Overview

Types of Trust Agencies

A trust relationship can be established between your account and another account or a cloud service.

• Account delegation: You can delegate another Huawei Cloud account or more professional third-party accounts to perform resource O&M on your behalf according to the granted permissions.
• Cloud service delegation: You can create a trust agency to delegate a cloud service to perform O&M on your resources.

  There is a special type of trust agency called service-linked trust agency. It is directly linked to a cloud service. It is similar to but different from a service trust agency. When using service trust agencies, you may encounter the following:

  • You need to create a service trust agency and assign the least privilege access to it, but you may not know the minimum permission set required by it.
  • You have full permissions for a service trust agency and may configure an inappropriate or accidentally delete an identity policy, affecting the service usage.
    With service-linked trust agencies, you can resolve these issues. The following table lists the differences between a service trust agency and a service-linked trust agency.

    Table 1 Differences between a service trust agency and a service-linked trust agency

    Agency Type	Create	Delete	Permissions	Restricted by SCP	Visible to Users
    Service trust agency	Created by users or cloud services on behalf of users	Deleted by users	Granted by the user-configured identity policies	Yes	Yes
    Service-linked agency	Created by cloud services on behalf of users	Deleted by cloud services on behalf of users	Cannot be granted by user or modified by user-configured identity policies. Cloud services predefine the least permissions.	No	Yes

Agency Chaining

Agency chaining is when you use an agency to assume a second agency. You can use APIs, CLI, or SDKs to switch agencies. For example, agency A has the permission to assume agency B. You use the permanent access key of IAM user A to call the AssumeAgency API to assume agency A. This returns the temporary security credentials of agency A. With agency chaining, you can use those temporary security credentials to enable IAM user A to assume agency B.

When you assume an agency, you can pass a session tag and set the tag as transitive. Transitive session tags are passed to all subsequent sessions in an agency chain. For more information about session tags, see Passing Session Tags.

An agency chain limits the assumed-agency session of your API, CLI, or SDK to a maximum of one hour, regardless of the maximum session duration configured for a single agency. When you use the AssumeAgency API to switch to a trust agency, you can use the duration_seconds parameter to specify the duration of the assumed-agency session. You can specify a value of up to 43,200 seconds (12 hours), depending on the maximum session duration setting of your trust agency. However, if you use the agency chaining to switch to another trust agency and provide a duration_seconds value greater than one hour, the switch will fail.

Trust Policy

Generally, identity policies are assigned to IAM identities for authorization. In resource-based authorization, permissions are assigned to a resource to define which principals can perform what operations on the resource. The trust policy is a typical resource-based policy in trust agencies.

{
	"Version": "5.0",
	"Statement": [{
		"Principal": {
			"IAM": ["<Account Id Of Account B>"],
			"Service": ["service.OBS"]
		},
		"Action": ["sts:agencies:assume", "sts::tagSession", "sts::setSourceIdentity"],
		"Condition": {
			"DateGreaterThan": {
				"g:CurrentTime": "2024-01-01T12:00Z"
			},
			"DateLessThan": {
				"g:CurrentTime": "2024-01-01T15:00Z"
			}
		},
		"Effect": "Allow"
	}]
}

In this example, account A uses a trust agency to establish a trust relationship for account B and OBS. Principals with trust agency permissions in account B and OBS can switch to the trust agency of account A from 12:00 on January 1, 2024 (UTC) to 15:00 on January 1, 2024 (UTC). You can also set assumed-agency session tags and source identity information to define the delegated party that switches to the trust agency to access Huawei Cloud.

In the example trust policy, <Account Id Of Account B> represents account B, service.OBS represents OBS, g:CurrentTime indicates the condition key for controlling the switch window, sts:agencies:assume indicates the action for granting permissions to switch to the trust agency, sts::tagSession indicates the action for granting permissions to set session tags, and sts::setSourceIdentity indicates the action for granting permissions to set source identity information.

In conclusion, trust agencies can establish trust relationships for multiple principals and multiple types of principals through trust policies, and can use actions and condition keys to perform fine-grained access control on trust agency switch operations performed by delegated parties. In comparison, an agency cannot establish trust relationships for multiple principals and multiple types of principals, nor can it perform fine-grained access control on trust agency switch operations performed by delegated parties. If you still need to use such agencies, see Agencies.