A service-linked role (SLR) is a type of RAM role for which the trusted entity is an Alibaba Cloud service. Auto Scaling uses a service-linked role to access other cloud services and resources on your behalf.
Usually, a service-linked role is automatically created for you when you perform a specific operation. You must manually create the service-linked role if automatic creation fails or is not supported by Auto Scaling.
Resource Access Management (RAM) provides a system policy for each service-linked role. This policy cannot be modified. To view this system policy, go to the service-linked role's details page. For more information, see AliyunESSFullAccess.
Use cases
-
When you create a scaling group for the first time, you must manually create the service-linked role
AliyunServiceRoleForAutoScaling. Auto Scaling uses this role to access associated cloud resources, such as ECS instances and VPCs. -
If the service-linked role
AliyunServiceRoleForAutoScalinghas been deleted, you must recreate it before you can create another scaling group.
Required RAM user permissions
If you use a RAM user to create or delete a service-linked role, you must ask an administrator for the necessary permissions. The administrator can grant administrative permissions or add the following permissions to the Action statement of a custom policy for the RAM user:
-
Create a service-linked role:
ram:CreateServiceLinkedRole -
Delete a service-linked role:
ram:DeleteServiceLinkedRole
For more information about how to grant permissions, see Permissions required to manage a service-linked role.
Create a service-linked role
When you use Auto Scaling, the system checks whether the AliyunServiceRoleForAutoScaling service-linked role already exists in your account. If the role does not exist, the console reports insufficient permissions and prompts you to authorize the system to automatically create the role. For more information, see Create AliyunServiceRoleForAutoScaling.
After the service-linked role is created, the trusted Alibaba Cloud service can assume the role to access other cloud resources. Be aware that you may be charged for resources created by the service.
Alternatively, you can manually create the service-linked role for Auto Scaling by using the RAM console or by calling an API. For more information, see Create a service-linked role and CreateServiceLinkedRole.
View a service-linked role
After the service-linked role is created, you can go to the Roles page in the RAM console and search for AliyunServiceRoleForAutoScaling to view the role's details.
The Auto Scaling service-linked role, AliyunServiceRoleForAutoScaling, includes the AliyunServiceRolePolicyForAutoScaling system policy. The permission policies for a service-linked role are defined and used by the corresponding cloud service. You cannot add, modify, or delete permissions for a service-linked role. You can view the permission policies included in the role on the role details page. For more information, see View the information about a RAM role.
-
Basic Information
On the
AliyunServiceRoleForAutoScalingrole's details page, the Basic Information section displays the role's basic information, including the role name, creation time, ARN, and description. -
Permissions
On the Permissions tab of the
AliyunServiceRoleForAutoScalingrole details page, click a policy name to view the policy content and the cloud resources the role can access. -
Trust Policy
On the Trust Policy tab of the
AliyunServiceRoleForAutoScalingrole details page, you can view the trust policy. A trust policy defines the trusted entities that can assume a RAM role. For a service-linked role, the trusted entity is a cloud service, which you can identify by checking theServicefield in the trust policy.
For more information about how to view the details of a service-linked role, see View the information about a RAM role.
Delete a service-linked role
-
Before you delete AliyunServiceRoleForAutoScaling, you must first delete all Auto Scaling resources in all regions under the current account, including scaling groups, scheduled tasks, and event-triggered tasks. Otherwise, the deletion will fail.
-
After a service-linked role is deleted, features that rely on the role will not work correctly. Proceed with caution.
If you no longer need to use AliyunServiceRoleForAutoScaling, for example, if you do not need scaling groups to manage resources, you can delete the role. For instructions, see Delete a RAM role.