All Products
Search
Document Center

Serverless App Engine:Pull Alibaba Cloud images across accounts

Last Updated:Sep 03, 2024

Serverless App Engine (SAE) allows you to pull Alibaba Cloud images across accounts by assuming a Resource Access Management (RAM) role. For example, User A can assume a RAM role that has the required permissions to pull the private images of User B. This topic describes how to pull Alibaba Cloud images across accounts.

Step 1: Create a RAM role

Use the Alibaba Cloud account of User B to create a RAM role. Set the role type of the RAM role to Alibaba Cloud Account and specify the Alibaba Cloud account of User A as a trusted Alibaba Cloud account.

  1. Log on to the RAM console as a RAM user who has administrative rights.

  2. In the left-side navigation pane, choose Identities > Roles.

  3. On the Roles page, click Create Role.

  4. On the Create Role page, select Alibaba Cloud Account in the Select Role Type section and click Next.

  5. In the Configure Role step, configure the RAM Role Name and Note parameters, select Other Alibaba Cloud Account, enter the Alibaba Cloud account ID of User A, and then click OK.

    Note

    If you want a specific RAM user instead of all RAM users that belong to your Alibaba Cloud account to assume the RAM role, you can use one of the following methods:

  6. Click Close.

Step 2: Grant permissions to the RAM role

Configure a permission policy for the RAM role that you created in Step 1 to pull the private images of User B. In this example, image-related permissions are added to an existing policy. For information about how to create a policy, see Create custom policies.

  1. Log on to the RAM console with an Alibaba Cloud account.

  2. In the left-side navigation pane, choose Permissions > Policies.

  3. On the Policies page, find the policy that you want to manage and click its name.

  4. On the Policy Document tab, click Modify Policy Document.

  5. On the Visual editor or JSON tab, modify the document of the policy and click Next to edit policy information.

    Important

    Make sure that the RAM role has the permissions that are related to Container Registry.

    The following script shows the required permissions:

    {
        "Version": "1",
        "Statement": [
            {
                "Effect": "Allow",
                "Action": [
                    "cr:GetAuthorizationToken",
                    "cr:ListInstanceEndpoint",
                    "cr:PullRepository",
                    "cr:GetRepository",
                    "cr:ListRepositoryTag"
                ],
                "Resource": "*"
            }
        ]
    }
  6. Change the value of Note and click OK.

  7. In the left-side navigation pane, choose Identities > Roles.

  8. On the Roles page, find the RAM role that you want to manage and click Grant Permission in the Actions column.

    image

    You can also select multiple RAM roles and click Grant Permission in the lower part of the RAM role list to grant permissions to multiple RAM roles at a time.

  9. In the Grant Permission panel, grant permissions to the RAM role based on your business requirements, click OK, and then click Complete.

Step 3: Configure the trust policy of the RAM role

Configure the trust policy of the RAM role that you created for User B to allow the SAE service account of User A to assume the RAM role.

  1. Log on to the RAM console as a RAM user who has administrative rights.

  2. In the left-side navigation pane, choose Identities > Roles.

  3. On the Roles page, click the name of the RAM role that you created.

  4. On the Trust Policy tab, click Edit Trust Policy. Change the RAM field in the Principal element to the Service field and click Save trust policy document.

    Sample code:

    Before the change

    After the change

    {
        "Statement": [
            {
                "Action": "sts:AssumeRole",
                "Effect": "Allow",
                "Principal": {
                    "RAM": [
                        "acs:ram::123456789012****:root"
                    ]
                }
            }
        ],
        "Version": "1"
    }

    The preceding policy indicates that the RAM role can be assumed by all RAM users and RAM roles of the Alibaba Cloud account whose ID is 123456789012****.

    {
      "Statement": [
        {
          "Action": "sts:AssumeRole",
          "Effect": "Allow",
          "Principal": {
            "Service": [
              "123456789012****@sae.aliyuncs.com"
            ]
          }
        }
      ],
      "Version": "1"
    }

    The preceding policy indicates that the RAM role can be assumed by the SAE service account whose ID is 123456789012****@sae.aliyuncs.com. The service account belongs to the Alibaba Cloud account whose ID is 123456789012****.

    Note

    In this example, a service specified by the Service field is used to pull images across accounts.

Step 4: Deploy an SAE application

Log on to the RAM console and copy the ARN of the RAM role on the Basic Information page. When you create or deploy an application, use an image that is pulled from another Alibaba Cloud account and configure the acrAssumeRoleArn parameter. In the Configure Image section, click the Private images of Other Alibaba Cloud Account tab. In the acrAssumeRoleArn field, enter the ARN of the RAM role that you created. For more information, see the following topics: