service-linked role for Cloud Assistant - Elastic Compute Service

Create, configure, and delete the AliyunServiceRoleForECSArchiving role that authorizes Cloud Assistant to access other cloud services.

Background

AliyunServiceRoleForECSArchiving is a RAM service-linked role that authorizes Cloud Assistant to access other Alibaba Cloud services. Cloud Assistant assumes this role to deliver O&M task execution records and session records to a specific Object Storage Service (OSS) bucket or Simple Log Service (SLS) project for persistent storage.

Policy attached to AliyunServiceRoleForECSArchiving

Role name: AliyunServiceRoleForECSArchiving

Policy name: AliyunServiceRolePolicyForECSArchiving

Content of the AliyunServiceRolePolicyForECSArchiving policy:

{
  "Version": "1",
  "Statement": [
    {
      "Action": [
        "oss:PutObject",
        "oss:GetBucketInfo",
        "log:GetProject",
        "log:GetLogStore",
        "log:CreateLogStore",
        "log:PostLogStoreLogs",
        "log:GetIndex",
        "log:CreateIndex",
        "oss:GetObject"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": "ram:DeleteServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "archiving.ecs.aliyuncs.com"
        }
      }
    }
  ]
}

Create the AliyunServiceRoleForECSArchiving role

When you enable the Operation Content and Result Delivery feature or the Session Record Delivery feature, the system automatically creates the AliyunServiceRoleForECSArchiving role if it does not exist in your account.

The AliyunServiceRolePolicyForECSArchiving policy is attached to the role. System policies for service-linked roles are defined by the linked Alibaba Cloud services. You cannot add, modify, or remove permissions for service-linked roles.

Delete the AliyunServiceRoleForECSArchiving role

If you no longer need to deliver O&M task execution records or session records for persistent storage, delete the AliyunServiceRoleForECSArchiving role. See Delete a RAM role.

Cloud Assistant requires the AliyunServiceRoleForECSArchiving role for these features. If you attempt to delete the role while either feature is enabled in a region, an error message is returned indicating the regions where the features are enabled. Disable the features in those regions before you delete the role.

Disable the Operation Content and Result Delivery feature

On the ECS Cloud Assistant page, click Operation Content and Result Delivery. In the Operation Content and Result Delivery dialog box, clear Deliver to Log Service and Deliver to OSS, and then click OK.
Disable the Session Record Delivery feature

In the Connect dialog box for an instance, click Deliver Session Records in the Session Manager section. In the Deliver Session Records dialog box, clear Deliver to Log Service and Deliver to OSS, and then click OK.

FAQ

Why is the AliyunServiceRoleForECSArchiving role not automatically created when I use a RAM user?

To allow a RAM user to automatically create this role, use an Alibaba Cloud account to attach the following policy to the RAM user. See Grant permissions to a RAM role.

Note

Replace <account ID> with your Alibaba Cloud account ID.

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "ram:CreateServiceLinkedRole"
            ],
            "Resource": "acs:ram:*:<account ID>:role/*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": [
                        "archiving.ecs.aliyuncs.com"
                    ]
                }
            }
        }
    ]
}