Microservices Engine：Access authentication by the Nacos client

Step 1: Create a RAM role and attach policies to the RAM role

1. Optional. Create a RAM role whose trusted entity is an Alibaba Cloud service. For more information, see Create a regular service role.

2. Grant permissions to an existing RAM role or the RAM role that you created, and attach one of the following system policies to the RAM role. In this step, a coarse-grained authorization operation is performed to grant the RAM role read permissions and write permissions or read-only permissions on the configurations and services of all MSE Nacos instances. For more information about authorization, see Grant permissions to a RAM role.

   Policy	Description
   AliyunMSEFullAccess	The permissions that are required to manage MSE. You can use a RAM role to which this policy is attached to manage all features the same way you use an Alibaba Cloud account to manage all features.
   AliyunMSEReadOnlyAccess	The read-only permissions on the resources of MSE. A RAM role to which this policy is attached can only read all MSE resources of the Alibaba Cloud account.

   Note

   You can attach a maximum of five policies at a time. If you want to attach more than five policies, repeat the step multiple times.

Step 2: Attach the RAM role to the ECS instance

1. Log on to the ECS console.

2. In the left-side navigation pane, choose Instances & Images > Instances.

3. In the top navigation bar, select the region and resource group to which the resource belongs.

4. Find the ECS instance to which you want to attach the instance RAM role and choose > Instance Settings > Attach/Detach RAM Role in the Actions column.

5. In the Attach/Detach RAM Role dialog box, select the instance RAM role that you created from the RAM Role drop-down list and click Confirm.

Step 3: Configure authentication on the client (SDK)

properties.put(PropertyKeyConst.SERVER_ADDR, "${Endpoint of the MSE Nacos instance}");
properties.put(PropertyKeyConst.RAM_ROLE_NAME, "${roleName}");
// Nacos registry
NamingService naming = NamingFactory.createNamingService(properties);
// Nacos configuration center
ConfigService configService = ConfigFactory.createConfigService(properties);

## Nacos registry
spring.cloud.nacos.discovery.ramRoleName=${roleName}

## Nacos configuration center
spring.cloud.nacos.config.ramRoleName=${roleName}

dubbo.registry.address=nacos://${Endpoint of the MSE Nacos instance}:8848?ramRoleName=${roleName}

Step 1: Grant permissions to the worker RAM role in the ACK cluster

1. Create a custom policy that contains the following content. For more information, see Step 1: Create a custom policy.

   • Grant the worker RAM role the management permissions on MSE.

     {
         "Action": "mse:*",
         "Resource": "*",
         "Effect": "Allow"
     },
     {
         "Action": "ram:CreateServiceLinkedRole",
         "Resource": "*",
         "Effect": "Allow",
         "Condition": {
             "StringEquals": {
                 "ram:ServiceName": "mse.aliyuncs.com"
             }
         }
     }

   • Grant the worker RAM role the read-only permissions on MSE.

     {
         "Action": [
             "mse:Query*",
             "mse:List*",
             "mse:Get*"
         ],
         "Resource": "*",
         "Effect": "Allow"
     },
     {
         "Action": "ram:CreateServiceLinkedRole",
         "Resource": "*",
         "Effect": "Allow",
         "Condition": {
             "StringEquals": {
                 "ram:ServiceName": "mse.aliyuncs.com"
             }
         }
     }

   Note

   If you want to grant fine-grained permissions to the worker RAM role, you need to create a custom policy. For more information, see Fine-grained authorization in registries and Fine-grained authorization in configuration centers.

2. Attach the custom policy to the worker RAM role. For more information, see Step 2: Attach the custom policy to the worker RAM role.

Step 2: Configure authentication on the client (SDK)

properties.put(PropertyKeyConst.SERVER_ADDR, "${Endpoint of the MSE Nacos instance}");
properties.put(PropertyKeyConst.RAM_ROLE_NAME, "${roleName}");
// Nacos registry
NamingService naming = NamingFactory.createNamingService(properties);
// Nacos configuration center
ConfigService configService = ConfigFactory.createConfigService(properties);

## Nacos registry
spring.cloud.nacos.discovery.ramRoleName=${roleName}

## Nacos configuration center
spring.cloud.nacos.config.ramRoleName=${roleName}

dubbo.registry.address=nacos://${Endpoint of the MSE Nacos instance}:8848?ramRoleName=${roleName}