STAROps:Cross-account access permission practices

Scenario

Enterprises typically use the STAROps platform from a centralized management account, while production resources are distributed across multiple business accounts. O&M engineers want to troubleshoot logs and monitoring data in business accounts directly from the conversation entry point of the management account. However, a Digital Employee in the management account can access only resources in the current account by default. Cross-account queries therefore fail because credentials for the destination account are unavailable. This topic uses a management account (Account A) and a business account (Account B) to demonstrate an end-to-end cross-account authorization process.

How it works

STAROps allows you to create custom Digital Employees. A custom Digital Employee works based on the configured RoleArn. You can configure multiple connectors for a custom Digital Employee, and Alibaba Cloud connectors support cross-account RoleArns.

When a Digital Employee runs, it uses its configured RoleArn to assume a role in another account and obtain permissions to access cloud resources in that account.

Limits

• To ensure optimal performance, we recommend that you configure no more than 10 cross-account connectors for a Digital Employee.

• The role in the destination account must have a trust policy that trusts the RoleArn of the Digital Employee. Otherwise, cross-account access cannot be implemented.

Prerequisites

1. STAROps is activated.

2. A custom Digital Employee is created and a RoleArn is configured for the Digital Employee.

Configuration procedure

The variables used in this topic are described in the following table.

Step 1: Create a cross-account access role (Digital Employee role) in Account B

Create a RAM role in the business account (Account B) and allow the role in Account A to assume the RAM role.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "RAM": "acs:ram::{uid-a}:role/{role-a}"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

Step 2: Create a connector for the Digital Employee in Account A

The built-in CloudMonitor, SLS, and Alibaba Cloud resource connectors of STAROps support cross-account access. The following procedure uses an Alibaba Cloud resource connector as an example. For more information about how to create a connector for a Digital Employee, see System connectors.

1. Choose Settings > Connectors > Resources.

2. Click Add Resource Connection, select Alibaba Cloud Resources, and then click Next.

3. Configure the connection.

• Connector ID: The unique identifier of the connector. It cannot be modified after the connector is created. The ID must be 1 to 64 characters in length, can contain lowercase letters, digits, and hyphens (-), must start with a letter, and must end with a letter or digit.

• Name: The name that distinguishes the connection in the list. The name can be up to 128 characters in length.

• Alibaba Cloud Role: Select Cross-account Role and enter the Role ARN in the acs:ram::{uid-b}:role/{role-b} format. Then, click Check Permissions.

Verify the cross-account connection

After the configuration is complete, use one of the following methods to verify that the cross-account connection takes effect:

• Method 1: On the Digital Employee configuration page, click the connector and check whether the connection is normal.

• Method 2: Start a conversation with the Digital Employee and ask it to access the connector. Example: Access connector B and check whether the connection works as expected.

FAQ

Cross-account access works by allowing the Digital Employee role {role-a} to assume the destination role {role-b}. The Check Permissions operation on a connector uses the same authorization chain. If the check fails, open the connector details, view the error code and message, and troubleshoot the issue based on the following sections.