Cross-account access by using a RAM role-Resource Access Management(RAM)-阿里云帮助中心

To authorize another enterprise to manage your business operations, use RAM roles to grant cross-account access to your resources.

Scenarios

Company A runs its business on multiple Alibaba Cloud services, such as ECS instances, ApsaraDB RDS instances, SLB instances, and OSS buckets. Company A wants to:

Delegate resource operations and management to Company B.
Avoid permission changes when Company B's employees join or leave. Company B can independently grant its employees and applications fine-grained access to Company A's resources.
Revoke authorization for Company B at any time if the contract ends.

Solution

Suppose Company A has Alibaba Cloud account A (A@company-a.onaliyun.com) and Company B has Alibaba Cloud account B (B@company-b.onaliyun.com). A RAM role lets Account B access resources in Account A.

In Account A, create a RAM role that trusts all RAM identities in Account B, and grant it the required permissions, such as ECS management. In Account B, create a RAM user and grant the RAM user permission to assume the role. Account A defines the trusted entity and role permissions, while Account B controls which RAM users can assume the role.

For more information, see Grant permissions across Alibaba Cloud accounts .
When the partnership ends, Account A revokes Account B's permission to assume the RAM role. After revocation, no RAM users in Account B can assume the role or access Account A's resources.

For more information, see Revoke permissions across Alibaba Cloud accounts.

Grant permissions across Alibaba Cloud accounts

In Account A, create a RAM role that specifies Account B as the trusted entity.
1. Log on to the RAM console by using Account A.
2. On the Roles page, create a RAM role.
  
  For Principal Type, select Cloud Account. For Principal Name, select Other Account and enter the ID of Account B. For more information, see Create a RAM role for a trusted Alibaba Cloud account and Modify basic information about an account.
From Account A, grant permissions to the RAM role.

On the Roles page or the Grants page, attach a system policy or custom policy to the RAM role. You must follow the principle of least privilege and grant only the necessary permissions. For example, if you want the RAM role to manage ECS instances, you can attach the AliyunECSFullAccess system policy. For more information, see Manage permissions for a RAM role.
In Account B, create a RAM user.
1. Log on to the RAM console by using Account B.
2. On the Users page, create a RAM user.
  
  For more information, see Create a RAM user.
In Account B, grant the RAM user permission to assume the role.

On the Users page or the Grants page, attach the AliyunSTSAssumeRoleAccess system policy to the RAM user. For more information, see Manage RAM user permissions.
A RAM user in Account B can access the authorized resources in Account A by assuming the role.

You can assume the role in one of the following ways:
- Assume a RAM role in the console
  
  After logging on to the console, the user can assume the RAM role by choosing Switch Identity.
- Assume a RAM role by using the API
  
  The RAM user calls the AssumeRole API operation with an AccessKey pair to obtain an STS token for the RAM role.

Revoke permissions across Alibaba Cloud accounts

Account A can revoke Account B's permission to assume the RAM role by using one of the following methods:

Modify the trust policy of the RAM role
1. Log on to the RAM console by using Account A.
2. On the Roles page, modify the trust policy of the role.
  
  Modify the Principal field to revoke trust for Account B. For more information, see Modify the trust policy of a RAM role.
  
  The trust policy is in JSON format. The RAM array under Principal contains the ARNs of trusted principals in the format acs:ram::<AccountUID>:root. To revoke trust, find and delete the ARN entry that corresponds to Account B.
Delete the RAM role
1. Log on to the RAM console by using Account A.
2. On the Roles page, delete the RAM role.
  
  When you delete a RAM role, the permissions attached to the role are also removed. For more information, see Delete a RAM role.