This topic describes execution roles, including how to create a permission policy and an execution role.
Background
When you build applications with Serverless Workflow, you must create an execution role and grant it the required permissions. When Serverless Workflow executes a flow, it assumes this role to access other cloud services on your behalf, such as invoking functions, sending messages, and executing other flows.
The Serverless Workflow console lets you quickly create an execution role and grant it default system permissions. For more fine-grained access control, such as allowing a flow to access only specific functions in Function Compute, follow the instructions in this topic.
Serverless Workflow uses the role-based permission management system of Resource Access Management (RAM). The basic principle of authorization is as follows: a policy defines the permissions to access a specific service. When you attach a policy to a role, the role gains those permissions. To access another service, a service assumes a role with the required permissions. This approach avoids the use of long-term access keys and enhances system security.
Create a permission policy
Log on to the RAM console as a RAM administrator.
In the left-side navigation pane, choose .
On the Policies page, click Create Policy.
On the Create Policy page, click the Script tab.
Enter the policy document, and then click Next: Edit Basic Information.
For more information about the syntax and structure of a permission policy, see Policy structure and syntax. The following table provides common permission examples.
Description
Effect
Action
Resource
Allows invoking the Func1 function in the Test1 service.
Allow
fc:InvokeFunction
acs:fc:::services/Test1/functions/Func1
Allows invoking all functions in the Test2 service.
Allow
fc:InvokeFunction
acs:fc:::services/Test2/functions/*
Allows invoking all functions in services with names starting with Public.
Allow
fc:InvokeFunction
acs:fc:::services/Public*/functions/*
Allows sending messages to the Test1 queue.
Allow
mns:SendMessage
acs:mns:*:*:/queues/Test1/messages
Allows starting executions for the Test1 flow.
Allow
fnf:StartExecution
acs:fnf:::flows/Test1/executions/*
In the Basic Information section, enter a Policy Name and Note, and then click OK.
Create an execution role
Log on to the RAM console as a RAM administrator.
In the left-side navigation pane, choose .
On the Roles page, click Create Role.
In the Create Role panel, set the following parameters, and then click Finish.
For Trusted Entity type, select Alibaba Cloud Service.
For Role Type, select Normal Service Role.
For RAM Role Name, enter FnFExecutionRole.
For Trusted Service, select Function Flow.
Attach the permission policy that you created to the FnFExecutionRole role.
For detailed instructions, see Manage permissions for a RAM role.
Click the role you created. In the Basic Information section, copy the role ARN. You need this ARN to create or update a flow.