API Gateway:Service-linked role for microservices integration - AliyunServiceRoleForApiGatewayIntegrateWithMicroservices

Background

API Gateway uses the RAM role ApiGateway - IntegrateWithMicroservices to access your resources in Enterprise Distributed Application Service (EDAS) and Microservices Engine (MSE). For more information, see Service-linked roles.

Scenarios

When you create an EDAS-type backend service, import EDAS-type backend services, or import APIs from EDAS, API Gateway prompts you to create a service-linked role. After you approve, the system automatically creates AliyunServiceRoleForApiGatewayIntegrateWithMicroservices and attaches the AliyunServiceRolePolicyForApiGatewayIntegrateWithMicroservices policy to it, granting API Gateway permission to access resources in other cloud services.

AliyunServiceRoleForApiGatewayIntegrateWithMicroservices description

Role name: AliyunServiceRoleForApiGatewayIntegrateWithMicroservices Role policy: AliyunServiceRolePolicyForApiGatewayIntegrateWithMicroservices Policy content:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "edas:ReadApplication",
        "edas:ReadNamespace",
        "edas:ReadService"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "mse:ListAnsServices",
        "mse:ListAnsInstances",
        "mse:ListClusters",
        "mse:QueryInstancesInfo",
        "mse:QueryClusterInfo"
      ],
      "Resource": "*"
    },
    {
      "Action": "ram:DeleteServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "microservice-integration.apigateway.aliyuncs.com"
        }
      }
    }
  ]
}

Delete AliyunServiceRoleForApiGatewayIntegrateWithMicroservices

Before you can delete AliyunServiceRoleForApiGatewayIntegrateWithMicroservices, you must delete all backend services that depend on this role. Procedure:

1. Log on to the API Gateway console. In the left-side navigation pane, choose Manage APIs > Backend Services.

2. On the Backend Services page, select EDAS from the Type drop-down list to filter out backend services of the EDAS type. Then, find the service that you want to delete and click Delete in the Actions column.

3. Go to the RAM console. In the left-side navigation pane, choose Identities > Roles. Find the role AliyunServiceRoleForApiGatewayIntegrateWithMicroservices and click Delete Role in the Actions column.

FAQ

Why is AliyunServiceRoleForApiGatewayIntegrateWithMicroservices not automatically created for me as a RAM user?

You do not have the required permissions. Ask the owner of your Alibaba Cloud account to attach the following policy to your RAM user.

{

{
    "Statement": [
        {
            "Action": "ram:CreateServiceLinkedRole",
            "Resource": "*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": "microservice-integration.apigateway.aliyuncs.com"
                }
            }
        }
    ],
    "Version": "1"
}