Use a function role to access other cloud services

Step 1: Create a role and grant permissions

1. Log on to the RAM console. In the left-side navigation pane, choose Roles > Create Role.

2. On the Create Role page, select Cloud Service for Principal Type and Function Compute / FC for Principal Name. Then, click OK.

3. In the Create Role dialog box that appears, set the Role Name, such as mytestrole, and then click OK. This redirects you to the role details page.

4. On the Permissions tab, click Grant Permission. In the Grant Permission panel, follow these steps to grant permissions to the role.

5. Select the Resource Scope. The Principal is the target role by default. From the policy list, select the check box next to a system or custom policy to add it to the Selected Policies list. Then, click OK. For more information, see Policies and examples.

   • Account: The permissions take effect within the current Alibaba Cloud account.

   • Resource Group: The permissions take effect within the specified resource group. This option is available only if the cloud service supports resource groups. For more information, see Cloud services that support resource groups.

   In this example, to manage OSS, you must add the AliyunOSSFullAccess system policy to the new role.

Step 2: Bind the role to the target function

1. Log on to the Function Compute console. In the left-side navigation pane, choose Function Management > Functions.

2. In the top menu bar, select a region. On the Functions page, find the target function and click Configuration in the Actions column.

3. On the function details page, select the Configuration tab. In the Advanced Settings section, click Modify. In the Advanced Settings panel, expand the Permissions section. For Function Role, select the mytestrole role that you created in Step 1. Then, click Deploy.

Step 3: Test the function

Test whether the function associated with the mytestrole role has permissions to manage OSS.

1. On the function list page, click the target function. On the Code tab, click the arrow next to Test Function and select Configure Test Parameters. The following is a sample test event.

   {
      "endpoint": "http://oss-cn-hangzhou.aliyuncs.com",
      "bucket": "web****",
      "objectName": "myObj",
      "message": "your-message"
   }

   In this example, replace the value of bucket with the name of your bucket, which must be in the same region as the function.

2. On the Code tab, enter the code in the code editor, and then click Deploy.

   This example uses the Python runtime. The code uses the temporary credentials provided by Function Compute to access OSS.

   import json
   import oss2
   def handler(event, context):
       evt = json.loads(event)
       creds = context.credentials
       # Use the temporary credentials injected by Function Compute.
       # Your Alibaba Cloud account AccessKey pair grants full access to all API operations. 
       # We recommend that you use a RAM user for API access and routine O&M.
       # To prevent security risks, do not hardcode the AccessKey ID and AccessKey secret in your project code.
       # This example shows how to obtain the AccessKey ID and AccessKey secret from the context.
       auth = oss2.StsAuth(creds.access_key_id, creds.access_key_secret, creds.security_token)
       bucket = oss2.Bucket(auth, evt['endpoint'], evt['bucket'])
       bucket.put_object(evt['objectName'], evt['message'])
       return 'success'

3. Click Test Function. After the function executes successfully, log on to the OSS console, find the target bucket, and verify that the target object's content is updated to the value of the message parameter from the test event.