Grant E-HPC permissions to access associated cloud resources - Elastic High Performance Computing

E-HPC uses service-linked roles to access other Alibaba Cloud services on your behalf. This topic covers role permissions and how to create, view, and delete the roles.

What is a service-linked role

A service-linked role is a Resource Access Management (RAM) role whose trusted entity is an Alibaba Cloud service. When a service assumes this role, it can access other Alibaba Cloud services. For more information, see Service-linked roles.

The following table lists the E-HPC service-linked role and its system policy.

Role	System policy	Scenario
AliyunServiceRoleForEHPC	AliyunServiceRolePolicyForEHPC	Grants E-HPC access to associated cloud resources, including ECS, VPC, and NAS.

Grant permissions to a RAM user

To create or delete a service-linked role as a RAM user, grant the required permissions from an Alibaba Cloud account.

Method 1: Attach the AliyunEHPCFullAccess policy to the RAM user. This policy includes permissions to create and delete the service-linked role.
Method 2: Create a custom policy with the following actions in the Action element, then attach it to the RAM user:
- Create a service-linked role: ram:CreateServiceLinkedRole
- Delete a service-linked role: ram:DeleteServiceLinkedRole

Required permissions are detailed in Permissions required to create and delete a service-linked role.

Create the service-linked role

When you use E-HPC, the system checks whether AliyunServiceRoleForEHPC exists. If the role is missing, the system prompts you to create it automatically.

Important

After the role is created, E-HPC can access associated cloud resources. You may be charged for resources that you create, such as ECS instances and NAS file systems.

AliyunServiceRolePolicyForEHPC is a preset policy attached to AliyunServiceRoleForEHPC. You cannot add, modify, or delete permissions in this policy.

Permissions in AliyunServiceRolePolicyForEHPC

The following policy document lists all permissions granted to the E-HPC service-linked role, grouped by service.

{
  "Version": "1",
  "Statement": [
    {
      "Action": [
        "ecs:RunInstances",
        "ecs:DescribeInstances",
        "ecs:DescribeInstanceTypes",
        "ecs:DescribeKeyPairs",
        "ecs:DescribeSecurityGroups",
        "ecs:DescribePrice",
        "ecs:DescribeZones",
        "ecs:DescribeAvailableResource",
        "ecs:DescribeCloudAssistantStatus",
        "ecs:CreateSecurityGroup",
        "ecs:DescribeImages",
        "ecs:AttachKeyPair",
        "ecs:ModifyInstanceAttribute",
        "ecs:StartInstance",
        "ecs:StopInstance",
        "ecs:DeleteInstance",
        "ecs:CreateInstance",
        "ecs:ReplaceSystemDisk",
        "ecs:RebootInstance",
        "ecs:AuthorizeSecurityGroup",
        "ecs:RevokeSecurityGroup",
        "ecs:CreateHpcCluster",
        "ecs:ModifyHpcClusterAttribute",
        "ecs:DeleteHpcCluster",
        "ecs:DescribeHpcClusters",
        "ecs:DeleteSecurityGroup",
        "ecs:DescribeDisks",
        "ecs:ReInitDisk",
        "ecs:CreateCommand",
        "ecs:InvokeCommand",
        "ecs:StopInvocation",
        "ecs:DeleteCommand",
        "ecs:DescribeCommands",
        "ecs:ModifyCommand",
        "ecs:DescribeInvocations",
        "ecs:DescribeInvocationResults",
        "ecs:CreateNetworkInterface",
        "ecs:DescribeNetworkInterfaces",
        "ecs:CreateNetworkInterfacePermission",
        "ecs:DescribeNetworkInterfacePermissions",
        "ecs:AttachNetworkInterface",
        "ecs:DeleteNetworkInterface",
        "ecs:DeleteNetworkInterfacePermission",
        "ecs:DescribeResourceAllocation",
        "ecs:TagResources",
        "ecs:DescribeManagedInstances",
        "eci:BatchCreateContainerGroups",
        "eci:CreateContainerGroup"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "vpc:DescribeVpcs",
        "vpc:DescribeVSwitches",
        "vpc:AllocateEipAddress",
        "vpc:DescribeEipAddresses",
        "vpc:AssociateEipAddress",
        "vpc:DescribeVSwitches",
        "vpc:ReleaseEipAddress",
        "vpc:CreateVpc",
        "vpc:CreateVSwitch"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "nas:DescribeFileSystems",
        "nas:DescribeMountTargets",
        "nas:CreateFileSystem",
        "nas:CreateMountTarget",
        "nas:CreateAccessGroup",
        "nas:CreateAccessRule",
        "nas:DeleteAccessGroup",
        "nas:DeleteAccessRule",
        "nas:DescribeAccessGroups",
        "nas:DescribeAccessRules",
        "nas:ModifyFileSystem",
        "nas:UpdateFileSystemInfo",
        "nas:CPFSCreateFileSystem",
        "nas:CPFSDescribeFileSystems",
        "nas:CPFSModifyFileSystem",
        "nas:CreateLDAPConfig",
        "nas:DeleteLDAPConfig",
        "nas:DescribeLDAPConfig"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "ecd:CreateRAMDirectory",
        "ecd:CreateADConnectorDirectory",
        "ecd:DescribeDirectories",
        "ecd:DeleteDirectories",
        "ecd:CreateBundle",
        "ecd:DescribeBundles",
        "ecd:DeleteBundles",
        "ecd:ListDirectoryUsers",
        "ecd:ModifyEntitlement",
        "ecd:CreatePolicyGroup",
        "ecd:DescribePolicyGroups",
        "ecd:ModifyPolicyGroup",
        "ecd:DeletePolicyGroups",
        "ecd:CreateDesktops",
        "ecd:DescribeDesktops",
        "ecd:RebootDesktops",
        "ecd:DeleteDesktops",
        "ecd:DescribeDesktopTypes",
        "ecd:StartDesktops",
        "ecd:StopDesktops",
        "ecd:CreateImage",
        "ecd:DescribeImages",
        "ecd:DeleteImages",
        "ecd:DescribeRegions",
        "ecd:DescribeZones",
        "ecd:GetConnectionTicket"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "ess:CreateScalingGroup",
        "ess:ModifyScalingGroup",
        "ess:EnableScalingGroup",
        "ess:DisableScalingGroup",
        "ess:DeleteScalingGroup",
        "ess:SetGroupDeletionProtection",
        "ess:DescribeScalingGroups",
        "ess:DescribeScalingInstances",
        "ess:DescribeScalingActivities",
        "ess:DescribeScalingConfiguration",
        "ess:DescribeScalingRules",
        "ess:CreateScalingConfiguration",
        "ess:ModifyScalingConfiguration",
        "ess:DeleteScalingConfiguration",
        "ess:CreateScalingRule",
        "ess:ModifyScalingRule",
        "ess:DeleteScalingRule",
        "ess:ExecuteScalingRule",
        "ess:AttachInstances",
        "ess:DetachInstances",
        "ess:RemoveInstances",
        "ess:CreateScheduledTask",
        "ess:DeleteScheduledtask",
        "ess:ModifyScheduledTask",
        "ess:DescribeLimitation",
        "ess:CreateLifecycleHook",
        "ess:CompleteLifecycleAction",
        "ess:DeleteLifecycleHook",
        "ess:TagResources",
        "ess:ScaleWithAdjustment"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "cms:CreateDynamicTagGroup",
        "cms:DescribeMonitorGroups",
        "cms:DeleteDynamicTagGroup",
        "cms:DeleteMonitorGroup",
        "cms:DescribeContactGroupList",
        "cms:DescribeDynamicTagRuleList"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": "acm:DescribePrice",
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": "ram:PassRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "acs:Service": "ecs.aliyuncs.com"
        }
      }
    },
    {
      "Action": "ram:CreateServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": [
            "ess.aliyuncs.com",
            "gws.aliyuncs.com",
            "eci.aliyuncs.com"
          ]
        }
      }
    },
    {
      "Action": "ram:DeleteServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "ehpc.aliyuncs.com"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "eci:RestartContainerGroup",
        "eci:DeleteContainerGroup"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "eci:tag/product": [
            "E-HPC"
          ]
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "pvtz:AddZone",
        "pvtz:DescribeZoneInfo",
        "pvtz:BindZoneVpc",
        "pvtz:DescribeZoneVpcTree",
        "pvtz:DescribeZones",
        "pvtz:AddZoneRecord",
        "pvtz:DeleteZoneRecord",
        "pvtz:DescribeZoneRecords",
        "pvtz:UpdateZoneRecord",
        "pvtz:CheckZoneName",
        "pvtz:DeleteZone",
        "eci:DescribeContainerGroupEvents",
        "eci:DescribeContainerGroupMetric",
        "eci:DescribeContainerGroupStatus",
        "eci:DescribeContainerGroups",
        "eci:DescribeContainerLog",
        "eci:DescribeInstanceOpsRecords",
        "eci:DescribeMultiContainerGroupMetric",
        "eci:DescribeVirtualNodes",
        "eci:ExportContainerGroupTemplate",
        "eci:ListUsage"
      ],
      "Resource": "*"
    }
  ]
}

View the service-linked role

After the role is created, search for it by name in the RAM console.

Basic Information: In the Basic Information section, view the role name, creation time, ARN, and description.
Permissions: On the Permissions tab, click a policy name to view the policy content and accessible resources.
Trust Policy: On the Trust Policy tab, view the trust policy. The policy defines which entities can assume the role. Check the Service field to identify the trusted cloud service.

View the information about a RAM role.

Delete the service-linked role

Important

Deleting a service-linked role disables all features that depend on it. Proceed with caution.

If you no longer use E-HPC, delete the service-linked role in the RAM console. For more information, see Delete a RAM role.

Before deleting the role, verify the following:

You no longer need the role to create clusters or manage associated cloud resources.
All dependent E-HPC clusters have been deleted. For more information, see Release a cluster.