If you want to use a custom domain name of a Container Registry instance to access and manage SSL certificates, you can add a RAM role to the Alibaba Cloud account of the Container Registry instance and grant the RAM role the permissions to perform operations on SSL certificates. This way, Container Registry can access SSL certificates in a secure method. This topic describes how to grant permissions to a RAM role before you use a custom domain name to manage SSL certificates.
Step 1: Create a RAM role
Before you use a custom domain name of a Container Registry instance to access SSL certificates, you must create a role named AliyunContainerRegistryCustomizedDomainRole for your Alibaba Cloud account of the Container Registry instance.
Log on to the RAM console as a RAM user who has administrative rights.
In the left-side navigation pane, choose .
On the Roles page, click Create Role.
On the Create Role page, select Alibaba Cloud Account in the Select Role Type section and click Next.
Set the RAM Role Name parameter to AliyunContainerRegistryCustomizedDomainRole and set the Note parameters as needed. Select Current Alibaba Cloud Account for the Select Trusted Alibaba Cloud Account parameter. Then, click OK.
NoteIf you select Other Alibaba Cloud Account, enter the ID of another Alibaba Cloud account.
Step 2: Attach a policy to the RAM role
You must attach the AliyunYundunCertReadOnlyAccess policy to the RAM role. This policy grants the RAM role the read permissions on SSL certificates.
Log on to the RAM console as a RAM user who has administrative rights.
In the left-side navigation pane, choose .
On the Roles page, click Grant Permission in the Actions column that corresponds to the AliyunContainerRegistryCustomizedDomainRole role.
In the Grant Permission panel, set Resource Scope to Account, enter AliyunYundunCertReadOnlyAccess in the Policy search box to search for and select AliyunYundunCertReadOnlyAccess.
NoteIn the Selected section on the right, you can click the cross (×) to the right of a policy to remove the policy.
Click Grant permissions.
Click Close.
Step 3: Configure a trust policy for the RAM role
Add Container Registry to the trust policy of the RAM role. This grants Container Registry access to SSL certificates.
Log on to the RAM console as a RAM user who has administrative rights.
In the left-side navigation pane, choose .
On the Roles page, click AliyunContainerRegistryCustomizedDomainRole in the Role Name column.
On the Trust Policy tab, click Edit Trust Policy.
In the Edit Trust Policy panel, copy the following content to the code editor and click OK.
{ "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": [ "cr.aliyuncs.com" ] } } ], "Version": "1" }