With IAM roles, Volcengine account B can access TLS resources in Volcengine account A. This article describes the steps for cross-account access to TLS based on IAM roles.

Scenario example

Enterprise A has enabled TLS to improve business development efficiency and data analysis capabilities. However, Enterprise A wishes to focus on the development of its core business and entrust daily operations and data analysis to its partner, Enterprise B. In this cooperation model, Enterprise A needs to provide Enterprise B with the necessary access permissions to TLS while ensuring data security. To address this requirement, TLS offers a solution for cross-account resource access based on IAM roles. The specific process is as follows:

Enterprise A uses its Volcengine primary account A to create an IAM role and grant business-related TLS permissions.

Enterprise B uses its Volcengine primary account B to create an IAM user and grant permission to assume the IAM role.

Enterprise B uses the IAM user under primary account B to access TLS in Enterprise A (primary account A).

Steps

1. Primary account A creates an IAM role and grants TLS access permissions

Enterprise A creates an IAM role through Volcengine primary account A and authorizes it, specifying the TLS permissions the IAM role will have when assumed. In this example, you can grant the IAM role permissions to query logs and manage dashboards.

Volcengine primary account A logs in to IAM Console.

Create a custom permission policy.

In the left navigation pane, click Permission policy.

On the Permission policy page, click Create policy.

On the Create policy page, complete the following configuration, then click Submit.

Set Policy name, for example, TLSDashboardAccess.

In the JSON editor, add the following permission policy.

{
"Statement": [
{
"Effect": "Allow",
"Action": [
"tls:DescribeProjects",
"tls:DescribeProject",
"tls:DescribeTopics",
"tls:DescribeTopic"
],
"Resource": [
"*"
]
},
{
"Effect": "Allow",
"Action": [
"tls:SearchLogs",
"tls:DescribeIndex",
"tls:DescribeSavedSearches",
"tls:DescribeHistogramV1"
],
"Resource": [
"*"
]
},
{
"Effect": "Allow",
"Action": [
"tls:CreateDashboard",
"tls:DeleteDashboard",
"tls:ModifyDashboard",
"tls:DescribeDashboard",
"tls:DescribeDashboards"
],
"Resource": [
"*"
]
}
]
}

Create an IAM role.

In the left navigation bar, click Role Management.

On the Role Management page, click Create new role.

In the Create new role panel, complete the following configuration, then click Next.

Set Select trusted identity type to Account.

Set Select identity to Other accounts.

Enter the ID of primary account B in Account ID.

This setting allows IAM users under primary account B to assume this IAM role.

Set Role name, then click Next.

In the Authorize step, select the custom permission policy you created (TLSDashboardAccess), then click Submit.

Primary account B creates an IAM user and grants permission to assume the IAM role

Enterprise B creates an IAM user through Volcano Engine primary account B and grants STSAssumeRoleAccess authorization, allowing this IAM user to assume the IAM role created by primary account A.

Log in to the IAM Console as Volcano Engine primary account B.

Create an IAM user.

In the left navigation bar, select User management > Users.

On the Users page, click Create new user.

On the Create new user page, click Create user.

Follow the page prompts to enter information and set login settings, then click Next.

In the Permission settings step, select STSAssumeRoleAccess, and click Next.

In the Review step, confirm the username information, and click Submit.

IAM user of primary account B accesses TLS of primary account A

The IAM user of primary account B can log in to the console and access TLS resources of primary account A by following these steps.

Open the IAM user login portal in your browser.

On the IAM sub-user login page, enter primary account B's username, IAM username, and password, then click Log in now.

Move the mouse over the avatar in the upper right corner, and in the hover box, click Switch role.

On the Switch role page, enter the ID of primary account A and the IAM role name, then click Switch role.

Open the TLS console to access TLS resources of primary account A.

Torch Log Service