How to authorize Cloud Firewall to access cloud resources - Cloud Firewall

When you log on to the Cloud Firewall console for the first time, you must authorize Cloud Firewall to access your cloud resources before you can use the services provided by Cloud Firewall. This topic describes how to use the service-linked role for Cloud Firewall, AliyunServiceRoleForCloudFW, to grant access to your cloud resources, and how to delete AliyunServiceRoleForCloudFW.

Prerequisites

You have an Alibaba Cloud account or a RAM user with permissions to create and delete service-linked roles. For more information about how to grant permissions to a RAM user, see FAQ.

Background information

To provide features such as access control, monitoring, and analysis of network traffic, Cloud Firewall needs to access your resources in various cloud services, including Elastic Compute Service, Virtual Private Cloud, Server Load Balancers, Simple Log Service, Bastionhost, Cloud Enterprise Network, Security Center, and ApsaraDB RDS. You can grant access by using the Cloud Firewall service-linked role AliyunServiceRoleForCloudFW, which is automatically created by the system. You do not need to manually create or modify this service-linked role. For more information, see service-linked roles.

Procedure

Subscription

Log on to the Cloud Firewall console.
In the Service-linked Role for Cloud Firewall dialog box, click OK.

Note
If you have already created the AliyunServiceRoleForCloudFW role, this dialog box does not appear, and you can use Cloud Firewall directly.

Confirm that the permission policy for the role is AliyunServiceRolePolicyForCloudFW. This policy lets Cloud Firewall access services such as ECS, SLB, NAT Gateway, EIP, and security groups.

Pay-as-you-go

Go to the Cloud Firewall purchase page and set Product Type to Pay-as-you-go 2.0.
In the Service-linked Role section, click Create Service-Linked Role.

After you complete the steps, Alibaba Cloud automatically creates the Cloud Firewall service-linked role AliyunServiceRoleForCloudFW.

You can view the service-linked role that Alibaba Cloud automatically creates for Cloud Firewall on the Roles page in the RAM console. After the service-linked role AliyunServiceRoleForCloudFW is created, your Cloud Firewall instance can access the resources of associated cloud services, such as Elastic Compute Service, Virtual Private Cloud, Server Load Balancer, Simple Log Service, Bastionhost, Cloud Enterprise Network, Security Center, and ApsaraDB RDS.

AliyunServiceRoleForCloudFW permissions

By default, the AliyunServiceRoleForCloudFW role has the AliyunServiceRolePolicyForCloudFW system policy. The permissions defined in AliyunServiceRolePolicyForCloudFW are as follows.

{
  "Version": "1",
  "Statement": [
    {
      "Action": [
        "ecs:DescribeInstances",
        "ecs:DescribeTags",
        "ecs:JoinSecurityGroup",
        "ecs:LeaveSecurityGroup",
        "ecs:AuthorizeSecurityGroupEgress",
        "ecs:DescribeRegions",
        "ecs:DescribeVpcs",
        "ecs:RevokeSecurityGroupEgress",
        "ecs:ModifySecurityGroupAttribute",
        "ecs:DeleteSecurityGroup",
        "ecs:RevokeSecurityGroup",
        "ecs:DescribeSecurityGroupAttribute",
        "ecs:CreateSecurityGroup",
        "ecs:AuthorizeSecurityGroup",
        "ecs:DescribeSecurityGroups",
        "ecs:DescribeSecurityGroupReferences",
        "ecs:ModifySecurityGroupPolicy",
        "ecs:ModifySecurityGroupRule",
        "ecs:ModifySecurityGroupEgressRule",
        "ecs:CreateNetworkInterface",
        "ecs:DeleteNetworkInterface",
        "ecs:DescribeNetworkInterfaces",
        "ecs:CreateNetworkInterfacePermission",
        "ecs:DescribeNetworkInterfacePermissions",
        "ecs:DeleteNetworkInterfacePermission",
        "ecs:AttachNetworkInterface",
        "ecs:DetachNetworkInterface",
        "ecs:ModifyNetworkInterfaceAttribute",
        "ecs:DescribePrefixLists",
        "ecs:ListTagResources",
        "ecs:ImportImage",
        "ecs:ModifyInstanceSpec",
        "ecs:CreateImage"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "vpc:DescribeVpcs",
        "vpc:DescribeNatGateways",
        "vpc:DescribeSnatTableEntries",
        "vpc:DescribeForwardTableEntries",
        "vpc:DescribeBandwidthPackages",
        "vpc:GetNatGatewayAttribute",
        "vpc:ModifyNatGatewayAttribute",
        "vpc:DescribeEipAddresses",
        "vpc:DescribeRouterInterfaces",
        "vpc:DescribeRouteTableList",
        "vpc:DescribeRouteTables",
        "vpc:DescribeVSwitches",
        "vpc:CreateRouteEntry",
        "vpc:DeleteRouteEntry",
        "vpc:CreateVpc",
        "vpc:DeleteVpc",
        "vpc:CreateVSwitch",
        "vpc:DeleteVSwitch",
        "vpc:DescribeZones",
        "vpc:CreateVirtualBorderRouter",
        "vpc:ConnectRouterInterface",
        "vpc:ModifyRouterInterfaceAttribute",
        "vpc:DeleteRouterInterface",
        "vpc:CreateRouterInterface",
        "vpc:DeleteVirtualBorderRouter",
        "vpc:DeactivateRouterInterface",
        "vpc:DescribeVirtualBorderRouters",
        "vpc:DescribePhysicalConnections",
        "vpc:ModifyVirtualBorderRouterAttribute",
        "vpc:DescribeVpcAttribute",
        "vpc:DescribeVSwitchAttributes",
        "vpc:DescribeHaVips",
        "vpc:DescribeVpnConnections",
        "vpc:DescribeVpnRouteEntries",
        "vpc:DescribeVpnPbrRouteEntries",
        "vpc:DescribeVpnGateways",
        "vpc:DescribeSslVpnServers",
        "vpc:AssociateEipAddress",
        "vpc:UnassociateEipAddress",
        "vpc:CreateRouteTable",
        "vpc:DeleteRouteTable",
        "vpc:AssociateRouteTable",
        "vpc:UnassociateRouteTable",
        "vpc:CreateSnatEntry",
        "vpc:DeleteSnatEntry",
        "vpc:DescribeSnatTableEntries",
        "vpc:DescribeRouteEntryList",
        "vpc:DescribeIpv6Addresses",
        "vpc:ListVpcPeerConnections",
        "vpc:CreateRouteEntries",
        "vpc:DeleteRouteEntries",
        "vpc:ModifyRouteEntry",
        "vpc:DescribeRegions",
        "vpc:CheckCanAllocateVpcPrivateIpAddress",
        "vpc:CreateTrafficMirrorFilterRules",
        "vpc:UpdateTrafficMirrorFilterAttribute",
        "vpc:AddSourcesToTrafficMirrorSession",
        "vpc:GetTrafficMirrorServiceStatus",
        "vpc:ListTrafficMirrorFilters",
        "vpc:CreateTrafficMirrorFilter",
        "vpc:DeleteTrafficMirrorFilter",
        "vpc:UpdateTrafficMirrorSessionAttribute",
        "vpc:DeleteTrafficMirrorFilterRules",
        "vpc:ListTrafficMirrorSessions",
        "vpc:CreateTrafficMirrorSession",
        "vpc:RemoveSourcesFromTrafficMirrorSession",
        "vpc:DeleteTrafficMirrorSession",
        "vpc:OpenTrafficMirrorService",
        "vpc:UpdateTrafficMirrorFilterRuleAttribute"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "slb:DescribeRegions",
        "slb:DescribeLoadBalancers",
        "slb:DescribeLoadBalancerAttribute",
        "slb:DescribeLoadBalancerUDPListenerAttribute",
        "slb:DescribeLoadBalancerTCPListenerAttribute",
        "slb:DescribeLoadBalancerHTTPListenerAttribute",
        "slb:DescribeLoadBalancerHTTPSListenerAttribute",
        "slb:DescribeHealthStatus",
        "slb:DescribeAccessControlListAttribute"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "alb:DescribeRegions",
        "alb:ListLoadBalancers",
        "alb:GetLoadBalancerAttribute",
        "alb:ListListeners",
        "alb:GetListenerAttribute",
        "alb:GetListenerHealthStatus",
        "alb:ListAcls",
        "alb:ListAclEntries"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "nlb:DescribeRegions",
        "nlb:ListLoadBalancers",
        "nlb:GetLoadBalancerAttribute",
        "nlb:ListListeners",
        "nlb:GetListenerAttribute",
        "nlb:GetListenerHealthStatus"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "log:PostLogStoreLogs",
        "log:GetProject",
        "log:ListProject",
        "log:GetLogStore",
        "log:ListLogStores",
        "log:CreateLogStore",
        "log:CreateProject",
        "log:DeleteProject",
        "log:GetLogStoreLogs",
        "log:GetIndex",
        "log:CreateIndex",
        "log:UpdateIndex",
        "log:CreateDashboard",
        "log:ClearLogStoreStorage",
        "log:UpdateLogStore",
        "log:UpdateDashboard",
        "log:CreateSavedSearch",
        "log:UpdateSavedSearch",
        "log:DeleteLogStore",
        "log:DeleteSavedSearch",
        "log:GetSavedSearch",
        "log:ListSavedSearch",
        "log:DeleteDashboard",
        "log:GetDashboard",
        "log:ListDashboard",
        "log:GetLogStoreHistogram"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "yundun-bastionhost:DescribeInstance",
        "yundun-bastionhost:DescribeRegions",
        "yundun-bastionhost:DescribeInstances",
        "yundun-bastionhost:DescribeInstanceBastionhost",
        "yundun-bastionhost:DescribeInstanceAttribute"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "cen:DescribeCens",
        "cen:DescribeCenAttachedChildInstances",
        "cen:DescribeCenAttachedChildInstanceAttribute",
        "cen:AttachCenChildInstance",
        "cen:DetachCenChildInstance",
        "cen:PublishRouteEntries",
        "cen:WithdrawPublishedRouteEntries",
        "cen:DescribePublishedRouteEntries",
        "cen:DescribeCenRegionDomainRouteEntries",
        "cen:ModifyCenAttribute",
        "cen:CreateCenRouteMap",
        "cen:DeleteCenRouteMap",
        "cen:ModifyCenRouteMap",
        "cen:DescribeCenRouteMaps",
        "cen:DescribeCenChildInstanceRouteEntries",
        "cen:CreateCenChildInstanceRouteEntryToCen",
        "cen:DeleteCenChildInstanceRouteEntryToCen",
        "cen:ListTransitRouters",
        "cen:CreateTransitRouter",
        "cen:DeleteTransitRouter",
        "cen:ListTransitRouterAttachments",
        "cen:CreateTransitRouterVpcAttachment",
        "cen:DeleteTransitRouterVpcAttachment",
        "cen:UpdateTransitRouterVpcAttachmentAttribute",
        "cen:UpdateTransitRouterPeerAttachmentAttribute",
        "cen:CreateTransitRouterVbrAttachment",
        "cen:DeleteTransitRouterVbrAttachment",
        "cen:ListTransitRouterPeerAttachments",
        "cen:ListTransitRouterVpcAttachments",
        "cen:ListTransitRouterVbrAttachments",
        "cen:ListTransitRouterAvailableResource",
        "cen:CreateTransitRouterRouteTable",
        "cen:UpdateTransitRouterRouteTable",
        "cen:DeleteTransitRouterRouteTable",
        "cen:ListTransitRouterRouteTables",
        "cen:CreateTransitRouterRouteEntry",
        "cen:DeleteTransitRouterRouteEntry",
        "cen:ListTransitRouterRouteEntries",
        "cen:ListTransitRouterRouteTableAssociations",
        "cen:AssociateTransitRouterAttachmentWithRouteTable",
        "cen:DissociateTransitRouterAttachmentFromRouteTable",
        "cen:ListTransitRouterRouteTablePropagations",
        "cen:EnableTransitRouterRouteTablePropagation",
        "cen:DisableTransitRouterRouteTablePropagation",
        "cen:ModifyCenUserQuota",
        "cen:ReplaceTransitRouterRouteTableAssociation",
        "cen:CheckTransitRouterService",
        "cen:ListTransitRouterPrefixListAssociation"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "netana:DescribeNetworkQuotas",
        "netana:DescribeNetworkQuotaRequestResult",
        "netana:CreateNetworkQuotaRequest"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "privatelink:CheckProductOpen",
        "privatelink:OpenPrivateLinkService",
        "privatelink:CreateVpcEndpoint",
        "privatelink:DeleteVpcEndpoint",
        "privatelink:ListVpcEndpoints",
        "privatelink:ListVpcEndpointZones",
        "privatelink:AddZoneToVpcEndpoint",
        "privatelink:RemoveZoneFromVpcEndpoint",
        "privatelink:ListVpcEndpointServicesByEndUser"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "yundun-sas:DescribeVulList",
        "yundun-sas:DescribeVulDetails",
        "yundun-sas:DescribeCloudCenterInstances"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "yundun-cert:DescribeCACertificateList",
        "yundun-cert:GetUserStatus",
        "yundun-cert:CreateTestOrder",
        "yundun-cert:CreateRootCACertificate",
        "yundun-cert:CreateSubCACertificate"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "cs:DescribeUserQuota",
        "cs:DescribeClusterNodes",
        "cs:DescribeClusterNodePools",
        "cs:DescribeClusterNodePoolDetail",
        "cs:DescribeUserClusterNamespaces",
        "cs:DescribeClustersV1",
        "cs:DescribeClusterUserKubeconfig",
        "cs:DescribeClusterResources",
        "cs:DescribeClusterDetail",
        "cs:GetClusters",
        "cs:DescribeUserPermission",
        "cs:UpdateUserPermissions",
        "cs:GrantPermissions",
        "cs:CleanClusterUserPermissions"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "rds:DescribeDBInstances"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": "ram:CreateServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "cen.aliyuncs.com"
        }
      }
    },
    {
      "Action": [
        "resourcemanager:ListAccounts"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "cms:QueryMetricList",
        "cms:QueryMetricData",
        "cms:QueryMetricLast"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": "yundun-aegis:DescribeAccesskeyLeakList",
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": "ram:DeleteServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "cloudfw.aliyuncs.com"
        }
      }
    },
    {
      "Action": "ram:CreateServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "privatelink.aliyuncs.com"
        }
      }
    }
  ]
}

For more information about the syntax of permission policies, see Policy elements.

Deleting the service-linked role

If you no longer need to use Cloud Firewall, you can delete the Cloud Firewall service-linked role AliyunServiceRoleForCloudFW. You can delete the service-linked role only after your Cloud Firewall instance expires and is automatically released. For more information, see Delete a RAM role.

FAQ

Why can't my RAM user automatically create the Cloud Firewall service-linked role AliyunServiceRoleForCloudFW?

A RAM user must have specific permissions to automatically create or delete the AliyunServiceRoleForCloudFW role. If your RAM user cannot automatically create the AliyunServiceRoleForCloudFW role, you must attach the following policy to the RAM user. For detailed instructions, see Grant permissions to a RAM user.

{
    "Statement": [
        {
            "Action": [
                "ram:CreateServiceLinkedRole"
            ],
            "Resource": "acs:ram:*:Your Alibaba Cloud account ID:role/*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": [
                        "cloudfw.aliyuncs.com"
                    ]
                }
            }
        }
    ],
    "Version": "1"
}