AuthDiagnosis - Alibaba Cloud Linux - Alibaba Cloud Documentation Center

Operation description

Important The diagnostics feature requires a service-linked role to be created under the Resource Access Management (RAM) user. Invoking this operation automatically checks whether the service-linked role exists and creates it if it does not. The RAM user that invokes this operation must have the ram:CreateServiceLinkedRole permission.

Note the following when you invoke this operation to authorize SysOM to diagnose ECS instances:

Each authorization is valid for 7 days. After 7 days, the authorization expires and you must invoke this operation again to re-authorize.
If the SysOM service-linked role (AliyunServiceRoleForSysom) does not exist when you invoke this operation, automatic creation is performed. The Resource Access Management (RAM) user that invokes this operation must have the ram:CreateServiceLinkedRole permission.
When you invoke this operation to authorize diagnostics on a specific instance, the label sysom:diagnosis is automatically associated with the target ECS instance. SysOM only allows diagnostics on instances that have this label.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

sysom:AuthDiagnosis

none

*All Resource

*

None

Request syntax

POST /api/v1/openapi/diagnosis/auth HTTP/1.1

Request parameters

Parameter	Type	Required	Description	Example
body	object	No	The request body parameters.
autoCreateRole	boolean	No	Specifies whether to enable automatic creation of the service-linked role.
autoInstallAgent	boolean	No	Specifies whether to automatically install the latest version of the agent if it is not already installed.
instances	array<object>	Yes	The list of instances authorized for diagnostics.
	object	No		i-wz9gdv7qmdhntqmc4rjd
instance	string	No	The instance ID.	i-wz9b9vucz1iubsz8sjqo
region	string	No	The region ID.	cn-hangzhou

Response elements

Element	Type	Description	Example
	object	The response parameters.
code	string	The status code. `code == Success` indicates that the authorization is successful. Other status codes indicate that the authorization failed. Check the `message` field for the detailed fault information.	Success
data	any	This operation does not return data.	{}
message	string	The error message. If `code == Success`, this field is empty. Otherwise, this field contains the request error information.	SysomOpenAPIAssumeRoleException: EntityNotExist.Role The role not exists: acs:ram::xxxxx:role/aliyunserviceroleforsysom
request_id	string	The request ID.	35F91AAB-5FDF-5A22-B211-C7C6B00817D0

Examples

Success response

JSON format

{
  "code": "Success",
  "data": "{}",
  "message": "SysomOpenAPIAssumeRoleException: EntityNotExist.Role The role not exists: acs:ram::xxxxx:role/aliyunserviceroleforsysom",
  "request_id": "35F91AAB-5FDF-5A22-B211-C7C6B00817D0"
}

Error codes

HTTP status code	Error code	Error message	Description
400	SysomOpenAPI.NotSupportedAgentVersion	Unsupported sysom agent version.	Unsupported SysOM client version.

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.