Service-linked role for virtual nodes

Background information

The service-linked role AliyunServiceRoleForECIVnode for virtual nodes is a RAM role provided by Alibaba Cloud that allows you to use virtual nodes on an elastic container instance. After the service-linked role is assigned to an elastic container instance, the instance is granted the permissions to access other Alibaba Cloud services. For more information about service-linked roles, see Service-linked roles.

Scenarios

When you create a virtual node, the system accesses resources of Elastic Container Instance, Elastic Compute Service (ECS), and Virtual Private Cloud (VPC). In this scenario, you can use the automatically created service-linked role AliyunServiceRoleForECIVnode to grant access permissions.

Permission description

The policy attached to the AliyunServiceRoleForECIVnode role is AliyunServiceRolePolicyForECIVnode. The policy contains the following access permissions on cloud services.

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "eci:CreateContainerGroup",
                "eci:CreateContainerGroupFromTemplate",
                "eci:UpdateContainerGroup",
                "eci:UpdateContainerGroupByTemplate",
                "eci:RestartContainerGroup",
                "eci:DeleteContainerGroup",
                "eci:DescribeContainerGroups",
                "eci:ExportContainerGroupTemplate",
                "eci:ExecContainerCommand",
                "eci:CreateImageCache",
                "eci:DeleteImageCache",
                "eci:UpdateImageCache",
                "eci:DescribeImageCaches",
                "eci:DescribeContainerGroupMetric",
                "eci:DescribeMultiContainerGroupMetric",
                "eci:DescribeContainerLog",
                "eci:DescribeContainerGroupPrice",
                "eci:DescribeRegions"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "vpc:DescribeVSwitches",
                "vpc:DescribeVpcs",
                "vpc:DescribeEipAddresses"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "ecs:CreateNetworkInterfacePermission",
                "ecs:DeleteNetworkInterfacePermission",
                "ecs:CreateNetworkInterface",
                "ecs:DescribeNetworkInterfaces",
                "ecs:DescribeSecurityGroups"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": "ram:DeleteServiceLinkedRole",
            "Resource": "*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": "vnode.eci.aliyuncs.com"
                }
            }
        }
    ]
}

Delete the service-linked role

Before you delete the service-linked role AliyunServiceRoleForECIVnode, you must use OpenAPI Explorer to delete the virtual nodes that are associated with the service-linked role. For more information, see Delete a RAM role.