Use Terraform to activate ACK and assign service roles to ACK

Prerequisites

Before you begin, ensure that you have:

• An AccessKey pair created for the RAM user you log on as

  Use a RAM user rather than your Alibaba Cloud root account. RAM users have limited permissions, which reduces security exposure if credentials are compromised.

• The following policy attached to your RAM user. This policy grants the minimum permissions needed to run the Terraform commands in this topic.

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "ram:GetRole",
          "ram:ListRoles",
          "ram:AttachPolicyToRole",
          "ram:ListPoliciesForRole",
          "ram:CreateRole",
          "ram:DetachPolicyFromRole",
          "ram:DeleteRole"
        ],
        "Resource": "*"
      }
    ]
  }

• A Terraform runtime environment set up using one of the following options:

  Option	Best for
  Explorer	Quick setup — browser-based, no installation needed
  Cloud Shell	Quick setup — Terraform pre-installed, credentials pre-configured
  Local machine	Unstable networks or custom development environments

Terraform resources used

All examples use the following Terraform resources:

Step 1: Activate ACK

1. Create a working directory and a main.tf file inside it. Copy the following content into main.tf:

   // Activate ACK.
   data "alicloud_ack_service" "open" {
       enable = "On"
       type   = "propayasgo"
   }

2. Run the following command to initialize the Terraform runtime environment:

   terraform init

   The following output confirms a successful initialization:

   Terraform has been successfully initialized!
   
   You may now begin working with Terraform. Try running "terraform plan" to see
   any changes that are required for your infrastructure. All Terraform commands
   should now work.
   
   If you ever set or change modules or backend configuration for Terraform,
   rerun this command to reinitialize your working directory. If you forget, other
   commands will detect it and remind you to do so if necessary.

3. Apply the configuration to activate ACK:

   terraform apply

   When prompted, type yes and press Enter. The following output confirms that ACK is activated:

   Apply complete!  Resources: 0 added, 0 changed, 0 destroyed.

Step 2: Assign service roles to ACK

ACK requires a set of RAM service roles before you can create clusters. These roles allow ACK components to access other Alibaba Cloud services on your behalf.

This code checks which roles already exist before creating new ones — it is safe to run multiple times. If you are re-running after an interruption, existing roles are skipped automatically.

The following table maps each service role to the ACK component it serves:

Select the roles your use case requires. You can adjust the default list in the variable block below.

1. Copy the following code block into main.tf:

   // The RAM roles to create.
   variable "roles" {
     type = list(object({
       name            = string
       policy_document = string
       description     = string
       policy_name     = string
     }))
     default = [
       {
         name            = "AliyunCSManagedLogRole"
         policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
         description     = "The logging component of ACK clusters assumes this role to access your resources in other Alibaba Cloud services."
         policy_name     = "AliyunCSManagedLogRolePolicy"
       },
       {
         name            = "AliyunCSManagedCmsRole"
         policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
         description     = "The CMS component of ACK clusters assumes this role to access your resources in other Alibaba Cloud services."
         policy_name     = "AliyunCSManagedCmsRolePolicy"
       },
       {
         name            = "AliyunCSManagedCsiRole"
         policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
         description     = "The volume plug-in of ACK clusters assumes this role to access your resources in other Alibaba Cloud services."
         policy_name     = "AliyunCSManagedCsiRolePolicy"
       },
       {
         name            = "AliyunCSManagedCsiPluginRole"
         policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
         description     = "The volume plug-in of ACK clusters assumes this role to access your resources in other Alibaba Cloud services."
         policy_name     = "AliyunCSManagedCsiPluginRolePolicy"
       },
       {
         name            = "AliyunCSManagedCsiProvisionerRole"
         policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
         description     = "The volume plug-in of ACK clusters assumes this role to access your resources in other Alibaba Cloud services."
         policy_name     = "AliyunCSManagedCsiProvisionerRolePolicy"
       },
       {
         name            = "AliyunCSManagedVKRole"
         policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
         description     = "The VK component of ACK Serverless clusters assumes this role to access your resources in other Alibaba Cloud services."
         policy_name     = "AliyunCSManagedVKRolePolicy"
       },
       {
         name            = "AliyunCSServerlessKubernetesRole"
         policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
         description     = "By default, ACK clusters assume this role to access your cloud resources."
         policy_name     = "AliyunCSServerlessKubernetesRolePolicy"
       },
       {
         name            = "AliyunCSKubernetesAuditRole"
         policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
         description     = "The auditing feature of ACK assumes this role to access your resources in other Alibaba Cloud services."
         policy_name     = "AliyunCSKubernetesAuditRolePolicy"
       },
       {
         name            = "AliyunCSManagedNetworkRole"
         policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
         description     = "The network plug-in of ACK clusters assumes this role to access your resources in other Alibaba Cloud services."
         policy_name     = "AliyunCSManagedNetworkRolePolicy"
       },
       {
         name            = "AliyunCSDefaultRole"
         policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
         description     = "By default, ACK assumes this role to access your resources in other Alibaba Cloud services when managing ACK clusters."
         policy_name     = "AliyunCSDefaultRolePolicy"
       },
       {
         name            = "AliyunCSManagedKubernetesRole"
         policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
         description     = "By default, ACK clusters assume this role to access your cloud resources."
         policy_name     = "AliyunCSManagedKubernetesRolePolicy"
       },
       {
         name            = "AliyunCSManagedArmsRole"
         policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
         description     = "The Application Real-Time Monitoring Service (ARMS) plug-in of ACK clusters assumes this role to access your resources in other Alibaba Cloud services."
         policy_name     = "AliyunCSManagedArmsRolePolicy"
       },
       {
         name            = "AliyunCISDefaultRole"
         policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
         description     = "Container Intelligence Service (CIS) assumes this role to access your resources in other Alibaba Cloud services."
         policy_name     = "AliyunCISDefaultRolePolicy"
       },
       {
         name            = "AliyunOOSLifecycleHook4CSRole"
         policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"oos.aliyuncs.com\"]}}],\"Version\":\"1\"}"
         description     = "Operation Orchestration Service (OOS) assumes this role to access your resources in other Alibaba Cloud services. ACK relies on OOS to scale node pools."
         policy_name     = "AliyunOOSLifecycleHook4CSRolePolicy"
       },
       {
         name            = "AliyunCSManagedAutoScalerRole"
         policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
         description     = "The auto scaling component of ACK clusters assumes this role to access your node pool resources in other Alibaba Cloud services."
         policy_name     = "AliyunCSManagedAutoScalerRolePolicy"
       }
     ]
   }
   
   // Query existing RAM roles.
   data "alicloud_ram_roles" "roles" {
       policy_type = "Custom"
       name_regex  = "^Aliyun.*Role$"
   }
   
   locals {
     # All role names to create.
     all_role_names = [for role in var.roles : role.name]
     # Roles that already exist.
     created_role_names  = [for role in data.alicloud_ram_roles.roles.roles : role.name]
     # Roles that need to be created (set difference).
     complement_names = setsubtract(local.all_role_names, local.created_role_names)
     # Filter the full list to only the roles that need creating.
     complement_roles = [for role in var.roles : role if contains(local.complement_names, role.name)]
   }
   
   // Create RAM roles.
   resource "alicloud_ram_role" "role" {
     for_each    = { for r in local.complement_roles : r.name => r }
     name        = each.value.name
     document    = each.value.policy_document
     description = each.value.description
     force       = true
   }
   
   // Attach system policies to RAM roles.
   resource "alicloud_ram_role_policy_attachment" "attach" {
     for_each    = { for r in local.complement_roles : r.name => r }
     policy_name = each.value.policy_name
     policy_type = "System"
     role_name   = each.value.name
     depends_on  = [alicloud_ram_role.role]
   }

2. Preview the changes:

   terraform plan

3. Apply the execution plan:

   terraform apply

   When prompted, type yes and press Enter. The following output confirms the roles were created:

   Apply complete!  Resources: 2 added, 0 changed, 0 destroyed.

Verify the results

Use either method to confirm the roles exist.

terraform show

Delete resources

To remove all resources created by Terraform, run:

terraform destroy

For more information about this command, see Common commands.

Appendix

name            = "AliyunCSManagedLogRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "The logging component of ACK clusters assumes this role to access your resources in other Alibaba Cloud services."
policy_name     = "AliyunCSManagedLogRolePolicy"

name            = "AliyunCSManagedCmsRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "The CMS component of ACK clusters assumes this role to access your resources in other Alibaba Cloud services."
policy_name     = "AliyunCSManagedCmsRolePolicy"

name            = "AliyunCSManagedCsiRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "The volume plug-in of ACK clusters assumes this role to access your resources in other Alibaba Cloud services."
policy_name     = "AliyunCSManagedCsiRolePolicy"

name            = "AliyunCSManagedCsiPluginRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "The volume plug-in (new csi-plugin) of ACK managed clusters, ACK Edge clusters, and ACK Serverless clusters assumes this role to access your resources in ECS."
policy_name     = "AliyunCSManagedCsiPluginRolePolicy"

name            = "AliyunCSManagedCsiProvisionerRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "The volume plug-in (new csi-provisioner) of ACK managed clusters, ACK Edge clusters, and ACK Serverless clusters assumes this role to access your resources in ECS, NAS, and OSS."
policy_name     = "AliyunCSManagedCsiProvisionerRolePolicy"

name            = "AliyunCSServerlessKubernetesRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "By default, ACK Serverless clusters assume this role to access your resources in other cloud services."
policy_name     = "AliyunCSServerlessKubernetesRolePolicy"

name            = "AliyunCSKubernetesAuditRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "The auditing feature of ACK assumes this role to access your resources in other Alibaba Cloud services."
policy_name     = "AliyunCSKubernetesAuditRolePolicy"

name            = "AliyunCSManagedNetworkRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "The network plug-in of ACK clusters assumes this role to access your resources in other Alibaba Cloud services."
policy_name     = "AliyunCSManagedNetworkRolePolicy"

name            = "AliyunCSDefaultRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "By default, ACK assumes this role to access your resources in other Alibaba Cloud services when managing ACK clusters."
policy_name     = "AliyunCSDefaultRolePolicy"

name            = "AliyunCSManagedKubernetesRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "By default, ACK clusters assume this role to access your cloud resources."
policy_name     = "AliyunCSManagedKubernetesRolePolicy"

name            = "AliyunCSManagedArmsRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "The ARMS plug-in of ACK clusters assumes this role to access your resources in other Alibaba Cloud services."
policy_name     = "AliyunCSManagedArmsRolePolicy"

name            = "AliyunCISDefaultRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "CIS assumes this role to access your resources in other Alibaba Cloud services."
policy_name     = "AliyunCISDefaultRolePolicy"

name            = "AliyunOOSLifecycleHook4CSRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"oos.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "OOS assumes this role to access your resources in other Alibaba Cloud services. ACK relies on OOS to scale node pools."
policy_name     = "AliyunOOSLifecycleHook4CSRolePolicy"

name            = "AliyunCSManagedAcrRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "The Secret-free image pulling component of ACK clusters assumes this role to pull images from Container Registry."
policy_name     = "AliyunCSManagedAcrRolePolicy"

name            = "AliyunCSManagedNlcRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "The managed node pool controller of ACK clusters assumes this role to access your node pool resources in ECS and ACK."
policy_name     = "AliyunCSManagedNlcRolePolicy"

name            = "AliyunCSManagedAutoScalerRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "The auto scaling component of ACK clusters assumes this role to access your node pool resources in other Alibaba Cloud services."
policy_name     = "AliyunCSManagedAutoScalerRolePolicy"

name            = "AliyunCSManagedSecurityRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "The Secret encryption component of ACK clusters assumes this role to access your node pool resources in KMS."
policy_name     = "AliyunCSManagedSecurityRolePolicy"

name            = "AliyunCSManagedCostRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "The cost analysis component of ACK clusters assumes this role to access your resources in ECS and Elastic Container Instance, and call API operations of Bills Management."
policy_name     = "AliyunCSManagedCostRolePolicy"

name            = "AliyunCSManagedNimitzRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "The network plug-in of ACK Lingjun clusters assumes this role to access your resources in Intelligent Computing LINGJUN."
policy_name     = "AliyunCSManagedNimitzRolePolicy"

name            = "AliyunCSManagedBackupRestoreRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "The backup center component of ACK clusters assumes this role to access your resources in Cloud Backup and OSS."
policy_name     = "AliyunCSManagedBackupRestoreRolePolicy"

name            = "AliyunCSManagedEdgeRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "The control component of ACK Edge clusters assumes this role to access your resources in SAG, VPC, and Cloud CEN."
policy_name     = "AliyunCSManagedEdgeRolePolicy"

What's next

• What is Terraform?

• Create a Terraform stack — deploy Terraform templates using Resource Orchestration Service (ROS) from the ROS console

References

• Terraform Init 加速方案配置

• 静态配置身份认证