Service-linked roles for Auto Scaling - Auto Scaling - Alibaba Cloud Documentation Center

A service-linked role (SLR) is a RAM role whose trusted entity is an Alibaba Cloud service. Auto Scaling uses an SLR to access other cloud services and resources on your behalf.

A service-linked role is usually created automatically when you perform a specific operation. If automatic creation fails or is not supported, you must manually create the role.

Resource Access Management (RAM) provides an immutable system policy for each service-linked role. To view the policy, go to the role details page. For more information, see AliyunESSFullAccess.

Use cases

When you create a scaling group for the first time, you must manually create the service-linked role AliyunServiceRoleForAutoScaling. Auto Scaling uses this role to access associated cloud resources, such as ECS instances and VPCs.
If the service-linked role AliyunServiceRoleForAutoScaling has been deleted, you must recreate it before you can create another scaling group.

Required RAM user permissions

To create or delete a service-linked role as a RAM user, you need permissions from an administrator. The administrator can grant administrative permissions or add the following actions to a custom policy:

Create a service-linked role: ram:CreateServiceLinkedRole
Delete a service-linked role: ram:DeleteServiceLinkedRole

For more information, see Permissions required to manage a service-linked role.

Create a service-linked role

When you use Auto Scaling, the system checks whether AliyunServiceRoleForAutoScaling exists in your account. If the role does not exist, the console prompts you to authorize automatic creation. For more information, see Create AliyunServiceRoleForAutoScaling.

Important

After the service-linked role is created, the trusted Alibaba Cloud service can assume the role to access other cloud resources. You may be charged for resources created by the service.

You can also manually create the service-linked role by using the RAM console or by calling an API operation. For more information, see Create a service-linked role and CreateServiceLinkedRole.

View a service-linked role

After the role is created, go to the Roles page in the RAM console and search for AliyunServiceRoleForAutoScaling to view the role details.

AliyunServiceRoleForAutoScaling includes the AliyunServiceRolePolicyForAutoScaling system policy. Permission policies for a service-linked role are defined by the corresponding cloud service and cannot be added, modified, or deleted. You can view the attached policies on the role details page. For more information, see View the information about a RAM role.

Basic Information

On the AliyunServiceRoleForAutoScaling role details page, the Basic Information section displays the role name, creation time, ARN, and description.
Permissions

On the Permissions tab of the AliyunServiceRoleForAutoScaling role details page, click a policy name to view the policy content and the cloud resources the role can access.
Trust Policy

On the Trust Policy tab of the AliyunServiceRoleForAutoScaling role details page, you can view the trust policy. A trust policy defines which entities can assume a RAM role. For a service-linked role, the trusted entity is a cloud service, identified by the Service field in the policy.

For more information, see View the information about a RAM role.

Delete a service-linked role

Important

Before you delete AliyunServiceRoleForAutoScaling, you must delete all Auto Scaling resources in all regions under the current account, including scaling groups, scheduled tasks, and event-triggered tasks. Otherwise, the deletion fails.
After a service-linked role is deleted, features that rely on the role will not work correctly. Proceed with caution.

If you no longer need to use AliyunServiceRoleForAutoScaling, for example, if you do not need scaling groups to manage resources, you can delete the role. For instructions, see Delete a RAM role.