sub-account-pass-role.yml

ROSTemplateFormatVersion: '2015-09-01'
Description:
  zh-cn: 创建子账号，赋予PassRole权限，允许指定服务托管角色访问。
  en: Create sub-accounts and grant PassRole permissions, enabling designated service-managed
    roles to access.
Parameters:
  UserName:
    Type: String
    Label:
      zh-cn: 用户名
      en: User Name
    Description:
      zh-cn: 由1-128个英文字母、数字、“.”、“_”或“-”组成，账号内唯一。
      en: Consists of 1-128 English letters, numbers, ".", "_", Or "-", unique in
        the account
    Default: TestPassRole
  Service:
    Type: String
    Label:
      zh-cn: 授信服务
      en: Trusted Service
    Description:
      zh-cn: 授信服务地址
      en: Trusted Service Address
    Default: oos.aliyuncs.com
  Resource:
    Type: Json
    Label:
      zh-cn: 授信角色
      en: Credit Role
    Description:
      zh-cn: 授信角色的Arn，“*”表示授信给所有RAM角色
      en: Credit for role Arn, "*" for all RAM roles
    Default:
    - '*'
Resources:
  User:
    Type: ALIYUN::RAM::User
    Properties:
      UserName:
        Ref: UserName
      Policies:
      - PolicyName:
          Fn::Sub: PassRole-${ALIYUN::StackId}
        PolicyDocument:
          Version: '1'
          Statement:
          - Effect: Allow
            Resource:
              Ref: Resource
            Action:
            - ram:PassRole
            Condition:
              StringEquals:
                acs:Service:
                  Ref: Service
Outputs:
  UserName:
    Value:
      Fn::GetAtt:
      - User
      - UserName
Metadata:
  ALIYUN::ROS::Interface:
    ParameterGroups:
    - Parameters:
      - UserName
      - Service
      - Resource
      Label:
        default: RAM
    TemplateTags:
    - acs:example:安全:子账户PassRole权限