DocsICP FilingConsole
Documentation
Home Page Compute Nest Security and Compliance Use RAM for access control Grant supplier permissions to a RAM user

Grant supplier permissions to a RAM user

Updated at:
Copy as MD
Product
My Favorites

By default, a RAM user has no permissions when logging on to the Compute Nest console. You must grant permissions to the RAM user to prevent access errors. This topic explains how to grant supplier permissions to a RAM user.

Prerequisites

A RAM user has been created. For more information, see Create a RAM user.

Background information

  • A RAM user is created by an Alibaba Cloud account, another RAM user with administrative permissions, or a RAM role. A RAM user belongs to an Alibaba Cloud account and is not an independent Alibaba Cloud account.

  • A RAM user has their own logon password or access keys. You can create multiple RAM users within a single Alibaba Cloud account.

  • A RAM user requires permissions to log on to the console and create service instances. You can grant permissions by attaching policies to the RAM user based on your business requirements.

    If the RAM user only needs to log on to the Compute Nest console, you only need to grant the system permissions for Compute Nest. Compute Nest provides the following two system policies:

    • AliyunComputeNestSupplierFullAccess: Grants supplier permissions to manage Compute Nest. This policy allows the user to view and edit supplier views.

    • AliyunComputeNestSupplierReadOnlyAccess: Grants read-only supplier access to Compute Nest. This policy allows the user to view, but not edit, supplier views.

    If you need to create service instances, in addition to the AliyunComputeNestSupplierFullAccess policy, you must also grant cloud resource permissions. Cloud resource permissions are divided into required and optional permissions.

    • The required cloud resource permissions, which are needed to create all service instances, are as follows:

      • AliyunVPCFullAccess: Grants full permissions on VPC.

      • AliyunECSFullAccess: Grants full permissions on ECS.

      • AliyunTagAdministratorAccess: Grants permissions to manage the tag service and tags for all Alibaba Cloud services.

      • AliyunCloudMonitorFullAccess: Grants full permissions on CloudMonitor.

      • AliyunROSFullAccess: Grants full permissions on ROS.

    • Grant optional permissions if a service instance requires additional cloud resources. For example, if creating a service instance requires an EIP, you must first grant the AliyunEIPFullAccess policy, which provides full permissions on EIPs. For details about the authorization process, see the following procedure. For a list of Alibaba Cloud services that support RAM, see Services that work with RAM.

Procedure

  1. Log on to the RAM console using your Alibaba Cloud account or as a RAM administrator.

  2. In the left-side navigation pane, choose Identities > Users.

  3. On the Users page, find the target RAM user and click Add Permissions in the Actions column.

  4. On the Grant Permission page, configure the permissions for the RAM user.

    1. Select a resource scope.

    2. Select the principal.

      The principal is the RAM user who receives the permissions. The current RAM user is selected by default.

    3. Select policies.

      • Supplier permissions to manage Compute Nest: Select AliyunComputeNestSupplierFullAccess from the system policies.

      • User permissions to manage Compute Nest: Select AliyunComputeNestUserFullAccess from the system policies.

      • Read-only supplier access to Compute Nest: Select AliyunComputeNestSupplierReadOnlyAccess from the system policies.

      • Read-only user access to Compute Nest: Select AliyunComputeNestUserReadOnlyAccess from the system policies.

  5. Click OK.

    The results page shows a Completed status, which confirms that the policy was attached successfully.

Previous：Grant PassRole permission to a RAM userNext：Grant permissions to a RAM user