Simple Application Server:Manage service interconnection

Scenarios

By default, all simple application servers that belong to the same Alibaba Cloud account and reside in the same region communicate with each other over VPCs. The service interconnection feature is mainly used in the following scenarios:

• Simple application servers require access to Elastic Compute Service (ECS) instances over VPCs.

• Simple application servers require access to ApsaraDB databases over VPCs.

In this example, the scenario shown in the following figure is used. An enterprise purchases two VPCs in the China (Hangzhou) region and deploys their simple application servers in VPC 1 and their ECS instances in VPC 2. The enterprise wants to build connections between the simple application servers and the ECS instances across the VPCs.

Limits

• For simple application servers that belong to the same Alibaba Cloud account:

  • All simple application servers in the same region are automatically added to the same VPC. The VPC can be added to only one CEN instance at a time.

  • Simple application servers in different regions are added to region-specific VPCs. To allow services in different VPCs in a region to communicate with each other, you must select all the VPCs for the VPCs parameter when you configure service interconnection on the Simple Application Server console.

• If you do not have simple application servers deployed in a region, you cannot enable the service interconnection feature for the region.

• In the Simple Application Server console, you can enable service interconnection. This way, your simple application server is interconnected with other services that belong to the same Alibaba Cloud account and reside in the same region as the simple application server. This feature is provided free of charge. If you want to make your simple application server interconnected with other services that belong to different Alibaba Cloud accounts or reside in different regions, you must perform relevant operations in the CEN console. You are charged for cross-region interconnection. For more information, see Billing, Grant a transit router permissions on a network instance that belongs to another Alibaba Cloud account and Manage inter-region connections.

• Operations performed in the CEN console are not synchronized to the Simple Application Server console. We recommend that you perform operations such as managing VPCs in the Simple Application Server console after you configure the service interconnection feature. For more information, see Add or remove a VPC.

Enable service interconnection

1. Log on to the Simple Application Server console.

2. In the left-side navigation pane, click Service Interconnection.

3. In the upper-left corner of the Service Interconnection page, click Service Interconnection.

   The first time you enable the service interconnection feature, a message appears to prompt you to confirm authorization. After you click OK in the message, the system automatically creates a service-linked role for Simple Application Server. For more information, see Create and delete the service-linked role.

4. In the Configure Service Interconnection dialog box, configure parameters based on your business requirements.

   The following table describes the parameters.

   Parameter	Description
   Region	Select the region for which you want to enable the service interconnection feature. Example: China (Hangzhou).
   CEN Instance	Select a CEN instance from the drop-down list. If no CEN instance is available in the drop-down list, click Auto Create. The system automatically creates a CEN instance. Warning Simple Application Server supports only CEN Basic Edition transit routers. If you select a CEN Enterprise Edition transit router that you created in the CEN console, the service interconnection feature of Simple Application Server is unavailable. For more information about CEN Basic Edition and CEN Enterprise Edition, see Transit router editions.
   VPC	Select the ID of the desired VPC. For example, you can select the ID of a VPC where ECS instances reside. If you want to select multiple VPC IDs, click Add to Batch Selection Box and select more. You can also add or remove VPCs after you enable service interconnection in a region. For more information, see Add or remove a VPC.

5. Click Confirm.

   On the Service Interconnection page, you can view the VPCs that you added.

6. Test interconnectivity.

   In this example, a simple application server in VPC 1 and an ECS instance in VPC 2 that belong to the same Alibaba Cloud account and reside in the same region are used to test the interconnectivity. This example assumes that you selected VPC 2 for the VPC parameter in Step 5.

   1. Connect to the simple application server.

      For more information, see Connect to a Linux server.

   2. Run the ping command to ping the IP address of the ECS instance in VPC 2 to test the connectivity between the simple application server and the ECS instance.

      If the system returns a message that is similar to the following figure, the connection between the simple application server and ECS instance is established.

Add or remove a VPC

1. Log on to the Simple Application Server console.

2. In the left-side navigation pane, click Service Interconnection.

3. Add or remove a VPC.

   • Add a VPC

     1. On the Service Interconnection page, click Service Interconnection.

     2. In the Configure Service Interconnection dialog box, select a region, CEN instance, and VPC. For more information, see Table: Parameters for configuring service interconnection.

     3. click OK.

   • Remove a VPC

     1. Find the VPC that you want to remove. Click Remove in the Actions column.

        Note

        • After you remove a VPC, the simple application server is disconnected from other cloud services in the VPC.

        • If you have deleted the service-linked role AliyunServiceRoleForSwas for Simple Application Server, after you click Remove in the Actions column that corresponds to a VPC, a dialog box appears to prompt you to re-authorize Simple Application Server to obtain the IDs of your VPCs and CEN instances. Click OK. Then, you can remove the VPC.

     2. In the message that appears, click OK.

Create and delete the service-linked role

AliyunServiceRoleForSwas is a service-linked role that is provided by Resource Access Management (RAM). The service-linked role allows Simple Application Server to access other Alibaba Cloud resources. Simple Application Server can obtain access to resources in CEN and VPC by using an AliyunServiceRoleForSwas. This enables service interconnection. For more information, see Service-linked roles.

Permission description

Create the service-linked role

The first time you enable the service interconnection feature for a region, the system checks whether the AliyunServiceRoleForSwas service-linked role is created in your Alibaba Cloud account. If the service-linked role does not exist, you must authorize Simple Application Server to access resources of other Alibaba Cloud services. Then, the system creates the service-linked role.

The AliyunServiceRoleForSwas service-linked role is attached with the AliyunServiceRolePolicyForSwas system policy. System policies that are attached to service-linked roles are defined and used by the linked Alibaba Cloud services. You cannot add, modify, or remove permissions for service-linked roles.

Delete the service-linked role