ACS-RAM-ApproveAttachPolicyToUser

Template name

ACS-RAM-ApproveAttachPolicyToUser

Execute Now

Template description

Attaches a custom policy to the RAM user who creates executions after permission approval.

Template type

Automated

Owner

Alibaba Cloud

Input parameters

Parameter	Description	Data type	Required	Default value	Limit
policyType	The custom policy type.	String	Yes
policyName	The policy name.	String	Yes
webHookUrl	The webhook URL of the DingTalk chatbot.	String	Yes
atMobiles	None.	List	Yes
approvers	The permission approvers.	List	Yes
atAll	Specifies whether to @ all members in the notification.	String	No	false
minRequiredApprovals	The minimum number of approvers required.	Number	No	1
OOSAssumeRole	The RAM role assumed by CloudOps Orchestration Service (OOS).	String	No	""

Output parameters

Parameter	Description	Data type
statement		Json
stackId		String

Permission policy that is required to execute the template

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "ram:GetPolicy"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "ros:CreateStack",
                "ros:GetStack"
            ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

References

ACS-RAM-ApproveAttachPolicyToUser

Template content

FormatVersion: OOS-2019-06-01
Description:
  en: Attach policy to user that template executed by after approving
  name-en: ACS-RAM-ApproveAttachPolicyToUser   
  categories:
    - security
Parameters:
  policyType:
    Label:
      en: TpolicyType      
    Description:
      en: The policy type to add, the optioanl is Custom or System      
    Type: String
    AllowedValues:
      - Custom
      - System
  policyName:
    Label:
      en: PolicyName    
    Type: String
  webHookUrl:
    Label:
      en: WebHookUrl       
    Description:
      en: >-
        e.g.https://oapi.dingtalk.com/robot/send?access_token=1234zxcvaksdq31414,acquiring DingTalk webhook please refer to second appendix in https://www.alibabacloud.com/help/en/oos/use-cases/use-oos-to-configure-the-approval-process?spm=a3c0i.23458820.2359477120.1.55a06e9bkNIXn3.       
    Type: String
  atMobiles:
    Label:
      en: AtMobiles       
    Description:
      en: The dingtalk phone numbers of who be @ in notification,e.g.138ALBB1234       
    Type: List
  atAll:
    Label:
      en: AtAll       
    Description:
      en: 'Whether assistant @ all members in dingtalk group or not notification comes'      
    Type: String
    Default: 'false'
  approvers:
    Label:
      en: Approvers       
    Description:
      en: The name to fill is the front part of @ in the RAM user name,if  RAM user is user001@companyAlias.onaliyun.com, then fill  user001  in list       
    Type: List
    AssociationProperty: ALIYUN::RAM::User
  minRequiredApprovals:
    Label:
      en: MinRequiredApprovals       
    Type: Number
    Default: 1
  OOSAssumeRole:
    Label:
      en: OOSAssumeRole       
    Type: String
    Default: ''
RamRole: '{{ OOSAssumeRole }}'
Tasks:
  - Name: approveAttachPolicy
    Action: 'ACS::Approve'
    Description:
      en: Approve task add policy     
    Properties:
      Approvers: '{{approvers}}'
      MinRequiredApprovals: '{{minRequiredApprovals}}'
      NotifyType: WebHook
      WebHook:
        URI: '{{webhookUrl}}'
        Headers:
          Content-Type: application/json
        Content:
          msgtype: text
          text:
            content: |
              Notice: Please approve the task execution to attach {{policyType}} policy {{policyName}}
              for target user {{ACS::ExecuteUser}}
              sent by {{ACS::RegionId}} oos {{ACS::ExecutionId}}
          at:
            atMobiles: '{{atMobiles}}'
            isAtAll: '{{atAll}}'
  - Name: checkPolicyExist
    Action: ACS::CheckFor
    Description:
      en: Check for the existence of policy       
    Properties:
      Service: RAM
      API: GetPolicy
      Parameters:
        PolicyType: '{{ policyType }}'
        PolicyName: '{{ policyName }}'
      DesiredValues:
      - 'true'
      PropertySelector: '.DefaultPolicyVersion != null|tostring'
    Outputs:
      policyDocumentToAttach:
          Type: Json
          ValueSelector: .DefaultPolicyVersion.PolicyDocument
  - Name: createStack
    Action: 'ACS::Template'
    Description:
      en: Attach policy by Ros resource stack      
    Properties:
      TemplateName: 'ACS::ROS::CreateStack'
      Parameters:
        stackName:
          Fn::Replace:
            - .: _
            - OOS-{{ACS::ExecutionId}}
        disableRollback: true
        parameters:
          - ParameterKey: PolicyType
            ParameterValue: '{{ policyType }}'
          - ParameterKey: UserName
            ParameterValue: '{{ACS::ExecuteUser}}'
          - ParameterKey: PolicyName
            ParameterValue: '{{ policyName }}'
        templateBody: |
          {
            "Parameters": {
              "PolicyType": {
                "Type": "String",
                "Description": "Authorization policy type. Value: \"System\" or \"Custom\"."
              },
              "UserName": {
                "Type": "String",
                "Description": "User name."
              },
              "PolicyName": {
                "Type": "String",
                "Description": "Authorization policy name."
              }
            },
            "ROSTemplateFormatVersion": "2015-09-01",
            "Outputs": {},
            "Resources": {
              "AttachPolicyToUser": {
                "Type": "ALIYUN::RAM::AttachPolicyToUser",
                "Properties": {
                  "PolicyType": {
                    "Ref": "PolicyType"
                  },
                  "UserName": {
                    "Ref": "UserName"
                  },
                  "PolicyName": {
                    "Ref": "PolicyName"
                  }
                }
              }
            },
            "Metadata": {
              "ALIYUN::ROS::Interface": {
                "TemplateTags": [
                  "acs:integrate:oos:ram_approve_attach_policy_to_user"
                ]
              }
            }
          }
    Outputs:
      stackId:
        Type: String
        ValueSelector: stackId
Outputs:
  statement:
    Type: Json
    Value: "{{ checkPolicyExist.policyDocumentToAttach }}"
  stackId:
    Type: String
    Value: '{{createStack.stackId}}'