How do other users grant my function permissions to access other resources?-Function Compute(FC)-阿里云帮助中心

When User A owns a cloud resource and wants to allow a function owned by User B to access it, User A grants access by creating a Resource Access Management (RAM) role that trusts User B's Function Compute service principal. User B's function then assumes that role at runtime to retrieve temporary credentials.

How it works

User A creates a RAM role that trusts User B's Function Compute service principal and attaches the required resource policies to it. User A then sets this RAM role as the service role.
User B's function calls context.credentials to assume the RAM role created in step 1 and retrieves temporary credentials.
User B's function uses those credentials to access User A's cloud resources.

Grant cross-account access

Step 1 (User A): Create and configure a RAM role

Log on to the RAM console using User A's account.
Create a RAM role. When configuring the trusted entity, set the authorized user to:
```
user-B@fc.aliyuncs.com
```
Attach a permission policy to the RAM role that grants access only to the specific resources User B's function needs.
Follow the principle of least privilege — grant only the permissions the function requires. Overly broad policies expose User A's resources to unnecessary risk.
Set the RAM role as the service role.

Step 2 (User B): Assume the role in your function

Call context.credentials in your function code to retrieve temporary credentials for the RAM role.

Step 3 (User B): Access User A's resources

Initialize the SDK client for the target resource using the credentials from step 2. The function can access User A's resources within the scope of the permissions attached to the RAM role.

Notes

This pattern applies to any Alibaba Cloud resource. For example, if you need to deliver Simple Log Service logs from User A's account to an Object Storage Service (OSS) bucket in User B's account, configure the RAM role in User A's account following the same steps.