Server Load Balancer:Use RAM roles for cross-account SLB access

Background

Assume Enterprise A has purchased various cloud resources and needs Enterprise B to manage some of them. You can use a RAM role to meet this requirement. A RAM role is a virtual identity that does not have permanent authentication credentials. Instead, it must be assumed by a trusted entity. To meet the requirements of Enterprise A, perform the following steps:

1. Enterprise A creates a RAM role.

2. Enterprise A grants permissions to the RAM role.

3. Enterprise B creates a RAM user.

4. Enterprise B grants the AliyunSTSAssumeRoleAccess permission to the RAM user.

5. The RAM user from Enterprise B accesses Enterprise A's resources via the console or API calls.

Step 1: Create a RAM role (Enterprise A)

Log on to the RAM console with the Alibaba Cloud account of Enterprise A to create a RAM role.

1. Log on to the RAM console as a RAM administrator.

2. In the left-side navigation pane, choose Identities > Roles.

3. On the Roles page, click Create Role.

4. On the Create Role page, set Principal Type to Cloud Account, configure the account, and then click OK.

   • Current Account: If you want to allow all RAM users and RAM roles in the current Alibaba Cloud account to assume the RAM role that you are creating, select Current Account.

   • Other Account: If you want to allow all RAM users and RAM roles that belong to another Alibaba Cloud account to assume the RAM role that you are creating, you can select Other Account and then enter the ID of the other Alibaba Cloud account (root account). This option is primarily used for cross-account resource authorization scenarios. For a related tutorial, see Access resources across Alibaba Cloud accounts. You can view the ID of your Alibaba Cloud account (root account) on the Security Settings page.

5. (Optional) To allow only a specific RAM user or RAM role from the trusted Alibaba Cloud account to assume this role, click Switch to Policy Editor to modify the trust policy.

   The following example modifies the trust policy to allow only the RAM user Alice from the current Alibaba Cloud account (ID: 100******0719) to assume this role.

   • Visual editor

     In the Principal section, specify the name of the RAM user.

     Set the trusted entity type to Alibaba Cloud Account, click Add Principal, and then select sts:AssumeRole in the Actions column.

     In the Add Principal dialog box, set Select Account to Current Alibaba Cloud Account, set Identity Type to RAM User, enter Alice for User Name, and then click OK.

   • Script editor

     In the Principal element, specify the RAM user in the RAM field.

     {
       "Version": "1",
       "Statement": [
         {
           "Effect": "Allow",
           "Principal": {
             "RAM": "acs:ram::100******0719:user/Alice"
           },
           "Action": "sts:AssumeRole"
         }
       ]
     }

6. In the Create Role dialog box, enter a Role Name and click OK.

Step 2: Grant permissions to the RAM role (Enterprise A)

By default, a new RAM role has no permissions. Enterprise A must grant them.

1. Log on to the RAM console as a RAM administrator.

2. In the left-side navigation pane, choose Identities > Roles.

3. On the Roles page, find the RAM role that you created in Step 1 and click Attach Policy in the Actions column.

4. In the Attach Policy panel, grant permissions to the RAM role that you created in Step 1.

   1. Select the resource scope.

      • Account: The permissions apply to the current Alibaba Cloud account.

      • Resource Group: The permissions apply to the specified resource group.

        Note

        To grant permissions on a resource group, make sure that the cloud service and resource type support resource groups. For more information, see Services that work with Resource Group.

   2. Select the principal.

      The principal is the RAM role that receives the permissions. The system automatically selects the current role.

   3. Select policies.

      A policy defines a set of permissions. You can select multiple policies.

      • {type}: created and maintained by Alibaba Cloud. You can use but not modify system policies. For more information, see Services that work with RAM.

        Note

        The system automatically flags high-risk system policies, such as AdministratorAccess and AliyunRAMFullAccess. Avoid granting unnecessary high-risk permissions.

      • {type}: created and maintained by users. You can create, update, and delete custom policies. For more information about how to create a custom policy, see Create a custom policy.

   4. Click OK.

5. Click Close.

Step 3: Create a RAM user (Enterprise B)

Log on to the RAM console with the Alibaba Cloud account of Enterprise B to create a RAM user.

1. Log on to the RAM console as a RAM administrator or with your Alibaba Cloud account (root account).

2. In the left-side navigation pane, choose Identities > Users.

3. On the Users page, click Create User.

4. In the Create User section of the User Info page, configure the following settings.

   • User Login Name: The name can be up to 64 characters long and can contain letters, digits, periods (.), hyphens (-), and underscores (_).

   • Display Name: The name can contain up to 128 characters.

   • Tags: Click and then enter a tag key and a tag value. You can add tags to RAM users to facilitate tag-based user management.

   Note

   Click Add User to create multiple RAM users at a time.

5. In the Access Configuration section, select an access mode and configure the required parameters.

   For security purposes, we recommend that you select only one of the following access modes to separate human users from application users.

   • Console Access

     If a RAM user represents a person, we recommend enabling console access. This allows the user to log on to the Alibaba Cloud console with a username and password. You must configure the following parameters:

     • Console Password: You can automatically generate a password or specify a custom password. A custom password must meet the password complexity requirements. For more information, see Set a password policy for RAM users.

     • Required to Reset Password upon Next Logon: Select whether the RAM user must reset the password upon the next logon.

     • Multi-factor Authentication (MFA): Select whether to enable multi-factor authentication (MFA) for the RAM user. After enabling MFA, you must bind an MFA device. For more information, see Bind an MFA device for a RAM user.

   • Permanent AccessKey

     If a RAM user represents an application, you can use a permanent AccessKey pair for programmatic access to Alibaba Cloud. After enabling this access mode, the system automatically creates an AccessKey ID and an AccessKey secret for the RAM user. For more information, see Create an AccessKey pair.

     Important

     • The AccessKey secret of a RAM user is displayed only when you create it. You cannot retrieve the AccessKey secret afterwards. We recommend that you store it in a secure manner.

     • An AccessKey pair provides long-term credentials for programmatic access. If an AccessKey pair is leaked, the security of all account resources is at risk. To reduce this risk, we recommend that you use temporary credentials from Security Token Service (STS) instead. For more information, see Best practices for using access credentials to call API operations.

6. Click OK.

Step 4: Grant permissions to the RAM user (Enterprise B)

Enterprise B must grant the AliyunSTSAssumeRoleAccess policy to its RAM user. This allows the user to assume the RAM role created by Enterprise A.

1. Log on to the RAM console as a RAM administrator.

2. In the left-side navigation pane, choose Identities > Users.

3. On the Users page, find the RAM user that you created in Step 3 and click Attach Policy in the Actions column.

4. In the Grant Permission panel, grant permissions to the RAM user.

   1. Select the resource scope.

      • Account: The permissions apply to the current Alibaba Cloud account.

      • Resource Group: The permissions apply to the specified resource group.

        Note

        To grant permissions on a resource group, make sure that the cloud service and resource type support resource groups. For more information, see Services that work with Resource Group.

   2. Select the principal. Select the RAM user that you created in Step 3.

   3. Select policies. For this topic, select AliyunSTSAssumeRoleAccess.

5. Click OK, and then click Close.

Next steps

After completing the preceding steps, the RAM user from Enterprise B can access the cloud resources of Enterprise A by logging on to the console or calling API operations.