CloudOps Orchestration Service：ACS-RAM-ApproveAttachPolicyToUser

Nama Template

ACS-RAM-ApproveAttachPolicyToUser

Eksekusi Sekarang

Deskripsi Template

Melampirkan kebijakan kustom ke pengguna RAM setelah mendapatkan persetujuan izin.

Tipe Template

Otomatis

Pemilik

Alibaba Cloud

Parameter Input

Parameter Output

Kebijakan Izin yang Diperlukan untuk Menjalankan Template

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "ram:GetPolicy"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "ros:CreateStack",
                "ros:GetStack"
            ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

Referensi

ACS-RAM-ApproveAttachPolicyToUser

Isi Template

FormatVersion: OOS-2019-06-01
Description:
  en: Attach policy to user that template executed by after approving
  name-en: ACS-RAM-ApproveAttachPolicyToUser   
  categories:
    - security
Parameters:
  policyType:
    Label:
      en: TpolicyType      
    Description:
      en: The policy type to add, the optioanl is Custom or System      
    Type: String
    AllowedValues:
      - Custom
      - System
  policyName:
    Label:
      en: PolicyName    
    Type: String
  webHookUrl:
    Label:
      en: WebHookUrl       
    Description:
      en: >-
        e.g.https://oapi.dingtalk.com/robot/send?access_token=1234zxcvaksdq31414,acquiring DingTalk webhook please refer to second appendix in https://www.alibabacloud.com/help/en/oos/use-cases/use-oos-to-configure-the-approval-process?spm=a3c0i.23458820.2359477120.1.55a06e9bkNIXn3.       
    Type: String
  atMobiles:
    Label:
      en: AtMobiles       
    Description:
      en: The dingtalk phone numbers of who be @ in notification,e.g.138ALBB1234       
    Type: List
  atAll:
    Label:
      en: AtAll       
    Description:
      en: 'Whether assistant @ all members in dingtalk group or not notification comes'      
    Type: String
    Default: 'false'
  approvers:
    Label:
      en: Approvers       
    Description:
      en: The name to fill is the front part of @ in the RAM user name,if  RAM user is user001@companyAlias.onaliyun.com, then fill  user001  in list       
    Type: List
    AssociationProperty: ALIYUN::RAM::User
  minRequiredApprovals:
    Label:
      en: MinRequiredApprovals       
    Type: Number
    Default: 1
  OOSAssumeRole:
    Label:
      en: OOSAssumeRole       
    Type: String
    Default: ''
RamRole: '{{ OOSAssumeRole }}'
Tasks:
  - Name: approveAttachPolicy
    Action: 'ACS::Approve'
    Description:
      en: Approve task add policy     
    Properties:
      Approvers: '{{approvers}}'
      MinRequiredApprovals: '{{minRequiredApprovals}}'
      NotifyType: WebHook
      WebHook:
        URI: '{{webhookUrl}}'
        Headers:
          Content-Type: application/json
        Content:
          msgtype: text
          text:
            content: |
              Notice: Please approve the task execution to attach {{policyType}} policy {{policyName}}
              for target user {{ACS::ExecuteUser}}
              sent by {{ACS::RegionId}} oos {{ACS::ExecutionId}}
          at:
            atMobiles: '{{atMobiles}}'
            isAtAll: '{{atAll}}'
  - Name: checkPolicyExist
    Action: ACS::CheckFor
    Description:
      en: Check for the existence of policy       
    Properties:
      Service: RAM
      API: GetPolicy
      Parameters:
        PolicyType: '{{ policyType }}'
        PolicyName: '{{ policyName }}'
      DesiredValues:
      - 'true'
      PropertySelector: '.DefaultPolicyVersion != null|tostring'
    Outputs:
      policyDocumentToAttach:
          Type: Json
          ValueSelector: .DefaultPolicyVersion.PolicyDocument
  - Name: createStack
    Action: 'ACS::Template'
    Description:
      en: Attach policy by Ros resource stack      
    Properties:
      TemplateName: 'ACS::ROS::CreateStack'
      Parameters:
        stackName:
          Fn::Replace:
            - .: _
            - OOS-{{ACS::ExecutionId}}
        disableRollback: true
        parameters:
          - ParameterKey: PolicyType
            ParameterValue: '{{ policyType }}'
          - ParameterKey: UserName
            ParameterValue: '{{ACS::ExecuteUser}}'
          - ParameterKey: PolicyName
            ParameterValue: '{{ policyName }}'
        templateBody: |
          {
            "Parameters": {
              "PolicyType": {
                "Type": "String",
                "Description": "Authorization policy type. Value: \"System\" or \"Custom\"."
              },
              "UserName": {
                "Type": "String",
                "Description": "User name."
              },
              "PolicyName": {
                "Type": "String",
                "Description": "Authorization policy name."
              }
            },
            "ROSTemplateFormatVersion": "2015-09-01",
            "Outputs": {},
            "Resources": {
              "AttachPolicyToUser": {
                "Type": "ALIYUN::RAM::AttachPolicyToUser",
                "Properties": {
                  "PolicyType": {
                    "Ref": "PolicyType"
                  },
                  "UserName": {
                    "Ref": "UserName"
                  },
                  "PolicyName": {
                    "Ref": "PolicyName"
                  }
                }
              }
            },
            "Metadata": {
              "ALIYUN::ROS::Interface": {
                "TemplateTags": [
                  "acs:integrate:oos:ram_approve_attach_policy_to_user"
                ]
              }
            }
          }
    Outputs:
      stackId:
        Type: String
        ValueSelector: stackId
Outputs:
  statement:
    Type: Json
    Value: "{{ checkPolicyExist.policyDocumentToAttach }}"
  stackId:
    Type: String
    Value: '{{createStack.stackId}}'