Manage the service-linked role for ASM - Alibaba Cloud Service Mesh

AliyunServiceRoleForServiceMesh is a service-linked role from Resource Access Management (RAM) that allows Service Mesh to access other cloud resources.

Background

A service-linked role is a role linked to a specific cloud service. The service-linked role for ASM (AliyunServiceRoleForServiceMesh) allows Service Mesh to access other Alibaba Cloud services, such as Managed Service for OpenTelemetry, VPC, Classic Load Balancer (CLB), SLS, Managed Service for OpenTelemetry, ARMS, and CEN. For more information about service-linked roles, see Service-linked roles.

Prerequisites

If you use an Alibaba Cloud account, you have the permission to create the ASM service-linked role by default. If you use a RAM user, you must grant the RAM user the permission to create the service-linked role for Service Mesh. The required policy is CreateServiceLinkedRole. For more information, see Manage the permissions of a RAM user.

{
    "Statement": [
        {
            "Action": "ram:CreateServiceLinkedRole",
            "Resource": "*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": "servicemesh.aliyuncs.com"
                }
            }
        }
    ],
    "Version": "1"
}

Create the service-linked role for ASM

When you use Service Mesh, the system checks whether the AliyunServiceRoleForServiceMesh role exists in your account. If the role does not exist, the system prompts you to create it. In the Service Mesh console, click Create Now in the prompt to create the role.

The linked cloud service defines and uses the permission policies for a service-linked role. Therefore, you cannot add, modify, or remove its permissions. You can view the permission policies and other information on the role details page. For more information, see View the information about a RAM role.

Delete the service-linked role for ASM

If you no longer need to use Service Mesh, you can delete the AliyunServiceRoleForServiceMesh role.

Important

Before you delete the AliyunServiceRoleForServiceMesh role, you must delete all Service Mesh instances in all regions under your account. Otherwise, the deletion will fail. Each Alibaba Cloud account has only one AliyunServiceRoleForServiceMesh role. After you delete the role, neither your Alibaba Cloud account nor its RAM users can create or use Service Mesh.

Log on to the RAM console. In the navigation pane on the left, choose Identities > Roles.
On the Roles page, use the search box to find AliyunServiceRoleForServiceMesh, and then click Delete Role in the Actions column.
In the Delete Role dialog box, enter AliyunServiceRoleForServiceMesh and click Delete Role.
Note
While the role is being deleted, the status in the Actions column is Deleting. Wait a few seconds until the deletion is complete. If the deletion fails, click Show Details in the error message and follow the on-screen instructions to resolve the issue.