Use a RAM role to access ARMS resources across Alibaba Cloud accounts

ARMS permission policies

ARMS provides two system policies. Choose the one that matches the access level the delegated account needs.

If you attach AliyunARMSFullAccess, you do not need to attach AliyunARMSReadOnlyAccess separately.

Prerequisites

Before you begin, make sure that you have:

• Two Alibaba Cloud accounts: one that owns the ARMS resources (resource owner) and one that needs access (delegated account)

• RAM administrator permissions on both accounts

• The Alibaba Cloud account ID of the delegated account (find it on the Security Settings page)

Step 1: Create a RAM role (resource owner)

Create a RAM role under the resource owner's account that the delegated account can assume.

1. Log on to the RAM console with a RAM administrator account.

2. In the left-side navigation pane, choose Identities > Roles.

3. On the Roles page, click Create Role.

4. Set Principal Type to Cloud Account and select Other Account. Enter the Alibaba Cloud account ID of the delegated account, then click OK.

   • Select Current Account if a RAM user or role within the same account needs to assume this role.

   • Select Other Account for cross-account access. Find the account ID on the Security Settings page.

5. (Optional) Restrict which principals can assume the role. Click Switch to Policy Editor and modify the trust policy. The editor supports both Visual editor and JSON modes. The following JSON example restricts role assumption to the RAM user Alice under account 100******0719:

      {
        "Version": "1",
        "Statement": [
          {
            "Effect": "Allow",
            "Principal": {
              "RAM": "acs:ram::100******0719:user/Alice"
            },
            "Action": "sts:AssumeRole"
          }
        ]
      }

6. Enter a Role Name and click OK.

Step 2: Grant ARMS permissions to the RAM role (resource owner)

The RAM role has no permissions by default. Attach an ARMS policy to define what the delegated account can access.

1. Log on to the RAM console as a RAM administrator.

2. In the left-side navigation pane, choose Identities > Roles.

3. Find the RAM role created in Step 1 and click Grant Permission in the Actions column. You can also select multiple RAM roles and click Grant Permission in the lower part of the role list to grant permissions to multiple RAM roles at a time.

4. In the Grant Permission panel, configure the following parameters:

   • Resource Scope: Select Account to apply permissions across the entire account, or Resource Group to limit permissions to a specific resource group. > Note: If you select Resource Group, make sure the cloud service supports resource groups. For more information, see Services that work with Resource Group.

   • Principal: The current RAM role is automatically selected.

   • Policy: Search for and select the ARMS policy that matches the required access level. You can select multiple policies at a time. See the ARMS permission policies section above for details. > Note: Avoid attaching high-risk system policies such as AdministratorAccess or AliyunRAMFullAccess unless absolutely necessary.

     • System policies: Policies created by Alibaba Cloud. You can use but cannot modify these policies. For more information, see Services that work with RAM.

     • Custom policies: You can create, update, and delete custom policies based on your business requirements. For more information, see Create a custom policy.

5. Click Grant permissions, then click Close.

Step 3: Create a RAM user (delegated account)

Create a RAM user under the delegated account that will assume the cross-account role.

If the delegated account already has a suitable RAM user, skip to Step 4.

1. Log on to the RAM console with the delegated Alibaba Cloud account or a RAM user with administrative rights.

2. In the left-side navigation pane, choose Identities > Users.

3. On the Users page, click Create User.

4. In the User Account Information section, configure:

   You can click Add User to create multiple RAM users at a time.

   Parameter	Description
   Logon Name	Up to 64 characters. Supports letters, digits, periods (.), hyphens (-), and underscores (_).
   Display Name	Up to 128 characters.
   Tag (Optional)	Add one or more tags to organize RAM users.

5. In the Access Mode section, select the access mode based on how the RAM user will access ARMS. To ensure the security of your Alibaba Cloud account, we recommend that you select only one access mode for the RAM user.

   • Console Access: Select this mode if the RAM user represents an individual who accesses ARMS through the Alibaba Cloud console. Configure the following parameters:

     • Set Console Password: Select Automatically Regenerate Default Password or Reset Custom Password. If you select Reset Custom Password, you must specify a password that meets the complexity requirements. For more information, see Configure a password policy for RAM users.

     • Password Reset: Specify whether the RAM user must reset the password upon the next logon.

     • Enable MFA: Specify whether to enable multi-factor authentication (MFA) for the RAM user. After you enable MFA, you must bind an MFA device to the RAM user. For more information, see Bind an MFA device to a RAM user.

   • Using permanent AccessKey to access: Select this mode if the RAM user represents a program that accesses ARMS programmatically through API. The system automatically generates an AccessKey pair (AccessKey ID and AccessKey secret). For more information, see Obtain an AccessKey pair. > Important: The AccessKey secret is displayed only once during creation. Save it immediately. An AccessKey pair is a permanent credential for application access. If an AccessKey pair is leaked, the resources that belong to the account are exposed to potential risks. For production workloads, use STS temporary credentials instead. For more information, see Best practices for using an access credential to call API operations.

6. Click OK and complete the security verification.

Step 4: Grant the RAM user permission to assume the role (delegated account)

Attach the AliyunSTSAssumeRoleAccess policy to the RAM user so it can assume the cross-account role.

1. Log on to the RAM console as a RAM administrator.

2. In the left-side navigation pane, choose Identities > Users.

3. Find the target RAM user and click Add Permissions in the Actions column. You can also select multiple RAM users and click Add Permissions in the lower part of the page to grant permissions to multiple RAM users at a time.

4. In the Grant Permission panel, configure the following parameters:

   • Resource Scope: Select Account to apply permissions across the entire account, or Resource Group to limit permissions to a specific resource group. > Important: If you select Resource Group, make sure the cloud service supports resource groups. For more information, see Services that work with Resource Group. For more information about how to grant permissions on a resource group, see Use a resource group to grant a RAM user the permissions to manage a specific ECS instance.

   • Principal: The current RAM user is automatically selected.

   • Policy: Search for and select AliyunSTSAssumeRoleAccess. You can select multiple policies at a time. > Note: Avoid attaching high-risk system policies such as AdministratorAccess or AliyunRAMFullAccess unless absolutely necessary.

     • System policies: Policies created by Alibaba Cloud. You can use but cannot modify these policies. For more information, see Services that work with RAM.

     • Custom policies: You can create, update, and delete custom policies based on your business requirements. For more information, see Create a custom policy.

5. Click Grant permissions, then click Close.

Access ARMS resources as the delegated account

After you complete the setup, the RAM user under the delegated account can access ARMS resources owned by the resource owner through either the console or API.

Verify cross-account access

After setup, verify that the delegated account can access ARMS resources:

1. Console verification: Log on as the RAM user, assume the cross-account role, and confirm that the ARMS console displays the resource owner's application data.

2. API verification: Call the STS AssumeRole API with the RAM user's credentials and the RAM role ARN. Confirm that the response returns valid temporary credentials and that subsequent ARMS API calls succeed.

If access fails, check the following:

Related topics

• Create a custom policy -- define fine-grained ARMS permissions beyond the system policies

• Use a RAM role to grant permissions across Alibaba Cloud accounts -- general RAM cross-account setup guide

• Configure a password policy for RAM users

• Bind an MFA device to a RAM user -- strengthen account security