How to grant access to the service-linked role created by EventBridge in DataWorks - DataWorks

When you authorize DataWorks to use EventBridge, the AliyunServiceRoleForDataWorksOpenPlatform service-linked role is automatically created in RAM.

Background

To subscribe to and consume event messages in DataWorks through EventBridge, you must grant DataWorks access to your EventBridge resources. After authorization, the AliyunServiceRoleForDataWorksOpenPlatform service-linked role is automatically created in the RAM console. DataWorks Open Platform uses this role to access your resources in other Alibaba Cloud services. For more information about service-linked roles, see Service-linked roles.

Permissions of AliyunServiceRoleForDataWorksOpenPlatform

Log on to the RAM console. In the left-side navigation pane, choose Identities > Role.
On the Role page, enter AliyunServiceRoleForDataWorksOpenPlatform in the search box. The AliyunServiceRoleForDataWorksOpenPlatform RAM role is listed in the search results.
Click the role name AliyunServiceRoleForDataWorksOpenPlatform to view its basic information.

On the role details page, click the Permission Management tab to view the details of the attached AliyunServiceRolePolicyForDataWorksOpenPlatform access policy.

{    
   "Version": "1",    
   "Statement":[        
     {
       "Effect": "Allow",  
       "Action": [
         "eventbridge:GetEventBus",
         "eventbridge:GetRule",
         "eventbridge:CreateEventBus",
         "eventbridge:DeleteEventBus",
         "eventbridge:PutEvents",
         "eventbridge:ListEventBuses"
       ],
       "Resource": "*"

     },
     {
        "Action":"ram:DeleteServiceLinkedRole",
        "Resource":"*",
        "Effect":"Allow",
        "Condition":{
          "StringEquals": {
            "ram:ServiceName": "openplatform.dataworks.aliyuncs.com"
          }
        }  
     }    
   ]   
}

Delete the AliyunServiceRoleForDataWorksOpenPlatform role

Log on to the RAM console. In the left-side navigation pane, choose Identities > Role.
On the Roles page, enter AliyunServiceRoleForDataWorksOpenPlatform in the search box. The AliyunServiceRoleForDataWorksOpenPlatform RAM role is listed in the search results.
In the Actions column, click Delete Role.

FAQ

Why can't my RAM user automatically create the AliyunServiceRoleForDataWorksOpenPlatform service-linked role?

Your RAM user must have the required permissions to create or delete AliyunServiceRoleForDataWorksOpenPlatform. If your RAM user cannot automatically create AliyunServiceRoleForDataWorksOpenPlatform, attach the following policy to the RAM user.

{
    "Statement": [
       {
        "Action": [                
                "ram:CreateServiceLinkedRole"
            ],
          "Resource": "acs:ram:*:Alibaba Cloud account ID:role/*",
          "Effect": "Allow",
           "Condition": {
               "StringEquals": {
                    "ram:ServiceName": [
                        "openplatform.dataworks.aliyuncs.com"                
                   ]
                }           
           }
     }
  ],
  "Version": "1"
}

Note

Replace Alibaba Cloud account ID with the actual ID of your Alibaba Cloud account.