如何授权办公安全平台访问云资源 - Secure Access Service Edge

Grant SASE the permissions it needs to access your cloud resources before you use the service for the first time.

Prerequisites

You have activated SASE.
You are using an Alibaba Cloud account or a RAM user that has permissions to create and delete service-linked roles.

Background information

The first time you use SASE, Alibaba Cloud automatically creates a service-linked role named AliyunServiceRoleForCsas that allows SASE to access other Alibaba Cloud services on your behalf. No manual creation or modification is required. For more information, see Service-linked roles.

Procedure

Log on to the Secure Access Service Edge console.
In the Welcome to SASE dialog box, click Confirm Authorization.

After you enable secure access service edge, secure access service edge walks you through creating a service-linked role the first time you log on to the console.

When you click Confirm Creation, Alibaba Cloud automatically creates the service-linked role AliyunServiceRoleForCsas for SASE. You can view this role on the Roles page of the RAM console. Your SASE instance can access cloud services such as IDaaS and SAG only after this role is created.

SASE service-linked role

The secure access service edge service-linked role has the following attributes:

Role name: AliyunServiceRoleForCsas
Policy name: AliyunServiceRolePolicyForCsas

Note
This is a system policy. You cannot change the policy name or its content.

Policy example:

{
  "Version": "1",
  "Statement": [
    {
      "Action": [
        "ecs:DescribeInstances",
        "ecs:CreateSecurityGroup",
        "ecs:DeleteSecurityGroup",
        "ecs:AuthorizeSecurityGroup",
        "ecs:DescribeSecurityGroups",
        "ecs:DescribeSecurityGroupReferences",
        "ecs:ModifySecurityGroupPolicy",
        "ecs:ModifySecurityGroupRule",
        "ecs:ModifySecurityGroupEgressRule",
        "ecs:CreateNetworkInterface",
        "ecs:DeleteNetworkInterface",
        "ecs:DescribeNetworkInterfaces",
        "ecs:CreateNetworkInterfacePermission",
        "ecs:DescribeNetworkInterfacePermissions",
        "ecs:DeleteNetworkInterfacePermission",
        "ecs:AttachNetworkInterface",
        "ecs:DetachNetworkInterface",
        "ecs:RevokeSecurityGroup"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "rds:DescribeDBInstances",
        "rds:DescribeSecurityGroupConfiguration",
        "rds:ModifySecurityGroupConfiguration",
        "rds:DescribeDBInstanceIPArrayList",
        "rds:ModifySecurityIps"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "kvstore:DescribeInstances",
        "kvstore:DescribeGlobalDistributeCache",
        "kvstore:DescribeSecurityIps",
        "kvstore:ModifySecurityIps",
        "kvstore:DescribeSecurityGroupConfiguration",
        "kvstore:ModifySecurityGroupConfiguration"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "dds:DescribeDBInstances",
        "dds:DescribeSecurityIps",
        "dds:ModifySecurityIps",
        "dds:DescribeSecurityGroupConfiguration",
        "dds:ModifySecurityGroupConfiguration"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "polardb:DescribeDBClusters",
        "polardb:DescribeDBClusterAccessWhitelist",
        "polardb:ModifyDBClusterAccessWhitelist"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "vpc:DescribeVpcs",
        "vpc:DescribeVSwitches",
        "vpc:CreateVpc",
        "vpc:DeleteVpc",
        "vpc:CreateVSwitch",
        "vpc:DeleteVSwitch",
        "vpc:DescribeZones",
        "vpc:DescribePhysicalConnections",
        "vpc:DescribeVirtualBorderRouters",
        "vpc:DescribeVirtualBorderRoutersForPhysicalConnection",
        "vpc:DescribeVpnGateways",
        "vpc:DescribeVpnGateway",
        "vpc:DescribeCustomerGateways",
        "vpc:DescribeVpnConnections",
        "vpc:DescribeVpcAttribute",
        "vpc:DescribeRouteTables",
        "vpc:DescribeRouteTableList",
        "vpc:DescribeRouteEntryList"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "cen:DescribeCens",
        "cen:DescribeCenAttachedChildInstances",
        "cen:DescribeCenAttachedChildInstanceAttribute",
        "cen:AttachCenChildInstance",
        "cen:DetachCenChildInstance",
        "cen:GrantInstanceToCen",
        "cen:RevokeInstanceFromCen"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "smartag:CreateSmartAGTrafficService",
        "smartag:UpdateSmartAGTrafficService",
        "smartag:DeleteSmartAGTrafficSerivce",
        "smartag:ListSmartAGTrafficService",
        "smartag:DescribeSmartAccessGateways",
        "smartag:DescribeCloudConnectNetworks",
        "smartag:CreateCloudConnectNetwork",
        "smartag:ModifyCloudConnectNetwork",
        "smartag:DeleteCloudConnectNetwork",
        "smartag:CreateSmartAccessGatewaySoftware",
        "smartag:UpgradeSmartAccessGatewaySoftware",
        "smartag:DowngradeSmartAccessGatewaySoftware",
        "smartag:BindSmartAccessGateway",
        "smartag:UnbindSmartAccessGateway"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "log:PostLogStoreLogs",
        "log:GetProject",
        "log:ListProject",
        "log:GetLogStore",
        "log:ListLogStores",
        "log:CreateLogStore",
        "log:CreateProject",
        "log:GetIndex",
        "log:CreateIndex",
        "log:UpdateIndex",
        "log:CreateDashboard",
        "log:ClearLogStoreStorage",
        "log:UpdateLogStore",
        "log:UpdateDashboard",
        "log:CreateSavedSearch",
        "log:UpdateSavedSearch",
        "log:DeleteLogStore",
        "log:DeleteSavedSearch",
        "log:GetSavedSearch",
        "log:ListSavedSearch",
        "log:DeleteDashboard",
        "log:GetDashboard",
        "log:ListDashboard"
      ],
      "Resource": "acs:log:*:*:project/csas-project-*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "pvtz:DescribeZones",
        "pvtz:DescribeZoneInfo",
        "pvtz:DescribeZoneRecords"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": "ram:DeleteServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "csas.aliyuncs.com"
        }
      }
    }
  ]
}

Delete the service-linked role

If you no longer need SASE, you can delete the SASE service-linked role AliyunServiceRoleForCsas. Release all existing SASE instances first, and then delete the role in the RAM console.

Log on to the RAM console.
In the left-side navigation pane, choose Identities > Roles .
Use the search box to find the SASE service-linked role AliyunServiceRoleForCsas, and then click Delete Role in the Actions column.
In the Delete Role dialog box, click OK.

FAQ

Why can't I automatically create the SASE service-linked role when I use a RAM user?

A RAM user must have specific permissions to automatically create or delete service-linked roles. You must attach the following policy to the RAM user:

{
    "Statement": [
        {
            "Action": [
                "ram:CreateServiceLinkedRole"
            ],
            "Resource": "acs:ram:*:ACCOUNT_ID:role/*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": [
                        "csas.aliyuncs.com"
                    ]
                }
            }
        }
    ],
    "Version": "1"
}

Note

For instructions, see Grant permissions to a RAM role.