The AliyunServiceRoleForECIVnode service-linked role grants Elastic Container Instance the permissions required to manage virtual nodes. This topic also explains how to delete the role.
Background information
AliyunServiceRoleForECIVnode is a RAM role provided by Elastic Container Instance. You can assume this role to access other Alibaba Cloud services that are required for virtual node features. For more information about service-linked roles, see Service-linked roles.
Scenarios
When you create a virtual node, the system accesses resources of Elastic Container Instance, Elastic Compute Service (ECS), and Virtual Private Cloud (VPC). The automatically created AliyunServiceRoleForECIVnode role grants the required access permissions.
Permission description
The policy attached to AliyunServiceRoleForECIVnode is AliyunServiceRolePolicyForECIVnode, which includes the following permissions:
{
"Version": "1",
"Statement": [
{
"Action": [
"eci:CreateContainerGroup",
"eci:CreateContainerGroupFromTemplate",
"eci:UpdateContainerGroup",
"eci:UpdateContainerGroupByTemplate",
"eci:RestartContainerGroup",
"eci:DeleteContainerGroup",
"eci:DescribeContainerGroups",
"eci:ExportContainerGroupTemplate",
"eci:ExecContainerCommand",
"eci:CreateImageCache",
"eci:DeleteImageCache",
"eci:UpdateImageCache",
"eci:DescribeImageCaches",
"eci:DescribeContainerGroupMetric",
"eci:DescribeMultiContainerGroupMetric",
"eci:DescribeContainerLog",
"eci:DescribeContainerGroupPrice",
"eci:DescribeRegions"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"vpc:DescribeVSwitches",
"vpc:DescribeVpcs",
"vpc:DescribeEipAddresses"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"ecs:CreateNetworkInterfacePermission",
"ecs:DeleteNetworkInterfacePermission",
"ecs:CreateNetworkInterface",
"ecs:DescribeNetworkInterfaces",
"ecs:DescribeSecurityGroups"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": "ram:DeleteServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": "vnode.eci.aliyuncs.com"
}
}
}
]
}Delete the service-linked role
Before you delete AliyunServiceRoleForECIVnode, use OpenAPI Explorer to delete all virtual nodes that are associated with the role. After the virtual nodes are deleted, you can delete the role. For more information, see Delete a RAM role.