roles.

      2. On the Roles page, click Create Role.

      3. On the Create Role page, set Trusted Entity Type to Cloud Service.

      4. Set Principal to Resource Orchestration Service and click OK.

      5. In the dialog box that appears, enter AliyunROSStackGroupAdministrationRole in the Role Name field.

      6. Click OK to complete the creation.

   3. Create a custom policy named AssumeRole-AliyunROSStackGroupExecutionRole.

      1. In the left-side navigation pane, choose Permissions > Policies.

      2. On the Policies page, click Create Policy.

      3. On the Create Policy page, click the Script Editor tab, enter the following policy content, and click OK. Then, set Name to AssumeRole-AliyunROSStackGroupExecutionRole.

         This policy allows AliyunROSStackGroupAdministrationRole to assume AliyunROSStackGroupExecutionRole.

         {
           "Statement": [
             {
               "Effect": "Allow",
               "Action": "sts:AssumeRole",
               "Resource": "acs:ram::*:role/AliyunROSStackGroupExecutionRole"
             }
           ],
           "Version": "1"
         }

      4. Click OK to complete the creation.

   4. Grant the AssumeRole-AliyunROSStackGroupExecutionRole permission to AliyunROSStackGroupAdministrationRole.

      1. In the left-side navigation pane, choose Identities > Roles.

      2. On the Roles page, find the AliyunROSStackGroupAdministrationRole RAM role and click Grant Permission in the Actions column.

      3. In the Grant Permission panel, set Resource Scope to Account Level. The principal is automatically populated.

      4. Select Custom Policy and then select the AssumeRole-AliyunROSStackGroupExecutionRole policy.

      5. Click Confirm Grant Permission.

Method 2: Use the ROS console

Use ROS templates to create RAM roles and grant permissions for the administrator and execution accounts.

1. Log on to the ROS console with the administrator account and use the AliyunROSStackGroupAdministrationRole template to create the RAM role and grant permissions.

   Sample template:

   ROSTemplateFormatVersion: '2015-09-01'
   Description: Configures the AliyunROSStackGroupAdministrationRole to enable the use of stack groups in Alibaba Cloud ROS.
   Parameters:
     AdministrationRoleName:
       Type: String
       Default: AliyunROSStackGroupAdministrationRole
       Description:
         en: Name of the role for the administrator account
     ExecutionRoleName:
       Type: String
       Default: AliyunROSStackGroupExecutionRole
       Description:
         en: Name of the execution role for the execution account
   Metadata:
     ALIYUN::ROS::Interface:
       ParameterGroups:
         - Parameters:
             - AdministrationRoleName
             - ExecutionRoleName
           Label:
             default:
               en: RAM
       TemplateTags:
         - acs:example:Security:Grant permissions to the administrator account of a stack group
   Resources:
     AliyunROSStackGroupAdministrationRole:
       Type: ALIYUN::RAM::Role
       Properties:
         RoleName:
           Ref: AdministrationRoleName
         AssumeRolePolicyDocument:
           Version: 1
           Statement:
             - Action: sts:AssumeRole
               Effect: Allow
               Principal:
                 Service:
                   - ros.aliyuncs.com
         Policies:
           - PolicyName:
               Fn::Sub:
                 - AssumeRole-${ExecutionRoleName}
                 - ExecutionRoleName:
                     Ref: ExecutionRoleName
             PolicyDocument:
               Statement:
                 - Effect: Allow
                   Action:
                     - sts:AssumeRole
                   Resource:
                     - Fn::Sub: acs:ram::*:role/${ExecutionRoleName}
               Version: '1'
   Outputs:
     AdministrationRoleName:
       Value:
         Fn::GetAtt:
           - AliyunROSStackGroupAdministrationRole
           - RoleName
   

2. Log on to the ROS console with an execution account and use the AliyunROSStackGroupExecutionRole template to create the RAM role and grant permissions.

   Sample template:

   ROSTemplateFormatVersion: '2015-09-01'
   Description: Configures the AliyunROSStackGroupExecutionRole to enable your account to be used as an execution account for stack groups in Alibaba Cloud ROS.
   Conditions:
     CurrentAccount:
       Fn::Equals:
         - Ref: AdministrationAccountId
         - ''
   Parameters:
     ExecutionRoleName:
       Type: String
       Default: AliyunROSStackGroupExecutionRole
       Description:
         en: Name of the execution role for the execution account
     AdministrationAccountId:
       Type: String
       Description:
         en: The ID of the administrator account. If you leave this parameter empty, permissions are granted to the current account.
       Default: ''
   Metadata:
     ALIYUN::ROS::Interface:
       ParameterGroups:
         - Parameters:
             - ExecutionRoleName
             - AdministrationAccountId
           Label:
             default: RAM
       TemplateTags:
         - acs:example:Security:Grant permissions to the execution account of a stack group
   Resources:
     AliyunROSStackGroupExecutionRole:
       Type: ALIYUN::RAM::Role
       Properties:
         RoleName:
           Ref: ExecutionRoleName
         AssumeRolePolicyDocument:
           Version: 1
           Statement:
             - Action: sts:AssumeRole
               Effect: Allow
               Principal:
                 RAM:
                   - Fn::Join:
                       - ''
                       - - 'acs:ram::'
                         - Fn::If:
                             - CurrentAccount
                             - Ref: ALIYUN::TenantId
                             - Ref: AdministrationAccountId
                         - ':root'
     AttachPolicy:
       Type: ALIYUN::RAM::AttachPolicyToRole
       Properties:
         PolicyName: AdministratorAccess
         PolicyType: System
         RoleName:
           Fn::GetAtt:
             - AliyunROSStackGroupExecutionRole
             - RoleName
   Outputs:
     ExecutionRoleName:
       Value:
         Fn::GetAtt:
           - AliyunROSStackGroupExecutionRole
           - RoleName