Service linked roles

What is a service linked role?

An Alibaba Cloud service may need to access other services to implement a function. In this case, the Alibaba Cloud service must be authorized. For example, to retrieve resource lists and change logs from Elastic Compute Service (ECS) and ApsaraDB for RDS, Cloud Config requires the access permissions on ECS and RDS. Alibaba Cloud provides service linked roles to simplify the authorization in such scenarios.

A service linked role is a RAM role that only the linked service can assume. In most cases, a service automatically creates or deletes a service linked role if needed. The service linked role simplifies the process of authorizing a service to access other services and prevents improper configurations.

The policy that is attached to a service linked role is predefined by the linked service. You cannot modify or delete the policy. In addition, you cannot attach policies to or detach policies from a service linked role.

If a service does not support service linked roles, you can use a normal service role to authorize the service.

Create a service linked role

Some Alibaba Cloud services automatically create service linked roles when you perform operations such as creating a cloud resource or enabling a feature. You can view the created service linked roles on the RAM Roles page of the RAM console. You can also retrieve a list of created service linked roles by using the API or CLI to call the ListRoles operation.

You can also manually create service linked roles. For more information, see Create a service linked role.

Delete a service linked role

Some Alibaba Cloud services automatically delete service linked roles when you perform operations such as deleting a cloud resource or disabling a feature. You can also manually delete service linked roles in the RAM console. For more information, see Delete a RAM role.

When you attempt to delete a service linked role, RAM first checks whether the role is assumed by the linked service.

• If the service linked role is idle, it is deleted.
• If the service linked role is in use, it is not deleted. However, you can view the service resources that assume the service linked role. If you no longer need the service resources, find and remove the resources, and then delete the service linked role again.

Permissions required to create and delete a service linked role

RAM identities must be granted the required permissions before they can create or delete a service linked role. The permissions are also required in scenarios where service linked roles are automatically created when RAM identities perform operations.

The following sample policy allows authorized RAM identities to create and delete the service linked role for Resource Management:

{
    "Action": [
        "ram:CreateServiceLinkedRole",
        "ram:DeleteServiceLinkedRole"
    ],
    "Resource": "*",
    "Effect": "Allow",
    "Condition": {
        "StringEquals": {
            "ram:ServiceName": "resourcemanager.aliyuncs.com"
        }
    }
}

Assume a service linked role

A service linked role can be assumed only by the linked service and cannot be assumed by other identities such as RAM users or other RAM roles.

You can view the service that can assume a service linked role in the Service element on the Trust Policy Management tab of the role details page.

Alibaba Cloud services that support service linked roles