CCN authorization

Scenario 1: Same-account authorization

Scenario 2: Cross-account CCN instance

1. Log on to the CEN console.

2. Click the ID of the target CEN instance.

3. On the Basic Information > Transit Router tab, find the transit router in the target region and click its instance ID.

4. Click the Access Private Zone tab and then click Authorization. Follow the on-screen instructions to complete the authorization.

   Note

   You only need to authorize SAG when you first configure access to PrivateZone.

5. Log on to the RAM console.

6. In the left-side navigation pane, choose Role.

7. In the search box, enter AliyunSmartAGAccessingPVTZRole to find the role, and then click the role name.

8. Click the Trust Policy tab and then click Edit Trust Policy.

   The trust policy sets the Action parameter to sts:AssumeRole, the Effect parameter to Allow, and the Principal.Service parameter to smartag.aliyuncs.com.

9. In the Service field, add a "CCN owner account ID@smartag.aliyuncs.com" record, and then click Save trust policy document.

Scenario 3: Cross-account CEN instance

1. Use the account that owns the VPC to log on to the RAM console.

2. In the left-side navigation pane, choose Role.

3. Create a RAM role with the following settings, and then click OK. For more information, see Create a RAM role for a trusted Alibaba Cloud service.

   • Select Trusted Entity: Select Alibaba Cloud Service.

   • Role Type: Select Normal Service Role.

   • RAM Role Name: Enter AliyunSmartAGAccessingPVTZRole.

   • Select Trusted Service: Select Smart Access Gateway.

4. After the role is created, click Roles in the left-side navigation pane, and then click the name of the RAM role in the Role Name column.

5. On the Permissions tab, click Grant Permission.

6. In the System Policy section, enter pvtz in the search box, select the AliyunPvtzReadOnlyAccess policy to grant read-only access to PrivateZone, and then click OK. For more information, see Grant permissions to a RAM role.

7. After the permissions are granted, click the Trust Policy tab to view the authorization information.

   The trust policy sets the Action parameter to sts:AssumeRole, the Effect parameter to Allow, the Principal.Service parameter to smartag.aliyuncs.com, and the Version parameter to 1.

Scenario 4: All resources are in different accounts

1. Refer to the procedure in Scenario 3. Use the account that owns the VPC to create a RAM role and grant the required permissions.

   For more information, see Scenario 3: Cross-account CEN instance. Create the AliyunSmartAGAccessingPVTZRole RAM role and configure its Trust Policy. The policy sets Action to sts:AssumeRole, Effect to Allow, Principal.Service to smartag.aliyuncs.com, and Version to 1. This policy allows the SAG service to assume this role to access PrivateZone.

2. Follow the procedure in Scenario 2 to add the CCN service to the trust policy by using the account that owns the VPC. The entry must be in the format "<CCN_account_UID>@smartag.aliyuncs.com".

   For more information, see Scenario 2: Cross-account CCN instance.

   {
       "Statement": [
           {
               "Action": "sts:AssumeRole",
               "Effect": "Allow",
               "Principal": {
                   "Service": [
                       "smartag.aliyuncs.com",
                       "333333@smartag.aliyuncs.com"
                   ]
               }
           }
       ],
       "Version": "1"
   }

{
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Effect": "Allow",
      "Principal": {
        "Service": [
          "smartag.aliyuncs.com",
          "333333@smartag.aliyuncs.com",
          "444444@smartag.aliyuncs.com",
          "555555@smartag.aliyuncs.com"
        ]
      }
    }
  ],
  "Version": "1"
}