AliyunServiceRoleForECI is the service-linked role that Elastic Container Instance uses to access other Alibaba Cloud services on your behalf. This topic describes the role's attached permissions and how to delete it.
Overview
AliyunServiceRoleForECI is a Resource Access Management (RAM) role predefined for Elastic Container Instance. When you create an elastic container instance or an image cache, Elastic Container Instance automatically creates this role in your account if it does not already exist. The role grants Elastic Container Instance the minimum permissions it needs to call other Alibaba Cloud services — without requiring you to manually configure RAM policies. For more information about service-linked roles, see Service-linked roles.
Services accessed by the role
The role is automatically created when you create an elastic container instance or an image cache that requires access to the following Alibaba Cloud services:
Elastic Compute Service (ECS): to create and manage network interfaces and security groups for elastic container instances.
Virtual Private Cloud (VPC): to query vSwitches and VPCs, and to manage elastic IP addresses (EIPs), IPv6 addresses, and bandwidth packages.
Container Registry (ACR): to pull container images and retrieve authorization tokens from image repositories.
Simple Log Service (SLS): to create log projects, Logstores, machine groups, and indexes for container log collection.
Server Load Balancer (SLB): to query load balancers and remove backend servers.
AliyunServiceRoleForECI permissions
The permission policy attached to AliyunServiceRoleForECI is AliyunServiceRolePolicyForECI. It grants the following permissions:
{
"Version": "1",
"Statement": [
{
"Action": [
"ecs:CreateNetworkInterfacePermission",
"ecs:DeleteNetworkInterfacePermission",
"ecs:DescribeNetworkInterfacePermissions",
"ecs:CreateNetworkInterface",
"ecs:DescribeNetworkInterfaces",
"ecs:AttachNetworkInterface",
"ecs:DetachNetworkInterface",
"ecs:DeleteNetworkInterface",
"ecs:DescribeSecurityGroups",
"ecs:TagResources"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"vpc:DescribeVSwitches",
"vpc:DescribeVSwitchAttributes",
"vpc:DescribeVpcs",
"vpc:AssociateEipAddress",
"vpc:UnassociateEipAddress",
"vpc:DescribeEipAddresses",
"vpc:AllocateEipAddress",
"vpc:ReleaseEipAddress",
"vpc:AddCommonBandwidthPackageIp",
"vpc:RemoveCommonBandwidthPackageIp",
"vpc:DescribeIpv6Addresses",
"vpc:DescribeIpv6Gateways",
"vpc:AllocateIpv6InternetBandwidth",
"vpc:TagResources"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"cr:PullRepository",
"cr:GetAuthorizationToken",
"cr:GetRepositoryLayers",
"cr:GetRepositoryManifest",
"cr:GetRepositoryTag",
"cr:GetRepository",
"cr:ListInstance",
"cr:ListInstanceEndpoint"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"log:CreateProject",
"log:GetProject",
"log:CreateLogStore",
"log:GetLogStore",
"log:CreateMachineGroup",
"log:CreateConfig",
"log:GetConfig",
"log:ApplyConfigToGroup",
"log:GetAppliedConfigs",
"log:CreateIndex",
"log:TagResources"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"slb:DescribeLoadBalancers",
"slb:RemoveBackendServers"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": "ram:DeleteServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": "eci.aliyuncs.com"
}
}
}
]
}Delete AliyunServiceRoleForECI
Before deleting AliyunServiceRoleForECI, delete all Elastic Container Instance resources associated with the role:
Delete all elastic container instances.
Delete all image caches.
Delete these resources from the Elastic Container Instance console or by calling the corresponding API operations. After all resources are removed, delete AliyunServiceRoleForECI. For more information, see Delete a RAM role.