ApsaraMQ for RocketMQ:Service-linked roles

Background information

RAM provides a system policy for each service-linked role. You cannot modify the system policy. To view the information about the system policy of a specific service-linked role, go to the details page of the role. For more information, see System Policy Reference.

Supported service-linked roles

ApsaraMQ for RocketMQ provides the service-linked roles that are listed in the following table. The first time you use the related features, the system automatically creates the corresponding role.

For example, the first time you use the dashboard feature of ApsaraMQ for RocketMQ, the system automatically creates the AliyunServiceRoleForOns service-linked role.

Policy document

• AliyunServiceRoleForOns

  The following code shows the AliyunServiceRolePolicyForOns policy that is attached to the AliyunServiceRoleForOns service-linked role:

  {
      "Version": "1",
      "Statement": [
          {
              "Action": [
                  "cms:DescribeMetricRuleList",
                  "cms:DescribeMetricList",
                  "cms:DescribeMetricData"
              ],
              "Resource": "*",
              "Effect": "Allow"
          },
          {
              "Action": [
                  "arms:OpenVCluster",
                  "arms:ListDashboards",
                  "arms:CheckServiceStatus"
              ],
              "Resource": "*",
              "Effect": "Allow"
          },
          {
              "Action": "ram:DeleteServiceLinkedRole",
              "Resource": "*",
              "Effect": "Allow",
              "Condition": {
                  "StringEquals": {
                      "ram:ServiceName": "ons.aliyuncs.com"
                  }
              }
          }
      ]
  }

• AliyunServiceRoleForRMQMigration

  The following sample code shows the AliyunServiceRolePolicyForRMQMigration policy that is attached to the AliyunServiceRoleForRMQMigration role:

  {
      "Version": "1",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "privatelink:CreateVpcEndpoint",
                  "privatelink:ListVpcEndpoints",
                  "privatelink:GetVpcEndpointAttribute",
                  "privatelink:AddZoneToVpcEndpoint",
                  "privatelink:ListVpcEndpointZones",
                  "privatelink:RemoveZoneFromVpcEndpoint",
                  "privatelink:DeleteVpcEndpoint",
                  "privatelink:AttachSecurityGroupToVpcEndpoint",
                  "privatelink:ListVpcEndpointSecurityGroups",
                  "privatelink:DetachSecurityGroupFromVpcEndpoint"
              ],
              "Resource": "*"
          },
          {
              "Action": "ram:DeleteServiceLinkedRole",
              "Resource": "*",
              "Effect": "Allow",
              "Condition": {
                  "StringEquals": {
                      "ram:ServiceName": "migration.rmq.aliyuncs.com"
                  }
              }
          },
          {
              "Action": "ram:CreateServiceLinkedRole",
              "Resource": "*",
              "Effect": "Allow",
              "Condition": {
                  "StringEquals": {
                      "ram:ServiceName": "privatelink.aliyuncs.com"
                  }
              }
          }
      ]
  }

View the details of a service-linked role

After a service-linked role is created, you can go to the details page of the role in the RAM console to view the details of the role. The details of a service-linked role include the following information:

• Basic information

  In the Basic Information section, you can view the basic information about the role, including the name, creation time, Alibaba Cloud Resource Name (ARN), and description.

• Policy

  On the Permissions tab, you can click the policy name to view the policy document.

  Note

  You cannot view the permission policy attached to a service-linked role on the Policies page of the RAM console. You can view the permission policy only on the role details page.

• Trust policy

  On the Trust Policy tab, you can view the content of the trust policy that is attached to the role. A trust policy describes the trusted entity of a RAM role. A trusted entity refers to an entity that can assume the RAM role. The trusted entity of a service-linked role is a cloud service. You can view the value of the Service field in the trust policy to obtain the trusted entity.

For more information about how to view a service-linked role, see View the information about a RAM role.

Delete a service-linked role

If you do not use Security Center for a long period of time or want to delete your Alibaba Cloud account, you may need to manually delete service-linked roles in the RAM console. For more information, see Delete a RAM role.

FAQ

Why is the AliyunServiceRoleForOns service-linked role for ApsaraMQ for RocketMQ unable to be automatically created for my RAM user?

If the service-linked role is created for your Alibaba Cloud account, your RAM user inherits the service-linked role of your Alibaba Cloud account. If your RAM user does not inherit the role, log on to the RAM console and add the following permission policy:

{
    "Statement": [
        {
            "Action": [
                "ram:CreateServiceLinkedRole"
            ],
            "Resource": "acs:ram:*:Alibaba Cloud account ID:role/*",
            "Effect": "Allow",
            "Condition": {
              "StringEquals": {
                "ram:ServiceName":  "ons.aliyuncs.com"    
                }
            }
        }
    ],
    "Version": "1"
}

If the service-linked role cannot be automatically created for your RAM user after the policy is attached to the user, attach one of the following system policies to the RAM user:

• AliyunMQFullAccess

• AliyunMQReadOnlyAccess

For more information about the preceding policies, see System policies.