This topic describes the service-linked role AliyunServiceRoleForECIVnode that can be used to perform operations on virtual nodes and how to delete the service-linked role.
Background information
The service-linked role AliyunServiceRoleForECIVnode for virtual nodes is a RAM role provided by Alibaba Cloud that allows you to use virtual nodes on an elastic container instance. After the service-linked role is assigned to an elastic container instance, the instance is granted the permissions to access other Alibaba Cloud services. For more information about service-linked roles, see Service-linked roles.
Scenarios
When you create a virtual node, the system accesses resources of Elastic Container Instance, Elastic Compute Service (ECS), and Virtual Private Cloud (VPC). In this scenario, you can use the automatically created service-linked role AliyunServiceRoleForECIVnode to grant access permissions.
Permission description
The policy attached to the AliyunServiceRoleForECIVnode role is AliyunServiceRolePolicyForECIVnode. The policy contains the following access permissions on cloud services.
{
"Version": "1",
"Statement": [
{
"Action": [
"eci:CreateContainerGroup",
"eci:CreateContainerGroupFromTemplate",
"eci:UpdateContainerGroup",
"eci:UpdateContainerGroupByTemplate",
"eci:RestartContainerGroup",
"eci:DeleteContainerGroup",
"eci:DescribeContainerGroups",
"eci:ExportContainerGroupTemplate",
"eci:ExecContainerCommand",
"eci:CreateImageCache",
"eci:DeleteImageCache",
"eci:UpdateImageCache",
"eci:DescribeImageCaches",
"eci:DescribeContainerGroupMetric",
"eci:DescribeMultiContainerGroupMetric",
"eci:DescribeContainerLog",
"eci:DescribeContainerGroupPrice",
"eci:DescribeRegions"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"vpc:DescribeVSwitches",
"vpc:DescribeVpcs",
"vpc:DescribeEipAddresses"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"ecs:CreateNetworkInterfacePermission",
"ecs:DeleteNetworkInterfacePermission",
"ecs:CreateNetworkInterface",
"ecs:DescribeNetworkInterfaces",
"ecs:DescribeSecurityGroups"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": "ram:DeleteServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": "vnode.eci.aliyuncs.com"
}
}
}
]
}
Delete the service-linked role
Before you delete the service-linked role AliyunServiceRoleForECIVnode, you must use OpenAPI Explorer to delete the virtual nodes that are associated with the service-linked role. For more information, see Delete a RAM role.