Service-linked role for PrivateZone - Container Registry

This role lets Container Registry use PrivateZone to resolve domain names for you. This topic describes the role, answers frequently asked questions (FAQs), and explains how to delete it.

Background

A service-linked role is a type of RAM role that lets a service access other cloud services to perform specific tasks. For more information about service-linked roles, see Service-linked roles.

Scenarios

Container Registry's VPC access control feature uses PrivateZone to configure DNS resolution for VPC domain names. When you configure access control for a VPC, Container Registry automatically creates the AliyunServiceRoleForContainerRegistryAccessCustomerPrivateZone service-linked role. Container Registry then uses this role to access resources in PrivateZone.

Role details

Role name: AliyunServiceRoleForContainerRegistryAccessCustomerPrivateZone
Policy: AliyunServiceRolePolicyForContainerRegistryAccessCustomerPrivate

Permissions:

{
    "Action": [
        "pvtz:AddZone",
        "pvtz:DeleteZone",
        "pvtz:BindZoneVpc",
        "pvtz:UpdateZoneRemark",
        "pvtz:SetProxyPattern",
        "pvtz:DescribeRegions",
    "pvtz:DescribeZoneInfo",
    "pvtz:DescribeZones",
    "pvtz:AddZoneRecord",
    "pvtz:DeleteZoneRecord",
    "pvtz:UpdateRecordRemark",
    "pvtz:DescribeZoneRecords"
    ],
  "Resource": "*",
  "Effect": "Allow"
}

Delete the role

If you no longer need the VPC access control feature, you can delete the AliyunServiceRoleForContainerRegistryAccessCustomerPrivateZone role.

Delete the associated VPC access configuration.

You must delete the VPC access configuration before you can delete the AliyunServiceRoleForContainerRegistryAccessCustomerPrivateZone role.
1. Log on to the Container Registry console.
2. In the left-side navigation pane, click Instances.
3. On the Instances page, click the Enterprise Edition instance that you want to manage.
4. In the left-side navigation pane of the instance details page, choose Repository > Access Control.
5. On the VPC tab, find the VPC that you want to remove and click Delete in the Actions column.
6. In the dialog box that appears, click Confirm.
Log on to the RAM console by using your Alibaba Cloud account.
In the left-side navigation pane, choose Identities > Roles.
On the Role page, find the AliyunServiceRoleForContainerRegistryAccessCustomerPrivateZone role and click Delete Role in the Actions column.
In the Delete Role dialog box, enter the role name and click Delete Role.

FAQ

Why can't a RAM user automatically create the AliyunServiceRoleForContainerRegistryAccessCustomerPrivateZone service-linked role?

A RAM user must have specific permissions to automatically create or delete the AliyunServiceRoleForContainerRegistryAccessCustomerPrivateZone role. To grant these permissions, attach the following policy to the RAM user. For more information, see RAM authorization.

{
    "Statement": [
        {
            "Action": [
                "ram:CreateServiceLinkedRole"
            ],
            "Resource": "acs:ram:*:your-alibaba-cloud-account-id:role/*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": [
                        "access-customer-privatezone.cr.aliyuncs.com"
                    ]
                }
            }
        }
    ],
    "Version": "1"
}