Serverless App Engine:Grant permissions to a RAM role

Scenario

Enterprise A has activated SAE and wants to authorize Enterprise B to manage part of its business. Requirements:

• Enterprise A wants to focus on the business system and act only as the resource owner of SAE. Enterprise A wants to authorize Enterprise B to manage part of its business, such as application publishing, application management, auto scaling policy management, application one-click start and stop, and application monitoring.

• If an employee joins or leaves Enterprise B, Enterprise A does not need to make modifications to the granted permissions. Enterprise B can grant its RAM users fine-grained permissions on the resources of Enterprise A.

• If the contract between Enterprise A and Enterprise B ends, Enterprise A can revoke the permissions from Enterprise B.

Step 1: Enterprise A creates a RAM role

1. Log on to the RAM console with Account A.

2. In the left-side navigation pane, choose Identities > Roles.

3. On the Roles page, click Create Role.

   

4. On the Create Role page, configure the related parameters.

   1. Set Principal Type to Cloud Account and Principal Name to Other Account. Then, enter the UID for Account B. Click OK.

   2. Enter sae-admin in the Role Name field and click OK.

      Important

      If you want a specific RAM user instead of all RAM users that belong to an Alibaba Cloud account to assume the RAM role, use one of the following methods:

      • Modify the trust policy of the RAM role. For more information, see Example 1: Change the trusted entity of a RAM role to an Alibaba Cloud account.

      • Modify the role-assuming policy that is attached to the RAM user. For more information, see How to specify the RAM role that a RAM user can assume?

5. On the Basic Information page of the RAM role, you can view the RAM role name, creation time, and Alibaba Cloud Resource Name (ARN).

   • RAM role name: sae-admin.

   • ARN: acs:ram::1234************:role/sae-admin.

   • Trust policy:

     Note

     This policy indicates that only RAM users that belong to Account B can assume the RAM role.

     {
       "Statement": [
         {
           "Action": "sts:AssumeRole",
           "Effect": "Allow",
           "Principal": {
             "RAM": [
               "acs:ram::2345************:root"
             ]
           }
         }
       ],
       "Version": "1"
     }

Step 2: Enterprise A grants permissions to the RAM role

1. Log on to the RAM console with Account A.

2. In the left-side navigation pane, choose Identities > Roles.

3. On the Roles page, find the RAM role that you want to manage and click Grant Permission in the Actions column.

   

   You can also select multiple RAM roles and click Grant Permission in the lower part of the RAM role list to grant permissions to multiple RAM roles at a time.

4. In the Grant Permission panel, grant permissions to the RAM role.

   1. Configure the Resource Scope parameter.

      • Account: The authorization takes effect on the current Alibaba Cloud account.

      • Resource Group: The authorization takes effect on a specific resource group.

        Note

        If you select Resource Group for the Resource Scope parameter, make sure that the required cloud service supports resource groups. For more information, see Services that work with Resource Group.

   2. Configure the Principal parameter.

      The principal is the RAM role to which you want to grant permissions. The current RAM role is automatically selected.

   3. Configure the Policy parameter.

      A policy is a set of access permissions. You can select multiple policies at a time.

      • System policies: policies that are created by Alibaba Cloud. You can use but cannot modify these policies. Version updates of the policies are maintained by Alibaba Cloud. For more information, see Services that work with RAM.

        Note

        The system automatically identifies high-risk system policies, such as AdministratorAccess and AliyunRAMFullAccess. We recommend that you do not grant unnecessary permissions by attaching high-risk policies.

      • Custom policies: You can manage and update custom policies based on your business requirements. You can create, update, and delete custom policies. For more information, see Create a custom policy.

   4. Click Grant permissions.

5. Click Close.

Step 3: Enterprise B creates a RAM user

1. Log on to the RAM console with Account B.

2. In the left-side navigation pane, choose Identities > Users.

3. On the Users page, click Create User.

4. In the User Account Information section of the Create User page, configure the following parameters:

   • Logon Name: The logon name can be up to 64 characters in length, and can contain letters, digits, periods (.), hyphens (-), and underscores (_).

   • Display Name: The display name can be up to 128 characters in length.

   • Tag: Click the icon and enter a tag key and a tag value. Adding tags helps you categorize and manage RAM users.

   Note

   You can click Add User to create multiple RAM users at a time.

5. In the Access Mode section, select an access mode and configure the required parameters.

   For enhanced security, we recommend creating separate users for individuals and for applications. Choose only one access mode accordingly to maintain this separation.

   • Console access

     For users who are individuals, we recommend enabling Console Access. This allows them to sign in to the Alibaba Cloud Management Console with a username and password. If you select Console Access, you must configure the following parameters:

     • Set Logon Password: Select Automatically Regenerate Default Password or Reset Custom Password. If you select Reset Custom Password, you must specify a password. The password must meet complexity requirements. For more information, see Configure a password policy for RAM users.

     • Password Reset: Specify whether the RAM user is required to reset the password at the next sign-in.

     • Enable MFA: Specify whether to enable multi-factor authentication (MFA) for the RAM user. After you enable MFA, you must bind an MFA device to the RAM user. For more information, see Bind an MFA device to a RAM user.

   • Programmatic access

     For users that represent applications, enable Using permanent AccessKey to access for the RAM user. The system will generate a permanent AccessKey ID and AccessKey Secret for API calls. For more information, see Obtain an AccessKey pair.

     Important

     • The AccessKey Secret is displayed only once when it is created and cannot be retrieved later. Therefore, you must save it in a secure location.

     • An AccessKey pair is a permanent credential for application access. If the AccessKey pair of an Alibaba Cloud account is leaked, the resources that belong to the account are exposed to potential risks. To prevent credential leak risks, we recommend that you use Security Token Service (STS) tokens. For more information, see Best practices for using an access credential to call API operations.

6. Click OK.

Step 4: Enterprise B grants permissions to the RAM user

1. Log on to the RAM console with Account B.

2. In the left-side navigation pane, choose Identities > Users.

3. On the Users page, find the required RAM user, and click Add Permissions in the Actions column.

   

   You can also select multiple RAM users and click Add Permissions in the lower part of the page to grant permissions to the RAM users at a time.

4. In the Policy section, enter AliyunSTSAssumeRoleAccess in the search box, select the policy to add it to the Selected Policy list on the right, and then click Grant permissions.

5. Click Close.

Step 5: Access resources across Alibaba Cloud accounts

Security Token Service (STS) allows you to use temporary credentials to access your Alibaba Cloud resources. You can use STS to grant temporary access tokens with custom validity periods and access permissions to RAM entities such as RAM users and RAM roles. Authorized RAM entities can use the STS tokens to access Alibaba Cloud resources by using one of the following methods:

Revoke permissions from a RAM role

If the contract between Enterprise A and Enterprise B ends, Enterprise A only needs to revoke the permissions from the RAM role of Enterprise B and delete the RAM role. This way, all RAM users of Account B can no longer access the resources of Account A.

1. Log on to the RAM console with Account A.

2. In the left-side navigation pane, choose Identities > Roles.

3. On the Roles page, find the RAM user that you want to delete and click Delete Role in the Actions column.

4. In the Delete Role dialog box, enter the name of the RAM role and click Delete Role.

   If a policy is attached to the RAM role, the policy is detached when you delete the RAM role.

   For a RAM role that fails to be deleted, you can click Role Deletion in the upper-right corner of the RAM role list to view the details.