Serverless App Engine:Grant permissions to a RAM role

Prerequisites

Before you begin, make sure you have:

• Two Alibaba Cloud accounts: one for Enterprise A (the resource owner) and one for Enterprise B (the delegate)

• The account UID for Enterprise B (you will enter it when creating the RAM role)

• Sufficient RAM permissions in both accounts to create roles, users, and attach policies

Scenario

Enterprise A has activated SAE and wants to authorize Enterprise B to manage part of its business. The delegated management scope includes:

• Application publishing

• Application management

• Auto scaling policy management

• Application one-click start and stop

• Application monitoring

This arrangement lets Enterprise A focus on ownership of SAE resources while Enterprise B handles day-to-day operations. If an employee joins or leaves Enterprise B, Enterprise A does not need to update any permissions — Enterprise B manages its own RAM users. When the contract ends, Enterprise A simply deletes the RAM role to revoke all access immediately.

How it works

The setup involves four configuration steps followed by one verification step:

1. Enterprise A creates a RAM role that trusts Account B.

2. Enterprise A attaches an SAE permission policy to the role.

3. Enterprise B creates a RAM user for the operator.

4. Enterprise B grants that RAM user permission to assume the role.

5. Enterprise B's RAM user accesses SAE resources in Account A — via the console or the SDK.

When the business relationship ends, Enterprise A deletes the RAM role, immediately revoking all access for Enterprise B.

Step 1: Create a RAM role (Enterprise A)

1. Log on to the RAM console with Account A.

2. In the left-side navigation pane, choose Identities > Roles.

3. On the Roles page, click Create Role.

   

4. On the Create Role page, configure the following settings:

   1. Set Principal Type to Cloud Account and Principal Name to Other Account. Enter the UID for Account B, then click OK.

   2. Enter sae-admin in the Role Name field and click OK.

      Important

      By default, all RAM users in Account B can assume this role. To restrict access to specific RAM users, use one of the following methods:

      • Modify the trust policy of the RAM role. For details, see Example 1: Change the trusted entity of a RAM role to an Alibaba Cloud account.

      • Modify the role-assuming policy attached to the RAM user. For details, see How to specify the RAM role that a RAM user can assume?

5. On the Basic Information page of the new role, confirm the following details:

   • RAM role name: sae-admin

   • ARN: acs:ram::1234************:role/sae-admin

   • Trust policy:

   Note

   This policy allows any RAM user in Account B to assume the role.

   {
     "Statement": [
       {
         "Action": "sts:AssumeRole",
         "Effect": "Allow",
         "Principal": {
           "RAM": [
             "acs:ram::2345************:root"
           ]
         }
       }
     ],
     "Version": "1"
   }

Step 2: Grant permissions to the RAM role (Enterprise A)

1. Log on to the RAM console with Account A.

2. In the left-side navigation pane, choose Identities > Roles.

3. On the Roles page, find the sae-admin role and click Grant Permission in the Actions column. To grant permissions to multiple roles at once, select them and click Grant Permission at the bottom of the list.

   

4. In the Grant Permission panel, configure the following:

   1. Resource Scope — choose the scope for the authorization:

      Note

      If you select Resource Group, confirm that SAE supports resource groups. See Services that work with Resource Group.

      • Account: the authorization applies to all resources in Account A.

      • Resource Group: the authorization applies only to a specific resource group.

   2. Principal — the sae-admin role is automatically selected.

   3. Policy — select the policies to attach. You can attach multiple policies at once:

      • System policies: managed by Alibaba Cloud. You can use but not modify them. For the full list, see Services that work with RAM.

        Note

        The console flags high-risk policies such as AdministratorAccess and AliyunRAMFullAccess. Avoid attaching these unless strictly necessary.

      • Custom policies: policies you create and manage. See Create a custom policy.

5. Click Grant permissions, then click Close.

Step 3: Create a RAM user (Enterprise B)

1. Log on to the RAM console with Account B.

2. In the left-side navigation pane, choose Identities > Users.

3. On the Users page, click Create User.

   

4. In the User Account Information section, fill in the following fields:

   • Logon Name: up to 64 characters; letters, digits, periods (.), hyphens (-), and underscores (_) are allowed.

   • Display Name: up to 128 characters.

   • Tag: click and enter a tag key and value to help categorize this user.

   Note

   Click Add User to create multiple RAM users at a time.

5. In the Access Mode section, select the appropriate mode. Create separate users for individuals and for applications — assign only one access mode to each.

   • Console access — for human operators. Enable Console Access and configure:

     • Set Logon Password: select Automatically Regenerate Default Password or Reset Custom Password. If you select Reset Custom Password, specify a password that meets the password policy.

     • Password Reset: specify whether the user must reset the password at the next logon.

     • Enable MFA: enable multi-factor authentication (MFA) and bind an MFA device. See Bind an MFA device to a RAM user.

   • Programmatic access — for applications. Enable Using permanent AccessKey to access. The system generates a permanent AccessKey ID and AccessKey secret for API calls. See Obtain an AccessKey pair.

     Important

     • The AccessKey secret is shown only once at creation. Save it to a secure location immediately.

     • An AccessKey pair is a long-lived credential. If it is leaked, all resources under the account are at risk. For production workloads, use Security Token Service (STS) temporary credentials instead. See Best practices for using an access credential to call API operations.

6. Click OK.

Step 4: Grant the RAM user permission to assume the role (Enterprise B)

1. Log on to the RAM console with Account B.

2. In the left-side navigation pane, choose Identities > Users.

3. On the Users page, find the RAM user and click Add Permissions in the Actions column. To grant permissions to multiple users at once, select them and click Add Permissions at the bottom of the page.

   

4. In the Policy section, search for AliyunSTSAssumeRoleAccess, select it to add it to the Selected Policy list, then click Grant permissions.

5. Click Close.

Step 5: Access SAE resources across accounts

Enterprise B's RAM user can now access Enterprise A's SAE resources using either the console or the SDK.

package com.aliyun.sample;

import com.aliyun.sts20150401.models.AssumeRoleResponse;
import com.aliyun.tea.TeaException;
import com.google.gson.Gson;

public class Sample {

    /**
     * <b>description</b> :
     * <p>
     * Initialize your client with the credentials.
     * </p>
     *
     * @return Client
     *
     * @throws Exception
     */
    public static com.aliyun.sts20150401.Client createClient() throws Exception {
        com.aliyun.credentials.Client credential = new com.aliyun.credentials.Client();
        com.aliyun.teaopenapi.models.Config config =
                new com.aliyun.teaopenapi.models.Config().setCredential(credential);
        // Specify the endpoint. For more information, visit https://api.aliyun.com/product/Sts.
        config.endpoint = "sts.cn-hangzhou.aliyuncs.com";
        return new com.aliyun.sts20150401.Client(config);
    }

    public static void main(String[] args_) throws Exception {

        com.aliyun.sts20150401.Client client = Sample.createClient();
        com.aliyun.sts20150401.models.AssumeRoleRequest assumeRoleRequest =
                new com.aliyun.sts20150401.models.AssumeRoleRequest();
        com.aliyun.teautil.models.RuntimeOptions runtime =
                new com.aliyun.teautil.models.RuntimeOptions();

        // Replace with the actual RoleArn and customize the RoleSessionName.
        assumeRoleRequest.setRoleArn("acs:ram::1234************:role/sae-admin");
        assumeRoleRequest.setRoleSessionName("Alice");

        try {
            // Write your own code to display the response of the API operation if necessary.
            AssumeRoleResponse response = client.assumeRoleWithOptions(assumeRoleRequest, runtime);
            System.out.println(new Gson().toJson(response.body));
        } catch (TeaException error) {
            // Handle exceptions with caution in actual business scenarios, and do not ignore exceptions in your project.
            // Display the error message.
            System.out.println(error.getMessage());
            // Display the URL for troubleshooting.
            System.out.println(error.getData().get("Recommend"));
            com.aliyun.teautil.Common.assertAsString(error.message);
        } catch (Exception _error) {
            TeaException error = new TeaException(_error.getMessage(), _error);
            // Handle exceptions with caution in actual business scenarios and do not ignore exceptions in your project.
            // Display the error message.
            System.out.println(error.getMessage());
            // Display the URL for troubleshooting.
            System.out.println(error.getData().get("Recommend"));
            com.aliyun.teautil.Common.assertAsString(error.message);
        }
    }
}

{
  "requestId": "964E0EC5-575B-4FF5-8FD0-D4BD8025****",
  "assumedRoleUser": {
    "arn": "acs:ram::*************",
    "assumedRoleId": "*************"
  },
  "credentials": {
    "securityToken": "*************",
    "accessKeyId": "STS.*************",
    "accessKeySecret": "*************",
    "expiration": "2021-05-28T11:23:19Z"
  }
}

package com.aliyun.sample;

import com.aliyun.sae20190506.models.DescribeNamespacesResponse;
import com.aliyun.tea.*;
import com.google.gson.Gson;

public class Sample {

    /**
     * <b>description</b> :
     * <p>
     * Initialize your client with the credentials.
     * </p>
     *
     * @return Client
     *
     * @throws Exception
     */
    public static com.aliyun.sae20190506.Client createClient() throws Exception {
        com.aliyun.credentials.Client credential = new com.aliyun.credentials.Client();
        com.aliyun.teaopenapi.models.Config config =
                new com.aliyun.teaopenapi.models.Config().setCredential(credential);
        // For more information about endpoints, see https://api.aliyun.com/product/sae.
        config.endpoint = "sae.cn-hangzhou.aliyuncs.com";
        return new com.aliyun.sae20190506.Client(config);
    }

    public static void main(String[] args_) throws Exception {

        com.aliyun.sae20190506.Client client = Sample.createClient();
        com.aliyun.sae20190506.models.DescribeNamespacesRequest describeNamespacesRequest =
                new com.aliyun.sae20190506.models.DescribeNamespacesRequest();
        com.aliyun.teautil.models.RuntimeOptions runtime =
                new com.aliyun.teautil.models.RuntimeOptions();
        java.util.Map<String, String> headers = new java.util.HashMap<>();

        // Customize the following optional parameters as needed:
        describeNamespacesRequest.setCurrentPage(1);
        describeNamespacesRequest.setPageSize(10);

        try {
            DescribeNamespacesResponse response = client
                    .describeNamespacesWithOptions(describeNamespacesRequest, headers, runtime);
            System.out.println(new Gson().toJson(response.body));
        } catch (TeaException error) {
            // Handle exceptions with caution in actual business scenarios, and do not ignore exceptions in your project.
            // Display the error message.
            System.out.println(error.getMessage());
            // Display the URL for troubleshooting.
            System.out.println(error.getData().get("Recommend"));
            com.aliyun.teautil.Common.assertAsString(error.message);
        } catch (Exception _error) {
            TeaException error = new TeaException(_error.getMessage(), _error);
            // Handle exceptions with caution in actual business scenarios and do not ignore exceptions in your project.
            // Display the error message.
            System.out.println(error.getMessage());
            // Display the URL for troubleshooting.
            System.out.println(error.getData().get("Recommend"));
            com.aliyun.teautil.Common.assertAsString(error.message);
        }
    }
}

Revoke access from Enterprise B

When the business relationship with Enterprise B ends, delete the sae-admin role in Account A. This immediately prevents all RAM users in Account B from accessing Account A's resources.

1. Log on to the RAM console with Account A.

2. In the left-side navigation pane, choose Identities > Roles.

3. On the Roles page, find the sae-admin role and click Delete Role in the Actions column.

4. In the Delete Role dialog box, enter the role name and click Delete Role. If a policy is still attached, it is detached automatically when you delete the role. If the deletion fails, click Role Deletion in the upper-right corner of the role list to view the details and resolve blocking issues.