When you use Elastic High Performance Computing (E-HPC), you must create the service-linked role of E-HPC and grant permissions to the role. This topic describes the service-linked role of E-HPC and role permissions, and how to create, view, and delete the service-linked role.
Introduction to service-linked roles
A service-linked role is a Resource Access Management (RAM) role whose trusted entity is an Alibaba Cloud service. After a service-linked role is assumed by an Alibaba Cloud service, the service-linked role is authorized to access other Alibaba Cloud services. For more information, see Service-linked roles.
The following table describes the service-linked role and system policy of E-HPC.
Role | System policy | Scenario |
AliyunServiceRoleForEHPC | AliyunServiceRolePolicyForEHPC | This role is used to authorize E-HPC to access its associated cloud resources. With this role, E-HPC has the permissions to access Alibaba Cloud services, such as Elastic Compute Service (ECS), Virtual Private Cloud (VPC), and Apsara File Storage NAS (NAS). |
Grant permissions to a RAM user
If you use a RAM user to create or delete a service-linked role, you must use an Alibaba Cloud account to grant permissions to the RAM user.
Method 1: Attach the AliyunEHPCFullAccess policy to the RAM user. The policy contains the permissions to create and delete the service-linked role of E-HPC.
Method 2: Attach the following policies to the RAM user in the
Actionstatement of the custom policy:Create a service-linked role:
ram:CreateServiceLinkedRoleDelete a service-linked role:
ram:DeleteServiceLinkedRole
For more information, see the "Permissions required to create and delete a service-linked role" section in this topic.
Create the service-linked role
When you use E-HPC, the system checks whether the service-linked role AliyunServiceRoleForEHPC is created for the current Alibaba Cloud account. If the role does not exist, the system prompts a notification. After you confirm the information, the system automatically creates AliyunServiceRoleForEHPC.
After the system creates the role, E-HPC can assume the role to access associated cloud resources. You may be charged for the resources that you create, such as ECS instances and NAS file systems.
AliyunServiceRolePolicyForEHPC is a preset policy that is attached to the AliyunServiceRoleForEHPC role. You cannot add other permissions to the policy. Aside from that, you cannot modify or delete the permissions in the policy.
View the service-linked role
When the service-linked role is created, you can search for the role by name to view details in the RAM console.
Basic Information
In the Basic Information section, you can view the basic information about the role, including the name, creation time, Alibaba Cloud Resource Name (ARN), and description.
Permissions
On the Permissions tab, click the name of a policy to view the policy content and the cloud resources that the role can access.
Trust Policy
On the Trust Policy tab, you can view the content of the trust policy that is attached to the role. A trust policy describes the trusted entities of a RAM role. A trusted entity refers to an entity that can assume the RAM role. The trusted entity of a service-linked role is a cloud service. You can view the value of the
Servicefield in the trust policy to obtain the trusted entity.
For information about how to view information about a service-linked role, see View the information about a RAM role.
Delete the service-linked role
After a service-linked role is deleted, the features that depend on the role become unavailable. Proceed with caution.
If you no longer use E-HPC, delete the service-linked role in the RAM console. For more information, see Delete a RAM role.
Before you delete a service-linked role, take note of the following conditions:
You no longer need to use the service-linked role to perform operations such as creating a cluster or managing cloud resources that are associated with the cluster.
You must delete E-HPC clusters that depend on the service-linked role. For more information, see Release a cluster.