The first time you log on to the Cloud Firewall console, you must authorize Cloud Firewall to access the other cloud resources within your account before you can use features provided by Cloud Firewall. This topic describes how to authorize Cloud Firewall by using the AliyunServiceRoleForCloudFW service-linked role and how to delete this role.

Prerequisites

An Alibaba Cloud account or a Resource Access Management (RAM) user that has permissions to create or delete service-linked roles is used.

For more information about how to grant RAM users the permissions on service-linked roles, see FAQ.

Background information

To provide features such as access control, monitoring, and analysis on cloud traffic, Cloud Firewall must access the other cloud resources within your account, such as ECS instances, VPCs, SLB instances, Log Service, bastion hosts, CEN instances, Security Center, and ApsaraDB RDS instances. You can use the AliyunServiceRoleForCloudFW service-linked role to authorize Cloud Firewall. This role is automatically created. You do not need to manually create or modify a service-linked role. For more information, see Service-linked roles.

Procedure

  1. Log on to the Cloud Firewall console.
  2. In the Service-Linked Role for Cloud Firewall dialog box, click OK.
    Note If the AliyunServiceRoleForCloudFW service-linked role is created, the dialog box does not appear, and you can directly use Cloud Firewall in the console.
    Service-Linked Role for Cloud Firewall
    Then, Alibaba Cloud automatically creates the AliyunServiceRoleForCloudFW service-linked role.

    You can view the service-linked role on the Roles page of the RAM console. Cloud Firewall can access the other cloud resources within your account only after the AliyunServiceRoleForCloudFW service-linked role is created. The resources include ECS instances, VPCs, SLB instances, Log Service, bastion hosts, CEN instances, Security Center, and ApsaraDB RDS instances.

Permissions of the AliyunServiceRoleForCloudFW service-linked role

By default, the AliyunServiceRoleForCloudFW service-linked role is attached with the AliyunServiceRolePolicyForCloudFW policy. The following code block provides the permissions defined in the AliyunServiceRolePolicyForCloudFW policy:

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "ecs:DescribeInstances",
                "ecs:DescribeTags",
                "ecs:JoinSecurityGroup",
                "ecs:LeaveSecurityGroup",
                "ecs:AuthorizeSecurityGroupEgress",
                "ecs:DescribeRegions",
                "ecs:DescribeVpcs",
                "ecs:RevokeSecurityGroupEgress",
                "ecs:ModifySecurityGroupAttribute",
                "ecs:DeleteSecurityGroup",
                "ecs:RevokeSecurityGroup",
                "ecs:DescribeSecurityGroupAttribute",
                "ecs:CreateSecurityGroup",
                "ecs:AuthorizeSecurityGroup",
                "ecs:DescribeSecurityGroups",
                "ecs:DescribeSecurityGroupReferences",
                "ecs:ModifySecurityGroupPolicy",
                "ecs:ModifySecurityGroupRule",
                "ecs:ModifySecurityGroupEgressRule",
                "ecs:CreateNetworkInterface",
                "ecs:DeleteNetworkInterface",
                "ecs:DescribeNetworkInterfaces",
                "ecs:CreateNetworkInterfacePermission",
                "ecs:DescribeNetworkInterfacePermissions",
                "ecs:DeleteNetworkInterfacePermission",
                "ecs:AttachNetworkInterface",
                "ecs:DetachNetworkInterface"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "vpc:DescribeVpcs",
                "vpc:DescribeNatGateways",
                "vpc:DescribeSnatTableEntries",
                "vpc:DescribeForwardTableEntries",
                "vpc:DescribeBandwidthPackages",
                "vpc:GetNatGatewayAttribute",
                "vpc:ModifyNatGatewayAttribute",
                "vpc:DescribeEipAddresses",
                "vpc:DescribeRouterInterfaces",
                "vpc:DescribeRouteTableList",
                "vpc:DescribeRouteTables",
                "vpc:DescribeVSwitches",
                "vpc:CreateRouteEntry",
                "vpc:DeleteRouteEntry",
                "vpc:CreateVpc",
                "vpc:DeleteVpc",
                "vpc:CreateVSwitch",
                "vpc:DeleteVSwitch",
                "vpc:DescribeZones",
                "vpc:CreateVirtualBorderRouter",
                "vpc:ConnectRouterInterface",
                "vpc:ModifyRouterInterfaceAttribute",
                "vpc:DeleteRouterInterface",
                "vpc:CreateRouterInterface",
                "vpc:DeleteVirtualBorderRouter",
                "vpc:DeactivateRouterInterface",
                "vpc:DescribeVirtualBorderRouters",
                "vpc:DescribePhysicalConnections",
                "vpc:ModifyVirtualBorderRouterAttribute",
                "vpc:DescribeVpcAttribute",
                "vpc:DescribeVSwitchAttributes",
                "vpc:DescribeHaVips",
                "vpc:DescribeVpnConnections",
                "vpc:DescribeVpnRouteEntries",
                "vpc:DescribeVpnPbrRouteEntries",
                "vpc:DescribeVpnGateways",
                "vpc:DescribeSslVpnServers",
                "vpc:AssociateEipAddress",
                "vpc:UnassociateEipAddress",
                "vpc:CreateRouteTable",
                "vpc:DeleteRouteTable",
                "vpc:AssociateRouteTable",
                "vpc:UnassociateRouteTable",
                "vpc:CreateSnatEntry",
                "vpc:DeleteSnatEntry",
                "vpc:DescribeSnatTableEntries",
                "vpc:DescribeRouteEntryList",
                "vpc:DescribeIpv6Addresses"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "slb:DescribeRegions",
                "slb:DescribeLoadBalancers",
                "slb:DescribeLoadBalancerAttribute",
                "slb:DescribeLoadBalancerUDPListenerAttribute",
                "slb:DescribeLoadBalancerTCPListenerAttribute",
                "slb:DescribeLoadBalancerHTTPListenerAttribute",
                "slb:DescribeLoadBalancerHTTPSListenerAttribute",
                "slb:DescribeHealthStatus",
                "slb:DescribeAccessControlListAttribute"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "log:PostLogStoreLogs",
                "log:GetProject",
                "log:ListProject",
                "log:GetLogStore",
                "log:ListLogStores",
                "log:CreateLogStore",
                "log:CreateProject",
                "log:GetIndex",
                "log:CreateIndex",
                "log:UpdateIndex",
                "log:CreateDashboard",
                "log:ClearLogStoreStorage",
                "log:UpdateLogStore",
                "log:UpdateDashboard",
                "log:CreateSavedSearch",
                "log:UpdateSavedSearch",
                "log:DeleteLogStore",
                "log:DeleteSavedSearch",
                "log:GetSavedSearch",
                "log:ListSavedSearch",
                "log:DeleteDashboard",
                "log:GetDashboard",
                "log:ListDashboard"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "yundun-bastionhost:DescribeInstance",
                "yundun-bastionhost:DescribeRegions",
                "yundun-bastionhost:DescribeInstances",
                "yundun-bastionhost:DescribeInstanceBastionhost",
                "yundun-bastionhost:DescribeInstanceAttribute"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "cen:DescribeCens",
                "cen:DescribeCenAttachedChildInstances",
                "cen:DescribeCenAttachedChildInstanceAttribute",
                "cen:AttachCenChildInstance",
                "cen:DetachCenChildInstance",
                "cen:PublishRouteEntries",
                "cen:WithdrawPublishedRouteEntries",
                "cen:DescribePublishedRouteEntries",
                "cen:DescribeCenRegionDomainRouteEntries",
                "cen:ModifyCenAttribute",
                "cen:CreateCenRouteMap",
                "cen:DeleteCenRouteMap",
                "cen:ModifyCenRouteMap",
                "cen:DescribeCenRouteMaps",
                "cen:DescribeCenChildInstanceRouteEntries",
                "cen:CreateCenChildInstanceRouteEntryToCen",
                "cen:DeleteCenChildInstanceRouteEntryToCen",
                "cen:ListTransitRouters",
                "cen:CreateTransitRouter",
                "cen:DeleteTransitRouter",
                "cen:ListTransitRouterAttachments",
                "cen:CreateTransitRouterVpcAttachment",
                "cen:DeleteTransitRouterVpcAttachment",
                "cen:UpdateTransitRouterVpcAttachmentAttribute",
                "cen:UpdateTransitRouterPeerAttachmentAttribute",
                "cen:CreateTransitRouterVbrAttachment",
                "cen:DeleteTransitRouterVbrAttachment",
                "cen:ListTransitRouterPeerAttachments",
                "cen:ListTransitRouterVpcAttachments",
                "cen:ListTransitRouterVbrAttachments",
                "cen:ListTransitRouterAvailableResource",
                "cen:CreateTransitRouterRouteTable",
                "cen:UpdateTransitRouterRouteTable",
                "cen:DeleteTransitRouterRouteTable",
                "cen:ListTransitRouterRouteTables",
                "cen:CreateTransitRouterRouteEntry",
                "cen:DeleteTransitRouterRouteEntry",
                "cen:ListTransitRouterRouteEntries",
                "cen:ListTransitRouterRouteTableAssociations",
                "cen:AssociateTransitRouterAttachmentWithRouteTable",
                "cen:DissociateTransitRouterAttachmentFromRouteTable",
                "cen:ListTransitRouterRouteTablePropagations",
                "cen:EnableTransitRouterRouteTablePropagation",
                "cen:DisableTransitRouterRouteTablePropagation",
                "cen:ModifyCenUserQuota",
                "cen:ReplaceTransitRouterRouteTableAssociation"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "netana:DescribeNetworkQuotas",
                "netana:DescribeNetworkQuotaRequestResult",
                "netana:CreateNetworkQuotaRequest"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "yundun-sas:DescribeVulList",
                "yundun-sas:DescribeVulDetails"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "rds:DescribeDBInstances"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": "ram:CreateServiceLinkedRole",
            "Resource": "*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": "cen.aliyuncs.com"
                }
            }
        },
        {
            "Action": [
                "resourcemanager:ListAccounts"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": "ram:DeleteServiceLinkedRole",
            "Resource": "*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": "cloudfw.aliyuncs.com"
                }
            }
        }
    ]
}

For more information about the policy syntax, see Policy elements.

Delete a service-linked role

If you no longer use Cloud Firewall, you can delete the AliyunServiceRoleForCloudFW service-linked role. Before you can delete the service-linked role, make sure that Cloud Firewall expires and is automatically released. For more information, see Delete a RAM role.

FAQ

Why is the AliyunServiceRoleForCloudFW service-linked role not automatically created for my RAM user?

The AliyunServiceRoleForCloudFW service-linked role can be automatically created or deleted only if your RAM user has the required permissions. To obtain the permissions, you must attach the following policy to your RAM user. For more information, see Grant permissions to a RAM user.
{
    "Statement": [
        {
            "Action": [
                "ram:CreateServiceLinkedRole"
            ],
            "Resource": "acs:ram:*:ID of an Alibaba Cloud account:role/*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": [
                        "cloudfw.aliyuncs.com"
                    ]
                }
            }
        }
    ],
    "Version": "1"
}