How to use instance RAM role through API after activating RAM service

This article introduces how to use the instance RAM role through the API after activating the RAM service, and focuses on the operation steps.

Using the instance RAM role through the API

Usage restrictions

##The use of the instance RAM role has the following restrictions:

Only ECS instances of the private network (VPC) network type can use the instance RAM role.

An ECS instance can only be granted the RAM role to one instance at a time.

When you have granted the instance RAM role to an ECS instance and want to access the API of the cloud product in an application deployed within the ECS instance, you need to obtain the temporary authorization token of the instance RAM role through the instance metadata. . See 5. (Optional) Obtain temporary authorization token.

If you use the RAM user sub-account to use the instance RAM role, you need to authorize the RAM user to use the instance RAM role through the cloud account 6. (Optional).

Prerequisite

You have already activated the RAM service. Please refer to the RAM document for activation methods to activate the RAM service.

1. Create an instance RAM role

Call the interface CreateRole to create an instance RAM role.

Set the RoleName parameter, such as setting its value to EcsRamRoleDocumentTesting.

Set the AssumeRolePolicyDocument according to the following policy:

{
"Statement": [
{
"Action": "sts:AssumeRole",
"Effect": "Allow",
"Principal": {
"Service": [
"ecs.aliyuncs.com"
]
}
}
],
"Version": "1"
}

2. Authorize the instance RAM role

Call the interface CreatePolicy to create a new authorization policy.

Set the RoleName parameter, such as setting its value to EcsRamRoleDocumentTestingPolicy.

Set PolicyDocument according to the following policy:

{
"Statement": [
{
"Action": [
"oss:Get*",
"oss:List*"
],
"Effect": "Allow",
"Resource": "*"
}
],
"Version": "1"
}

Call the interface AttachPolicyToRole authorization role policy.

Set the PolicyType parameter to Custom.

Set the PolicyName parameter, such as EcsRamRoleDocumentTestingPolicy.

Set the RoleName parameter, such as EcsRamRoleDocumentTesting.

3. Grant the RAM role to the instance

Call the interface AttachInstanceRamRole to grant the RAM role to the instance.

Set the RegionId and InstanceIds parameters to specify an ECS instance.

Set the RamRoleName parameter, such as EcsRamRoleDocumentTesting.

4. (Optional) Reclaim the instance RAM role

Call the interface DetachInstanceRamRole to reclaim the instance RAM role.

Set the RegionId and InstanceIds parameters to specify an ECS instance.

Set the RamRoleName parameter, such as EcsRamRoleDocumentTesting.

5. (Optional) Obtain a temporary authorization token

You can obtain a temporary authorization token for the instance RAM role. This temporary authorization token can Execute the permissions and resources of the instance RAM role, and the temporary authorization token is automatically updated periodically. Example:

Retrieve the temporary authorization token of the instance RAM role named EcsRamRoleDocumentTesting:

Linux instance: Execute the command curl http://100.100.100.200/latest/meta-data/Ram/security -credentials/EcsRamRoleDocumentTesting.

Windows instances: See the documentation for instance metadata.

Obtain temporary authorization Token. The returned example is as follows:

{
"AccessKeyId" : "XXXXXXXXX",
"AccessKeySecret" : "XXXXXXXXX",
"Expiration" : "2017-11-01T05:20:01Z",
"SecurityToken" : "XXXXXXXXX",
"LastUpdated" : "2017-10-31T23:20:01Z",
"Code" : "Success"
}

6. (Optional) Authorize the RAM user to use the instance RAM role

Description

When When you authorize a RAM user to use an instance RAM role, you must grant the RAM user PassRole permissions for the instance RAM role. Among them, PassRole determines whether the RAM user can directly execute the permissions granted by the role policy.

Log in to the RAM console and refer to the document to authorize the RAM user to complete the authorization as follows:

{
"Version": "2016-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ecs: [ECS RAM Action]",
"ecs: CreateInstance",
"ecs: AttachInstanceRamRole",
"ecs: DetachInstanceRAMRole"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "ram:PassRole",
"Resource": "*"
}
]
}

The above is the detailed content of How to use instance RAM role through API after activating RAM service. For more information, please follow other related articles on the PHP Chinese website!