Application Real-Time Monitoring Service (ARMS) uses the AliyunServiceRoleForARMS service-linked role to let Managed Service for Prometheus access resources in other Alibaba Cloud services on your behalf, such as Container Service for Kubernetes (ACK), Simple Log Service (SLS), Elastic Compute Service (ECS), and Virtual Private Cloud (VPC). The AliyunServiceRoleForARMS role is automatically created, so you do not need to configure cross-service permissions manually.
For more information about service-linked roles, see Service-linked roles.
Permissions of the AliyunServiceRoleForARMS role
The AliyunServiceRoleForARMS role grants access to four Alibaba Cloud services:
| Service | Access scope |
|---|---|
| Container Service for Kubernetes (ACK) | Read cluster configurations, manage cluster nodes, and manage Kritis-related components. Scoped to acs:cs:*:*:cluster/*. |
| Simple Log Service (SLS) | Create and manage projects, Logstores, indexes, dashboards, saved searches, machine groups, consumer groups, and jobs. |
| Elastic Compute Service (ECS) | Describe instances, disks, snapshots, images, security groups, network interfaces, regions, and monitoring data. Create and invoke Cloud Assistant commands. |
| Virtual Private Cloud (VPC) | Describe VPCs and vSwitches. |
Delete the AliyunServiceRoleForARMS role
Delete the AliyunServiceRoleForARMS role when you no longer use Managed Service for Prometheus.
Impact of deletion:
Kubernetes clusters in your account stop synchronizing to the cluster list in the ARMS console.
ARMS stops reading and writing monitoring data to the ARMS console.
Prerequisites
Uninstall the Prometheus agent from the Kubernetes cluster in your account. The role cannot be deleted while the agent is still installed. For instructions, see Uninstall the Prometheus agent.
Procedure
Log on to the RAM console.
In the left-side navigation pane, choose Identities > Roles.
On the Roles page, enter AliyunServiceRoleForARMS in the search box.
In the Actions column, click Delete.
In the Delete RAM Role dialog box, click OK.
FAQ
Why is the AliyunServiceRoleForARMS role not automatically created for my RAM user?
You must obtain the required permissions to automatically create or delete the AliyunServiceRoleForARMS role. To allow the role to be automatically created for your RAM user, attach the following policy to your RAM user:
{
"Statement": [
{
"Action": [
"ram:CreateServiceLinkedRole"
],
"Resource": "acs:ram:*:<account-id>:role/*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": [
"arms.aliyuncs.com"
]
}
}
}
],
"Version": "1"
}Replace <account-id> with your Alibaba Cloud account ID.