All Products
Search

This Product

    Application Real-Time Monitoring Service:Service-linked role for Application Security

    Document Center

    Application Real-Time Monitoring Service:Service-linked role for Application Security

    Last Updated:Sep 11, 2026

    This topic describes the AliyunServiceRoleForARMSSecurity service-linked role and how to delete it.

    Background

    The AliyunServiceRoleForARMSSecurity is a service-linked role that Application Real-Time Monitoring Service (ARMS) uses to access other cloud services. A service-linked role is a type of RAM role. For more information about service-linked roles, see Service-linked roles.

    Scenarios for AliyunServiceRoleForARMSSecurity

    Application Security uses the automatically created AliyunServiceRoleForARMSSecurity service-linked role to access other Alibaba Cloud security services.

    Permissions of AliyunServiceRoleForARMSSecurity

    The AliyunServiceRoleForARMSSecurity service-linked role grants access to the following cloud service:

    Web Application Firewall (WAF)

    {
      "Action": [
        "yundun-waf:ModifyProtectionConfig",
        "yundun-waf:ModifyApplicationsRaspState",
        "yundun-waf:DescribeRiskDependencyStatisticsInfo",
        "yundun-waf:DescribeRiskDependencies",
        "yundun-waf:DescribeRiskCount",
        "yundun-waf:DescribeProtectionStatisticsInfo",
        "yundun-waf:DescribeProtectionConfig",
        "yundun-waf:DescribeMiddlewareInstances",
        "yundun-waf:DescribeDependencyInstances",
        "yundun-waf:DescribeDependencies",
        "yundun-waf:DescribeAttackStatisticsInfo",
        "yundun-waf:DescribeAttacks",
        "yundun-waf:DescribeAttackCount",
        "yundun-waf:DescribeAttackApplicationCount",
        "yundun-waf:DescribeApplications"
        "yundun-waf:GetRaspCommercialStatus"
      ],
      "Resource": "*",
      "Effect": "Allow"
    }

    Delete the AliyunServiceRoleForARMSSecurity role

    Before you delete the AliyunServiceRoleForARMSSecurity service-linked role for security or other reasons, you must understand the impact of this action. After you delete the role, you can no longer view Application Security pages. To continue using the Application Security feature, you must grant the required permissions again.

    To delete the AliyunServiceRoleForARMSSecurity role, perform the following steps:

    Note

    If an application in your account uses Application Security, you must first disconnect and restart it before you can delete the role. Otherwise, the deletion fails. For information about how to disconnect an application, see Disconnect a target application.

    1. On the page, search for the RAM role named AliyunServiceRoleForARMSSecurity.

    FAQ

    Q: Why doesn't my RAM user automatically create the AliyunServiceRoleForARMSSecurity service-linked role?

    A: A RAM user needs specific permissions to automatically create or delete the AliyunServiceRoleForARMSSecurity role. If the role is not automatically created, attach a custom policy or the AliyunARMSFullAccess system policy to the RAM user.

    Use a custom policy or a system policy based on the following scenarios:

    • Use a custom policy to grant a read-only RAM user only the permissions required for Application Security.

    • The AliyunARMSFullAccess system policy grants a RAM user full permissions for ARMS, including Application Security.

    (Optional) Step 1: Create a custom policy

    1. On the Create Policy page, click the JSON tab. In the policy editor, enter the following policy.

      {
  "Statement": [{
    "Action": [
      "ram:CreateServiceLinkedRole"
    ],
    "Resource": "acs:ram:*:Alibaba Cloud account ID:role/*",
    "Effect": "Allow",
    "Condition": {
      "StringEquals": {
        "ram:ServiceName": [
          "security.arms.aliyuncs.com"
        ]
      }
    }
  }, {
    "Action": "arms:CreateSecurityAuth",
    "Effect": "Allow",
    "Resource": "*"
  }],
  "Version": "1"
}
      Note

      Replace Alibaba Cloud account ID with your Alibaba Cloud account ID.

    Step 2: Attach the policy to a RAM user