What is a service-linked role for CPFS - Cloud Parallel File Storage

To perform operations such as managing mount targets and dataflows, a CPFS file system must access other Alibaba Cloud services, including VPC, ECS, and OSS. CPFS automatically creates service-linked roles that grant the minimum required privileges for cross-service access, which eliminates the need for manual permission configuration.

How service-linked roles work

A service-linked role is a type of RAM role whose trusted entity is an Alibaba Cloud service. CPFS uses service-linked roles to access other Alibaba Cloud services and resources, which eliminates the need to configure cross-service permissions manually.

When you perform specific operations, the system automatically creates the required service-linked role. If automatic creation fails, or if CPFS does not support automatic creation, you must create the role manually.

RAM attaches a system policy to each service-linked role. This policy cannot be modified. To view the policy details, go to the details page for the specific role.

Note

For more information about service-linked roles, see Service-linked roles.

Service-linked roles for CPFS

CPFS uses the following four service-linked roles. The permissions of each role are scoped to its specific operations:

AliyunServiceRoleForNasCpfsNetwork

CPFS assumes this role to access VPC and ECS when creating or deleting an elastic network interface (ENI) or a security group.
AliyunServiceRoleForNasCpfsClient

CPFS assumes this role to access VPC and ECS when creating or deleting an ECS instance, a Cloud Assistant instance, authorization information, or a security group.
AliyunServiceRoleForNasOssDataFlow

When the dataflow feature is active, CPFS assumes this role to query, read, and write data in a specified OSS bucket.
AliyunServiceRoleForNasEventNotification

When the dataflow feature is active, CPFS assumes this role to create and modify parameters related to EventBridge event notifications.

For more information about service-linked roles, see Service-linked roles.

Permissions

The following permission policies are attached to CPFS service-linked roles. Each role's permissions are limited to the minimum necessary for its function.

AliyunServiceRoleForNasCpfsNetwork

This role allows CPFS to perform the following operations:

VPC: query VPCs, vSwitches, and their attributes
ECS: create, query, and delete security groups and elastic network interfaces; manage elastic network interface permissions

Security group and elastic network interface operations are restricted to resources tagged with nas:cpfs=true.

{
    "Version": "1",
    "Statement": [{
            "Action": [
                "vpc:DescribeVSwitchAttributes",
                "vpc:DescribeVpcs",
                "vpc:DescribeVSwitches"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "ecs:CreateSecurityGroup",
                "ecs:DescribeSecurityGroups",
                "ecs:CreateNetworkInterface",
                "ecs:DeleteNetworkInterface",
                "ecs:DescribeNetworkInterfaces",
                "ecs:CreateNetworkInterfacePermission",
                "ecs:DescribeNetworkInterfacePermissions",
                "ecs:DeleteNetworkInterfacePermission"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ecs:DescribeSecurityGroupAttribute",
                "ecs:DeleteSecurityGroup",
                "ecs:AuthorizeSecurityGroup",
                "ecs:AuthorizeSecurityGroupEgress",
                "ecs:RevokeSecurityGroup",
                "ecs:RevokeSecurityGroupEgress"
            ],
            "Resource": "acs:ecs:*:*:*/*",
            "Condition": {
                "StringEqualsIgnoreCase": {
                    "ecs:tag/nas:cpfs": "true"
                }
            }
        },
        {
            "Action": "ram:DeleteServiceLinkedRole",
            "Resource": "*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": "cpfs-network.nas.aliyuncs.com"
                }
            }
        }
    ]
}

AliyunServiceRoleForNasCpfsClient

This role allows CPFS to perform the following operations:

VPC: query VPCs, vSwitches, and their attributes
ECS: run, create, start, and delete instances; install and invoke Cloud Assistant; manage security groups

Security group and instance operations are restricted to resources tagged with nas:cpfs=true.

{
 "Version": "1",
 "Statement": [
 {
 "Action": [
 "vpc:DescribeVSwitchAttributes",
 "vpc:DescribeVpcs",
 "vpc:DescribeVSwitches"
 ],
 "Resource": "*",
 "Effect": "Allow"
 },
 {
 "Action": [
 "ecs:RunInstances",
 "ecs:CreateInstance",
 "ecs:DescribeInstances",
 "ecs:CreateSecurityGroup",
 "ecs:DescribeSecurityGroups",
 "ecs:InstallCloudAssistant",
 "ecs:DescribeInvocations"
 ],
 "Resource": "*",
 "Effect": "Allow"
 },
 {
 "Effect": "Allow",
 "Action": [
 "ecs:StartInstances",
 "ecs:DeleteInstances",
 "ecs:RunCommand",
 "ecs:DescribeSecurityGroupAttribute",
 "ecs:DeleteSecurityGroup",
 "ecs:AuthorizeSecurityGroup",
 "ecs:AuthorizeSecurityGroupEgress",
 "ecs:RevokeSecurityGroup",
 "ecs:RevokeSecurityGroupEgress"
 ],
 "Resource": "acs:ecs:*:*:*/*",
 "Condition": {
 "StringEqualsIgnoreCase": {
 "ecs:tag/nas:cpfs": "true"
 }
 }
 },
 {
 "Action": "ram:DeleteServiceLinkedRole",
 "Resource": "*",
 "Effect": "Allow",
 "Condition": {
 "StringEquals": {
 "ram:ServiceName": "cpfs-client.nas.aliyuncs.com"
 }
 }
 } 
 ]
 }

AliyunServiceRoleForNasOssDataFlow

This role allows CPFS to perform the following operations:

OSS (unrestricted): list buckets and get bucket tags

OSS (tagged buckets only): perform all read, write, and multipart upload operations on buckets tagged with cpfs-dataflow=true

{
 "Statement": [
 {
 "Effect": "Allow",
 "Action": [
 "oss:ListBuckets",
 "oss:GetBucketTagging"
 ],
 "Resource": [
 "acs:oss:*:*:*"
 ]
 },
 {
 "Effect": "Allow",
 "Action": [
 "oss:HeadBucket",
 "oss:GetBucketLocation",
 "oss:GetBucketInventory",
 "oss:GetBucketInfo",
 "oss:GetBucketVersion",
 "oss:GetBucketAcl",
 "oss:GetBucketStat",
 "oss:GetBucket",
 "oss:ListObjects",
 "oss:GetObject",
 "oss:PutObject",
 "oss:CopyObject",
 "oss:AppendObject",
 "oss:DeleteObject",
 "oss:GetObjectMeta",
 "oss:PutObjectACL",
 "oss:GetObjectACL",
 "oss:PutObjectTagging",
 "oss:GetObjectTagging",
 "oss:InitiateMultipartUpload",
 "oss:CompleteMultipartUpload",
 "oss:AbortMultipartUpload",
 "oss:ListMultipartUploads",
 "oss:UploadPart",
 "oss:UploadPartCopy",
 "oss:ListParts"
 ],
 "Resource": [
 "acs:oss:*:*:*",
 "acs:oss:*:*:*/*"
 ],
 "Condition": {
 "StringEqualsIgnoreCase": {
 "oss:tag/cpfs-dataflow": "true"
 }
 }
 },
 {
 "Action": "ram:DeleteServiceLinkedRole",
 "Resource": "*",
 "Effect": "Allow",
 "Condition": {
 "StringEquals": {
 "ram:ServiceName": "oss-dataflow.nas.aliyuncs.com"
 }
 }
 }
 ],
 "Version": "1"
}

AliyunServiceRoleForNasEventNotification

This role allows CPFS to perform the following operations:

EventBridge: get event buses and create rules

EventBridge: list, update, enable, disable, and delete rules; create, update, and delete targets

{
 "Statement": [
 {
 "Effect": "Allow",
 "Action": [
 "eventbridge:GetEventBus",
 "eventbridge:CreateRule"
 ],
 "Resource": [
 "acs:eventbridge:*:*:*"
 ]
 },
 {
 "Effect": "Allow",
 "Action": [
 "eventbridge:GetRule",
 "eventbridge:ListRules",
 "eventbridge:UpdateRule",
 "eventbridge:EnableRule",
 "eventbridge:DisableRule",
 "eventbridge:DeleteRule",
 "eventbridge:CreateTargets",
 "eventbridge:UpdateTargets",
 "eventbridge:DeleteTargets"
 ],
 "Resource": [
 "acs:eventbridge:*:*:*"
 ]
 },
 {
 "Action": "ram:DeleteServiceLinkedRole",
 "Resource": "*",
 "Effect": "Allow",
 "Condition": {
 "StringEquals": {
 "ram:ServiceName": "event-notification.nas.aliyuncs.com"
 }
 }
 }
 ],
 "Version": "1"
}

RAM user permissions for service-linked roles

For a RAM user to create or delete a CPFS service-linked role, an administrator must grant the RAM user the AliyunNASFullAccess system policy. Alternatively, add the following permissions to the Action statement of a custom policy:

Create a service-linked role: ram:CreateServiceLinkedRole
Delete a service-linked role: ram:DeleteServiceLinkedRole

For more information about granting permissions, see Permissions required to manage service-linked roles.

View a service-linked role

After a service-linked role is created, you can find it on the Roles page of the RAM console by searching for its name, such as AliyunServiceRoleForNasCpfsNetwork, to view the following information:

Basic Information

In the Basic Information section of the role details page, you can view basic information, including the role name, creation time, role ARN, and description.
Permission Policy

On the Permissions tab of the role details page, click the permission policy name to view the policy document and the resources that the role can access.
Trust Policy

On the Trust Policy tab of the role details page, you can view the trust policy document. A trust policy describes the trusted entities that can assume the role. The trusted entity for a service-linked role is an Alibaba Cloud service, as specified in the Service field of the trust policy.

For more information about how to view a service-linked role, see View the information about a RAM role.

Delete a service-linked role for CPFS

If you no longer need a CPFS service-linked role, for example, after you stop using the dataflow feature, you can delete the role. Before deleting the role, you must first delete the associated CPFS file system instances. For more information, see Delete a file system and Delete a service-linked role.

FAQ

Why can't a RAM user automatically create a service-linked role for CPFS?

A RAM user must have specific permissions to trigger the automatic creation of a service-linked role. Attach the following system policies and a custom policy to the RAM user. For more information about how to create a custom policy, see Create a custom permission policy.

System policies
- AliyunVPCFullAccess: Permissions to manage VPC.
- AliyunBSSFullAccess: Permissions to manage Billing Management.
- AliyunNASFullAccess: Permissions to manage NAS.
- AliyunECSNetworkInterfaceManagementAccess: Permissions to manage ECS elastic network interfaces.

Custom policy

To manage mount targets, you need permissions for cpfs-network.nas.aliyuncs.com and cpfs-client.nas.aliyuncs.com.
To manage dataflow, you need permissions for oss-dataflow.nas.aliyuncs.com and event-notification.nas.aliyuncs.com.

Example:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ram:CreateServiceLinkedRole"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": { 
         "ram:ServiceName": [
            "cpfs-network.nas.aliyuncs.com",
            "cpfs-client.nas.aliyuncs.com",
            "oss-dataflow.nas.aliyuncs.com",
            "event-notification.nas.aliyuncs.com" 
         ]
        }
      }
    }
  ]
}