All Products
Search

This Product

    Alibaba Cloud DNS:Service linked role for Alibaba Cloud DNS

    Document Center

    Alibaba Cloud DNS:Service linked role for Alibaba Cloud DNS

    Last Updated:Aug 14, 2020

    Overview

    The service linked role AliyunServiceRoleForDNS is a Resource Access Management (RAM) role that only Alibaba Cloud Domain Name System (DNS) can assume to access other Alibaba Cloud services. This topic describes the scenarios that the service linked role is applicable to and how to delete the role.

    Background information

    Alibaba Cloud DNS may need to access other Alibaba Cloud services to implement a specific feature. To meet this requirement, Alibaba Cloud provides the AliyunServiceRoleForDNS role that allows Alibaba Cloud DNS to access other Alibaba Cloud services. For more information about service linked roles, see Service linked roles.

    Scenarios

    When you use the DNS Monitoring feature, Alibaba Cloud DNS assumes the AliyunServiceRoleForDNS role to access your CloudMonitor resources. You do not need to manually create the service linked role. If the role does not exist, Alibaba Cloud DNS automatically creates the role when you use the DNS Monitoring feature.

    Role description

    • Role name: AliyunServiceRoleForDNS
    • Policy name: AliyunServiceRolePolicyForDNS
    • This permission policy grants Alibaba Cloud DNS the permission to access the CloudMonitor resources of the current account.
    1. {
    2.   "Version": "1",
    3.   "Statement": [
    4.     {
    5.       "Action": [
    6.         "cms:QueryTaskConfig",
    7.         "cms:DescribeISPAreaCity",
    8.         "cms:CreateTask",
    9.         "cms:ModifyTask",
    10.         "cms:DeleteTasks",
    11.         "cms:DescribeTasks",
    12.         "cms:DescribeTaskDetail",
    13.         "cms:CreateAlarm",
    14.         "cms:DeleteAlarm",
    15.         "cms:UpdateAlarm",
    16.         "cms:ListAlarm",
    17.         "cms:QueryAlarm",
    18.         "cms:QueryMetricList",
    19.         "cms:QueryMetricLast",
    20.         "cms:QueryTaskMonitorData",
    21.         "cms:QueryStaticsAvailability",
    22.         "cms:QueryStaticsErrorRate",
    23.         "cms:QueryStaticsResponseTime",
    24.         "cms:QueryErrorDistribution"
    25.       ],
    26.       "Resource": "*",
    27.       "Effect": "Allow"
    28.     }
    29.   ]
    30. }

    Delete the AliyunServiceRolePolicyForDNS role

    Before you delete the AliyunServiceRoleForDNS role, you must delete all the created monitoring tasks in Alibaba Cloud DNS.

    • For more information about how to delete a service linked role, see the “Delete a service linked role” section of the Service linked roles topic.