Manage workload identities

Permissions

Grant operators the AliyunAgentIdentityFullAccess permission.

Create a workload identity

1. Log on to the Agent Identity console. In the navigation pane on the left, choose Workload Identity.

2. On the Workload Identity page, click Create Workload Identity.

3. On the Create Workload Identity page, enter a workload identity name.

4. Click Create Workload Identity.

Associate a RAM role

You must associate a workload identity with a RAM role that has permissions to obtain credentials from the Agent Identity data plane. This association allows your agent to obtain credentials like an STS token, an API key, or an OAuth2 access token.

To simplify RAM role creation and permission assignment, use the Create RAM Role wizard in the Agent Identity console to automatically create and authorize the RAM role. The operator must have the following RAM permissions:

• ram:ListRoles

• ram:ListPolicies

• ram:CreateRole

• ram:AttachPolicyToRole

Sample policy:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ram:ListRoles",
        "ram:ListPolicies",
        "ram:CreateRole",
        "ram:AttachPolicyToRole"
      ],
      "Resource": "*"
    }
  ]
}

1. Log on to the Agent Identity console. In the navigation pane on the left, choose Workload Identity.

2. On the Workload Identity page, click the name of the target workload identity.

3. On the workload identity details page, in the Authentication Flow section, click Associate RAM Role.

4. In the Associate RAM Role dialog box, click Create RAM Role.

5. On the Quick Authorization for Access Control page, review the RAM role to be created. You can change the role name and permission policy as needed.

   By default, the role is named workloadidentity-test-workload-identity and is granted the AliyunAgentIdentityDataGetCredentialAccess permission policy, which allows the role to obtain credentials from the Agent Identity data plane. After you confirm the settings, click Confirm Authorization.

5. Click Confirm Authorization. The system automatically creates the RAM role and configures its trust policy and permission policy.

6. Click Return to Console to go back to the workload identity details page.

7. Click Associate RAM Role again.

8. In the Associate RAM Role dialog box, select the automatically created RAM role.

9. Click OK.

Set an application callback URL

If you want your agent to obtain an OAuth2 access token from a credential provider by using Agent Identity, configure an application callback URL for the workload identity. This URL verifies the current user session to complete the token acquisition. For more information, see session binding.

1. Log on to the Agent Identity console. In the workload identity list, click the target workload identity.

2. On the workload identity details page, in the Authentication Flow section, click Set Application Callback URL.

3. In the Set Application Callback URL dialog box, click Add. Enter your application callback URL, for example, https://your-app-fqdn/callback.

4. Click OK.

Associate an identity provider

To integrate a workload identity with an external identity provider and trust its JWT tokens, you must associate the identity provider with the workload identity.

1. Log on to the Agent Identity console. In the navigation pane on the left, choose Workload Identity.

2. On the Workload Identity page, click the target workload identity.

3. On the workload identity details page, in the Authentication Flow section, under Identity Provider, click Associate Identity Provider.

4. In the Associate Identity Provider dialog box, select your configured identity provider from the drop-down list. If you do not have an identity provider, see Create an identity provider.

5. Click OK.

Delete a workload identity

1. Log on to the Agent Identity console. In the navigation pane on the left, choose Workload Identity.

2. On the Workload Identity page, find the workload identity that you want to delete, and in the Actions column, click Delete Workload Identity.

3. In the Delete Workload Identity dialog box, enter the workload identity name to confirm, and then click Delete Workload Identity.