Securely share resources with third parties
In daily cloud operations, resource sharing often extends beyond your organization. You may need to grant third parties access to manage some of your data and resources. For example, software vendors or Managed Service Providers (MSPs) might need to access your cloud resources to deploy software or perform daily operations management. Follow the principle of least privilege. Use fine-grained authorization and temporary credentials, such as Security Token Service (STS) tokens, to securely share resources with trusted third parties.
Priority
Medium
Practices to avoid
Do not provide fixed credentials, such as an AccessKey or a plaintext username and password, directly to third parties to access or manage your resources. This increases the risk of credential leakage.
Do not use the default trust policy without an `ExternalId` condition when you grant a third party a RAM role to assume. This can lead to the confused deputy problem.
Implementation guide
Use cross-account role assumption to allow third parties to access your cloud resources. Third-party vendors typically access resources in one of the following ways. For any method, grant a RAM role to the third party and have them use cross-account role assumption to access your resources.
Access through the console. The third party can log on to the console using their own Alibaba Cloud account. They can then switch to the RAM role under your account to access your cloud resources. For more information, see How to assume a RAM role.
Access through code. The third party can use their own Alibaba Cloud identity credentials, such as an AccessKey, to call the AssumeRole API operation. This allows them to assume the RAM role under your account and obtain its temporary credentials as an STS token. They can then use the STS token to access your cloud resources. For more information, see Assume a RAM role.
Third parties can access enterprise cloud resources using the Alibaba Cloud CLI. We recommend that they use their own Alibaba Cloud identity credentials, such as an AccessKey, and assume a role across accounts. For more information about how to configure the
RamRoleArnidentity credential, see Configure identity credentials in the Alibaba Cloud CLI.
It is important to add an `ExternalId` to the trust policy of the RAM role that you provide to a third party. This helps prevent the confused deputy problem. A third-party vendor may need to access the Alibaba Cloud accounts of multiple customers. You and the vendor must agree on a random and unique `ExternalId` that represents your enterprise. Add this `ExternalId` to the trust policy of the RAM role. When the third party calls the AssumeRole API operation to assume the role, they must provide this `ExternalId`. The call fails if the `ExternalId` is missing or incorrect. This prevents an attacker from impersonating another customer to trick the vendor into accessing the wrong resources.
Follow the best practice Periodically review public and cross-account access. Use access analytics to regularly review and identify external access. Promptly address any external access caused by improper resource sharing to ensure the security of your assets and data.
For scenarios where you must use a fixed credential such as an AccessKey, follow the best practice Centrally manage fixed credentials. For example, you may need to do this if a cloud product that a third party manages does not support RAM roles or STS tokens. This helps you avoid providing a plaintext AccessKey directly to the third party.