service-linked role for emr starrocks - E-MapReduce - Alibaba Cloud Documentation Center

This topic describes the AliyunServiceRoleForEMRStarRocks service-linked role for EMR StarRocks and explains how to delete it.

Background information

The AliyunServiceRoleForEMRStarRocks service-linked role is a Resource Access Management (RAM) role that EMR StarRocks assumes to access other Alibaba Cloud services and enable specific features.

For more information about service-linked roles, see Service-linked roles.

Scenarios for AliyunServiceRoleForEMRStarRocks

When EMR StarRocks needs to access resources from Server Load Balancer (SLB), Elastic Computing Service (ECS), and virtual private cloud (VPC), it assumes the automatically created AliyunServiceRoleForEMRStarRocks service-linked role to obtain the required access permissions.

Permissions of AliyunServiceRoleForEMRStarRocks

AliyunServiceRoleForEMRStarRocks has the permissions to access the following Alibaba Cloud services.

Access permissions for SLB

{
  "Action": [
    "slb:AddBackendServers",
    "slb:AddListenerWhiteListItem",
    "slb:AddTags",
    "slb:AddVServerGroupBackendServers",
    "slb:CreateLoadBalancer",
    "slb:CreateLoadBalancerHTTPListener",
    "slb:CreateLoadBalancerHTTPSListener",
    "slb:CreateLoadBalancerTCPListener",
    "slb:CreateLoadBalancerUDPListener",
    "slb:CreateRules",
    "slb:CreateVServerGroup",
    "slb:DeleteLoadBalancer",
    "slb:DeleteLoadBalancerListener",
    "slb:DeleteRules",
    "slb:DeleteVServerGroup",
    "slb:DescribeHealthStatus",
    "slb:DescribeListenerAccessControlAttribute",
    "slb:DescribeLoadBalancerAttribute",
    "slb:DescribeLoadBalancerHTTPListenerAttribute",
    "slb:DescribeLoadBalancerHTTPListenerAttributes",
    "slb:DescribeLoadBalancerHTTPSListenerAttribute",
    "slb:DescribeLoadBalancerTCPListenerAttribute",
    "slb:DescribeLoadBalancerUDPListenerAttribute",
    "slb:DescribeLoadBalancers",
    "slb:DescribeRegions",
    "slb:DescribeRules",
    "slb:DescribeTags",
    "slb:DescribeVServerGroupAttribute",
    "slb:DescribeVServerGroups",
    "slb:ModifyLoadBalancerInstanceSpec",
    "slb:ModifyLoadBalancerInternetSpec",
    "slb:ModifyLoadBalancerInstanceChargeType",
    "slb:ModifyLoadBalancerPayType",
    "slb:RemoveBackendServers",
    "slb:RemoveListenerWhiteListItem",
    "slb:RemoveVServerGroupBackendServers",
    "slb:SetBackendServers",
    "slb:SetListenerAccessControlStatus",
    "slb:SetLoadBalancerHTTPListenerAttribute",
    "slb:SetLoadBalancerHTTPSListenerAttribute",
    "slb:SetLoadBalancerName",
    "slb:SetLoadBalancerStatus",
    "slb:SetLoadBalancerTCPListenerAttribute",
    "slb:SetLoadBalancerUDPListenerAttribute",
    "slb:SetRule",
    "slb:SetServerCertificateName",
    "slb:SetVServerGroupAttribute",
    "slb:StartLoadBalancerListener",
    "slb:StopLoadBalancerListener",
    "slb:SetLoadBalancerDeleteProtection",
    "slb:RemoveTags",
    "slb:DescribeLoadBalancerListeners",
    "slb:ModifyVServerGroupBackendServers",
    "slb:SetLoadBalancerModificationProtection",
    "slb:CreateLoadBalancerForCloudService"
  ],
  "Resource": "*",
  "Effect": "Allow"
}

Access permissions for ECS

{
  "Action": [
    "ecs:AssociateEipAddress",
    "ecs:AttachNetworkInterface",
    "ecs:AuthorizeSecurityGroup",
    "ecs:AuthorizeSecurityGroupEgress",
    "ecs:CreateNetworkInterface",
    "ecs:CreateNetworkInterfacePermission",
    "ecs:CreateSecurityGroup",
    "ecs:DeleteNetworkInterface",
    "ecs:DeleteNetworkInterfacePermission",
    "ecs:DeleteSecurityGroup",
    "ecs:DescribeNetworkInterfacePermissions",
    "ecs:DescribeNetworkInterfaces",
    "ecs:DescribeSecurityGroupAttribute",
    "ecs:DescribeSecurityGroupReferences",
    "ecs:DescribeSecurityGroups",
    "ecs:DetachNetworkInterface",
    "ecs:JoinSecurityGroup",
    "ecs:LeaveSecurityGroup",
    "ecs:ModifyNetworkInterfaceAttribute",
    "ecs:ModifySecurityGroupAttribute",
    "ecs:ModifySecurityGroupPolicy",
    "ecs:ModifySecurityGroupRule",
    "ecs:RevokeSecurityGroup",
    "ecs:RevokeSecurityGroupEgress",
    "ecs:UnassociateEipAddress"
  ],
  "Resource": "*",
  "Effect": "Allow"
}

Access permissions for VPC

{
  "Action": [
    "vpc:DescribeVpcAttribute",
    "vpc:DescribeVpcs",
    "vpc:DescribeVSwitchAttributes",
    "vpc:DescribeVSwitches",
    "vpc:DescribeRouteTableList",
    "vpc:DescribeRouteTables",
    "vpc:DescribeRouteEntryList",
    "vpc:DescribeRouterInterfaceAttribute",
    "vpc:DescribeRouterInterfaces",
    "vpc:DescribeVRouters",
    "vpc:ModifyBypassToaAttribute"
  ],
  "Resource": "*",
  "Effect": "Allow"
}

Access permissions for Application Real-Time Monitoring Service (ARMS)

{
    "Action":[
        "arms:ListDashboards",
        "arms:CreateContact",
        "arms:DeleteContact",
        "arms:SearchContact",
        "arms:UpdateContact",
        "arms:CreateContactGroup",
        "arms:DeleteContactGroup",
        "arms:SearchContactGroup",
        "arms:UpdateContactGroup",
        "arms:SearchAlertRules",
        "arms:CreateAlertRules",
        "arms:UpdateAlertRules",
        "arms:DeleteAlertRules",
        "arms:StartAlertRule",
        "arms:StopAlertRule",
        "arms:SearchAlarmHistories",
        "arms:OpenArmsService",
        "arms:CreateWebhook",
        "arms:UpdateWebhook",
        "arms:CreateDispatchRule",
        "arms:ListDispatchRule",
        "arms:DeleteDispatchRule",
        "arms:UpdateDispatchRule",
        "arms:DescribeDispatchRule"
    ],
    "Resource":"*",
    "Effect":"Allow"
}

Delete AliyunServiceRoleForEMRStarRocks

Important

After you delete AliyunServiceRoleForEMRStarRocks, you cannot use features in the EMR Serverless StarRocks console.

Log on to the RAM console as a RAM administrator.
In the navigation pane on the left, choose Identity Management > Roles.
On the Roles page, enter AliyunServiceRoleForEMRStarRocks in the search box to find the RAM role.
In the Actions column for the AliyunServiceRoleForEMRStarRocks role, click Delete Role.
In the dialog box, enter the role name and click Delete Role.
- If no EMR StarRocks instances are in use in your account, you can directly delete AliyunServiceRoleForEMRStarRocks.
- If EMR StarRocks instances are in use in your account, you must first release the instances before you can delete AliyunServiceRoleForEMRStarRocks. Otherwise, the deletion fails.

FAQ

Q: Why can't my RAM user automatically create the AliyunServiceRoleForEMRStarRocks service-linked role for EMR StarRocks?

A: The RAM user must have specific permissions to automatically create or delete AliyunServiceRoleForEMRStarRocks. If a RAM user cannot automatically create the role, grant the following access policy to the user. For more information, see Manage permissions on a RAM role.

{
    "Statement": [
        {
            "Action": [
                "ram:CreateServiceLinkedRole"
            ],
            "Resource": "acs:ram:*:Alibaba Cloud account ID:role/*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": [
                        "starrocks.aliyuncs.com"
                    ]
                }
            }
        }
    ],
    "Version": "1"
}

Note

Alibaba Cloud account ID: Replace this with your Alibaba Cloud account ID.