What is a service-linked role for CPFS? - Cloud Parallel File Storage

Cloud Parallel File Storage (CPFS) uses service-linked roles to access other Alibaba Cloud services, such as Virtual Private Cloud and Object Storage Service. This topic describes the use cases, permissions, and deletion methods for these roles.

Background information

A service-linked role is a RAM role whose trusted entity is an Alibaba Cloud service. Cloud Parallel File Storage uses service-linked roles to access other cloud services or resources.

When you use a feature that requires a service-linked role, the system typically creates the role automatically. If the automatic creation fails or is not supported by Cloud Parallel File Storage, you must manually create the service-linked role.

RAM provides a system policy for each service-linked role. This policy cannot be modified. To view the policy content, go to the details page of the corresponding role in the RAM console.

Note

For more information about service-linked roles, see Service-linked roles.

Use cases

The following service-linked roles are used by CPFS:

AliyunServiceRoleForNasCpfsNetwork

When you create or delete an elastic network interface (ENI) or a security group, CPFS uses this role to access VPC and ECS.
AliyunServiceRoleForNasCpfsClient

When you create or delete ECS instances, Cloud Assistant, or security groups, CPFS uses this role to access VPC and ECS.
AliyunServiceRoleForNasOssDataFlow

When you use the dataflow feature, CPFS uses this role to query, read, and write data in a specified OSS bucket.
AliyunServiceRoleForNasEventNotification

When you use the dataflow feature, CPFS uses this role to create and modify EventBridge parameters.

For more information about service-linked roles, see Service-linked roles.

Permissions

The permissions granted to each CPFS service-linked role are as follows:

AliyunServiceRoleForNasCpfsNetwork

This role grants CPFS the permissions to manage network resources required for mount targets:

vpc: Read VPC and vSwitch attributes to validate network configurations.
ecs (unrestricted): Create security groups and ENIs, and manage ENI permissions.
ecs (tagged resources only): Manage security group rules for resources that are tagged with nas:cpfs=true.

ram: Delete this service-linked role (scoped to cpfs-network.nas.aliyuncs.com).

{
    "Version": "1",
    "Statement": [{
            "Action": [
                "vpc:DescribeVSwitchAttributes",
                "vpc:DescribeVpcs",
                "vpc:DescribeVSwitches"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "ecs:CreateSecurityGroup",
                "ecs:DescribeSecurityGroups",
                "ecs:CreateNetworkInterface",
                "ecs:DeleteNetworkInterface",
                "ecs:DescribeNetworkInterfaces",
                "ecs:CreateNetworkInterfacePermission",
                "ecs:DescribeNetworkInterfacePermissions",
                "ecs:DeleteNetworkInterfacePermission"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ecs:DescribeSecurityGroupAttribute",
                "ecs:DeleteSecurityGroup",
                "ecs:AuthorizeSecurityGroup",
                "ecs:AuthorizeSecurityGroupEgress",
                "ecs:RevokeSecurityGroup",
                "ecs:RevokeSecurityGroupEgress"
            ],
            "Resource": "acs:ecs:*:*:*/*",
            "Condition": {
                "StringEqualsIgnoreCase": {
                    "ecs:tag/nas:cpfs": "true"
                }
            }
        },
        {
            "Action": "ram:DeleteServiceLinkedRole",
            "Resource": "*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": "cpfs-network.nas.aliyuncs.com"
                }
            }
        }
    ]
}

AliyunServiceRoleForNasCpfsClient

This role grants CPFS the permissions to manage client instances for mounting:

vpc: Read VPC and vSwitch attributes.
ecs (unrestricted): Create and query instances and security groups, and install Cloud Assistant.
ecs (tagged resources only): Start and delete instances, run commands, and manage security group rules for resources that are tagged with nas:cpfs=true.

ram: Delete this service-linked role (scoped to cpfs-client.nas.aliyuncs.com).

{
 "Version": "1",
 "Statement": [
 {
 "Action": [
 "vpc:DescribeVSwitchAttributes",
 "vpc:DescribeVpcs",
 "vpc:DescribeVSwitches"
 ],
 "Resource": "*",
 "Effect": "Allow"
 },
 {
 "Action": [
 "ecs:RunInstances",
 "ecs:CreateInstance",
 "ecs:DescribeInstances",
 "ecs:CreateSecurityGroup",
 "ecs:DescribeSecurityGroups",
 "ecs:InstallCloudAssistant",
 "ecs:DescribeInvocations"
 ],
 "Resource": "*",
 "Effect": "Allow"
 },
 {
 "Effect": "Allow",
 "Action": [
 "ecs:StartInstances",
 "ecs:DeleteInstances",
 "ecs:RunCommand",
 "ecs:DescribeSecurityGroupAttribute",
 "ecs:DeleteSecurityGroup",
 "ecs:AuthorizeSecurityGroup",
 "ecs:AuthorizeSecurityGroupEgress",
 "ecs:RevokeSecurityGroup",
 "ecs:RevokeSecurityGroupEgress"
 ],
 "Resource": "acs:ecs:*:*:*/*",
 "Condition": {
 "StringEqualsIgnoreCase": {
 "ecs:tag/nas:cpfs": "true"
 }
 }
 },
 {
 "Action": "ram:DeleteServiceLinkedRole",
 "Resource": "*",
 "Effect": "Allow",
 "Condition": {
 "StringEquals": {
 "ram:ServiceName": "cpfs-client.nas.aliyuncs.com"
 }
 }
 } 
 ]
 }

AliyunServiceRoleForNasOssDataFlow

This role grants CPFS the permissions required for the dataflow feature to read and write OSS data:

oss (unrestricted): List all buckets and read bucket tags to locate the target bucket.
oss (tagged buckets only): Full read and write access to buckets and their objects that are tagged with cpfs-dataflow=true, including multipart uploads.

ram: Delete this service-linked role (scoped to oss-dataflow.nas.aliyuncs.com).

{
 "Statement": [
 {
 "Effect": "Allow",
 "Action": [
 "oss:ListBuckets",
 "oss:GetBucketTagging"
 ],
 "Resource": [
 "acs:oss:*:*:*"
 ]
 },
 {
 "Effect": "Allow",
 "Action": [
 "oss:HeadBucket",
 "oss:GetBucketLocation",
 "oss:GetBucketInventory",
 "oss:GetBucketInfo",
 "oss:GetBucketVersion",
 "oss:GetBucketAcl",
 "oss:GetBucketStat",
 "oss:GetBucket",
 "oss:ListObjects",
 "oss:GetObject",
 "oss:PutObject",
 "oss:CopyObject",
 "oss:AppendObject",
 "oss:DeleteObject",
 "oss:GetObjectMeta",
 "oss:PutObjectACL",
 "oss:GetObjectACL",
 "oss:PutObjectTagging",
 "oss:GetObjectTagging",
 "oss:InitiateMultipartUpload",
 "oss:CompleteMultipartUpload",
 "oss:AbortMultipartUpload",
 "oss:ListMultipartUploads",
 "oss:UploadPart",
 "oss:UploadPartCopy",
 "oss:ListParts"
 ],
 "Resource": [
 "acs:oss:*:*:*",
 "acs:oss:*:*:*/*"
 ],
 "Condition": {
 "StringEqualsIgnoreCase": {
 "oss:tag/cpfs-dataflow": "true"
 }
 }
 },
 {
 "Action": "ram:DeleteServiceLinkedRole",
 "Resource": "*",
 "Effect": "Allow",
 "Condition": {
 "StringEquals": {
 "ram:ServiceName": "oss-dataflow.nas.aliyuncs.com"
 }
 }
 }
 ],
 "Version": "1"
}

AliyunServiceRoleForNasEventNotification

This role grants CPFS the EventBridge permissions required to manage event notifications for dataflow:

eventbridge (unrestricted): Read event bus details and create rules.
eventbridge (all resources): Query, list, update, enable, disable, and delete rules, and manage rule targets.

ram: Delete this service-linked role (scoped to event-notification.nas.aliyuncs.com).

{
 "Statement": [
 {
 "Effect": "Allow",
 "Action": [
 "eventbridge:GetEventBus",
 "eventbridge:CreateRule"
 ],
 "Resource": [
 "acs:eventbridge:*:*:*"
 ]
 },
 {
 "Effect": "Allow",
 "Action": [
 "eventbridge:GetRule",
 "eventbridge:ListRules",
 "eventbridge:UpdateRule",
 "eventbridge:EnableRule",
 "eventbridge:DisableRule",
 "eventbridge:DeleteRule",
 "eventbridge:CreateTargets",
 "eventbridge:UpdateTargets",
 "eventbridge:DeleteTargets"
 ],
 "Resource": [
 "acs:eventbridge:*:*:*"
 ]
 },
 {
 "Action": "ram:DeleteServiceLinkedRole",
 "Resource": "*",
 "Effect": "Allow",
 "Condition": {
 "StringEquals": {
 "ram:ServiceName": "event-notification.nas.aliyuncs.com"
 }
 }
 }
 ],
 "Version": "1"
}

Required permissions for RAM users

A RAM user must have the AliyunNASFullAccess permission to create or delete a service-linked role. Alternatively, an administrator can add the following permissions to the Action statement in a custom policy:

Create service-linked role: ram:CreateServiceLinkedRole
Delete a service-linked role: ram:DeleteServiceLinkedRole

For more information about how to grant permissions, see Permissions required to manage service-linked roles.

View a service-linked role

After a service-linked role is created, you can go to the Roles page in the RAM console, search for the role name (for example, AliyunServiceRoleForNasCpfsNetwork), and click the role name to view its details:

Basic information

In the Basic Information section of the AliyunServiceRoleForNasCpfsNetwork role details page, you can view basic information such as the role name, creation time, role ARN, and description.
Permissions

On the Permissions tab of the AliyunServiceRoleForNasCpfsNetwork role details page, click the policy name to view the policy content and the cloud resources that the role can access.
Trust policy

On the Trust Policy tab of the AliyunServiceRoleForNasStandard role details page, view the content of the trust policy. The trust policy describes the trusted entities that can assume this RAM role. The trusted entity for a service-linked role is a cloud service, which you can view in the Service field of the trust policy.

For more information about how to view a service-linked role, see View a RAM role.

Delete a CPFS service-linked role

If you no longer use features such as CPFS dataflow, you can delete the corresponding service-linked role. Before you delete the role, you must first delete the CPFS file system instances that are associated with the role. For more information, see Delete a file system and Delete a service-linked role.

If the deletion fails because the role is still in use, wait a few minutes and try again.

Important

After a service-linked role is deleted, features that depend on the role can no longer be used. Proceed with caution.

FAQ

Why can't a RAM user automatically create CPFS service-linked roles?

To resolve this issue, grant the RAM user the following system and custom policies. For more information, see Create a custom policy.

System policies
- AliyunVPCFullAccess: Permissions to manage VPC.
- AliyunBSSFullAccess: Permissions to manage Billing Management.
- AliyunNASFullAccess: Permissions to manage NAS.
- AliyunECSNetworkInterfaceManagementAccess: Permissions to manage ECS ENIs.

Custom policy

To manage mount targets, you need the cpfs-network.nas.aliyuncs.com and cpfs-client.nas.aliyuncs.com permissions.
To manage dataflows, you need the oss-dataflow.nas.aliyuncs.com and event-notification.nas.aliyuncs.com permissions.

Sample policy:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ram:CreateServiceLinkedRole"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": { 
         "ram:ServiceName": [
            "cpfs-network.nas.aliyuncs.com",
            "cpfs-client.nas.aliyuncs.com",
            "oss-dataflow.nas.aliyuncs.com",
            "event-notification.nas.aliyuncs.com" 
         ]
        }
      }
    }
  ]
}