Step 1: Grant self-managed permissions

Method 1: Grant self-managed permissions in the RAM console

1. Configure permissions for the execution account.

   1. Use the execution account to log on to the RAM console.

   2. Create a RAM role (AliyunROSStackGroupExecutionRole) for the execution account. The trusted entity of the role is the administrator account.

      1. In the left navigation bar, select Identity Management > Roles.

      2. On the Roles page, click Create Role.

      3. On the Create Role page, select Trusted Entity Type as Alibaba Cloud Account.

      4. Select Trusted Alibaba Cloud Account as Other Alibaba Cloud Account, and enter the ID of the administrator account.

      5. Click OK, and enter Role Name as AliyunROSStackGroupExecutionRole in the dialog box.

      6. Click OK to complete the creation.

   3. Grant the AdministratorAccess permission to the AliyunROSStackGroupExecutionRole RAM role.

      1. On the Roles page, click Add Permissions in the Actions column of the AliyunROSStackGroupExecutionRole RAM role.

      2. In the Add Authorization panel, select Account Level as the resource scope, and the authorization entity will be automatically filled in.

      3. Select System Policy for Select Policy, and then select AdministratorAccess.

      4. Click OK.

2. Configure permissions for the administrator account.

   1. Use the administrator account to log on to the RAM console.

   2. Create a RAM role (AliyunROSStackGroupAdministrationRole) for the administrator account. The trusted entity of the role is Resource Orchestration Service.

      1. In the left navigation bar, select Identity Management > Roles.

      2. On the Roles page, click Create Role.

      3. On the Create Role page, select Trusted Entity Type as Alibaba Cloud Service.

      4. Select Select Trusted Service as Resource Orchestration Service, and click OK.

      5. In the dialog box, enter Role Name as AliyunROSStackGroupAdministrationRole.

      6. Click OK to complete the creation.

   3. Create a custom policy (AssumeRole-AliyunROSStackGroupExecutionRole).

      1. In the left navigation bar, select Permission Management > Policies.

      2. On the Policies page, click Create Policy.

      3. On the Create Policy page, click the Script tab, enter the following policy content, and click OK. Enter the Policy Name as AssumeRole-AliyunROSStackGroupExecutionRole.

         This policy allows the AliyunROSStackGroupAdministrationRole RAM role to assume the AliyunROSStackGroupExecutionRole RAM role.

         {
           "Statement": [
             {
               "Effect": "Allow",
               "Action": "sts:AssumeRole",
               "Resource": "acs:ram::*:role/AliyunROSStackGroupExecutionRole"
             }
           ],
           "Version": "1"
         }

      4. Click OK to complete the creation.

   4. Grant the AssumeRole-AliyunROSStackGroupExecutionRole permission to the AliyunROSStackGroupAdministrationRole RAM role.

      1. In the left navigation bar, select Identity Management > Roles.

      2. On the Roles page, click Add Permissions in the Actions column of the AliyunROSStackGroupAdministrationRole RAM role.

      3. In the Add Permissions panel, select Scope For Authorization as Alibaba Cloud Account. The authorized principal is automatically filled in.

      4. Select Custom Policy for Select Policy, and then select AssumeRole-AliyunROSStackGroupExecutionRole.

      5. Click OK.

Method 2: Grant self-managed permissions in the ROS console

You can use a ROS template to create RAM roles for the administrator and execution accounts and grant permissions on stack groups and stacks to these roles.

1. The administrator account logs on to the ROS console and uses the AliyunROSStackGroupAdministrationRole template to create a RAM role and grant permissions to the role.

   Example template:

   ROSTemplateFormatVersion: '2015-09-01'
   Description: Configure the AliyunROSStackGroupAdministrationRole to enable use of Alibaba Cloud ROS StackGroup.
   Parameters:
     AdministrationRoleName:
       Type: String
       Default: AliyunROSStackGroupAdministrationRole
       Description:
         en: Role name of administration account
         zh-cn: 创建授权给管理员账号的角色的名称
     ExecutionRoleName:
       Type: String
       Default: AliyunROSStackGroupExecutionRole
       Description:
         en: Execution role name of target account
         zh-cn: 目标账号执行角色名称
   Metadata:
     ALIYUN::ROS::Interface:
       ParameterGroups:
         - Parameters:
             - AdministrationRoleName
             - ExecutionRoleName
           Label:
             default:
               en: RAM
               zh-cn: 账号权限
       TemplateTags:
         - acs:example:Security:Grant permissions to the administrator account of a stack group
   Resources:
     AliyunROSStackGroupAdministrationRole:
       Type: ALIYUN::RAM::Role
       Properties:
         RoleName:
           Ref: AdministrationRoleName
         AssumeRolePolicyDocument:
           Version: 1
           Statement:
             - Action: sts:AssumeRole
               Effect: Allow
               Principal:
                 Service:
                   - ros.aliyuncs.com
         Policies:
           - PolicyName:
               Fn::Sub:
                 - AssumeRole-${ExecutionRoleName}
                 - ExecutionRoleName:
                     Ref: ExecutionRoleName
             PolicyDocument:
               Statement:
                 - Effect: Allow
                   Action:
                     - sts:AssumeRole
                   Resource:
                     - Fn::Sub: acs:ram::*:role/${ExecutionRoleName}
               Version: '1'
   Outputs:
     AdministrationRoleName:
       Value:
         Fn::GetAtt:
           - AliyunROSStackGroupAdministrationRole
           - RoleName
   

2. The execution account logs on to the ROS console and uses the AliyunROSStackGroupExecutionRole template to create a RAM role and grant permissions to the role.

   Example template:

   ROSTemplateFormatVersion: '2015-09-01'
   Description: Configure the AliyunROSStackGroupExecutionRole to enable use of your account as a target account in Alibaba Cloud ROS StackGroup.
   Conditions:
     CurrentAccount:
       Fn::Equals:
         - Ref: AdministrationAccountId
         - ''
   Parameters:
     ExecutionRoleName:
       Type: String
       Default: AliyunROSStackGroupExecutionRole
       Description:
         en: Execution role name of target account
         zh-cn: 为目标账号创建执行角色的名称
     AdministrationAccountId:
       Type: String
       Description:
         zh-cn: 管理员主账号ID，不填则授权给当前账号
         en: Administration account ID. If not, authorize the current account
       Default: ''
   Metadata:
     ALIYUN::ROS::Interface:
       ParameterGroups:
         - Parameters:
             - ExecutionRoleName
             - AdministrationAccountId
           Label:
             default: RAM
       TemplateTags:
         - acs:example:Security:Grant permissions to the execution account of a stack group
   Resources:
     AliyunROSStackGroupExecutionRole:
       Type: ALIYUN::RAM::Role
       Properties:
         RoleName:
           Ref: ExecutionRoleName
         AssumeRolePolicyDocument:
           Version: 1
           Statement:
             - Action: sts:AssumeRole
               Effect: Allow
               Principal:
                 RAM:
                   - Fn::Join:
                       - ''
                       - - 'acs:ram::'
                         - Fn::If:
                             - CurrentAccount
                             - Ref: ALIYUN::TenantId
                             - Ref: AdministrationAccountId
                         - ':root'
     AttachPolicy:
       Type: ALIYUN::RAM::AttachPolicyToRole
       Properties:
         PolicyName: AdministratorAccess
         PolicyType: System
         RoleName:
           Fn::GetAtt:
             - AliyunROSStackGroupExecutionRole
             - RoleName
   Outputs:
     ExecutionRoleName:
       Value:
         Fn::GetAtt:
           - AliyunROSStackGroupExecutionRole
           - RoleName