This topic describes the background information, policies, usage notes, and FAQ about the service-linked roles for EventBridge.
Background information
EventBridge may need to access another Alibaba Cloud service to implement a feature. In this case, EventBridge must assume a specific service-linked role to obtain permissions to access the Alibaba Cloud service. For more information, see Service-linked roles.
EventBridge can automatically create the following service-linked roles:
- AliyunServiceRoleForEventBridgeSendToFC
- AliyunServiceRoleForEventBridgeSendToMNS
- AliyunServiceRoleForEventBridgeSendToSMS
- AliyunServiceRoleForEventBridgeSendToDirectMail
- AliyunServiceRoleForEventBridgeSourceRocketMQ
- AliyunServiceRoleForEventBridgeSendToRocketMQ
- AliyunServiceRoleForEventBridgeConnectVPC
- AliyunServiceRoleForEventBridgeSourceActionTrail
- AliyunServiceRoleForEventBridgeSourceRabbitMQ
- AliyunServiceRoleForEventBridgeSendToRabbitMQ
- AliyunServiceRoleForEventBridgeSourceKafka
- AliyunServiceRoleForEventBridgeSendToKafka
- AliyunServiceRoleForEventBridgeSendToRDS
AliyunServiceRoleForEventBridgeSendToFC
EventBridge assumes the AliyunServiceRoleForEventBridgeSendToFC role to obtain permissions to access Function Compute and implement features that need to invoke functions.
The following AliyunServiceRolePolicyForEventBridgeSendToFC policy is attached to the AliyunServiceRoleForEventBridgeSendToFC role:
{
"Version": "1",
"Statement": [
{
"Action": [
"fc:InvokeFunction",
"fc:ListServices",
"fc:ListFunctions"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": "ram:DeleteServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": "sendevent-fc.eventbridge.aliyuncs.com"
}
}
}
]
}
AliyunServiceRoleForEventBridgeSendToMNS
EventBridge assumes the AliyunServiceRoleForEventBridgeSendToMNS role to obtain permissions to access Message Service (MNS) and implement features that need to send or publish messages.
The following AliyunServiceRolePolicyForEventBridgeSendToMNS policy is attached to the AliyunServiceRoleForEventBridgeSendToMNS role:
{
"Version": "1",
"Statement": [
{
"Action": [
"mns:SendMessage",
"mns:PublishMessage",
"mns:ListQueue",
"mns:ListTopic"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": "ram:DeleteServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": "sendevent-mns.eventbridge.aliyuncs.com"
}
}
}
]
}
AliyunServiceRoleForEventBridgeSendToSMS
EventBridge assumes the AliyunServiceRoleForEventBridgeSendToSMS role to obtain permissions to access Short Message Service (SMS) and implement features that need to send text messages.
The following AliyunServiceRolePolicyForEventBridgeSendToSMS policy is attached to the AliyunServiceRoleForEventBridgeSendToSMS role:
{
"Version": "1",
"Statement": [
{
"Action": [
"dysms:SendSms",
"dysms:SendBatchSms",
"dysms:QuerySendDetails",
"dysms:QuerySmsSign",
"dysms:QuerySmsTemplate"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": "ram:DeleteServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": "sendevent-sms.eventbridge.aliyuncs.com"
}
}
}
]
}
AliyunServiceRoleForEventBridgeSendToDirectMail
EventBridge assumes the AliyunServiceRoleForEventBridgeSendToDirectMail role to obtain permissions to access Direct Mail and implement features that need to send emails.
The following AliyunServiceRolePolicyForEventBridgeSendToDirectMail policy is attached to the AliyunServiceRoleForEventBridgeSendToDirectMail role:
{
"Version": "1",
"Statement": [
{
"Action": [
"dm:SingleSendMail",
"dm:BatchSendMail",
"dm:QueryMailAddressByParam"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": "ram:DeleteServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": "sendevent-directmail.eventbridge.aliyuncs.com"
}
}
}
]
}
AliyunServiceRoleForEventBridgeSourceRocketMQ
EventBridge assumes the AliyunServiceRoleForEventBridgeSourceRocketMQ role to obtain permissions to access Message Queue for Apache RocketMQ and implement resource access features.
The following AliyunServiceRolePolicyForEventBridgeSourceRocketMQ policy is attached to the AliyunServiceRoleForEventBridgeSourceRocketMQ role:
{
"Version":"1",
"Statement":[
{
"Action":[
"mq:QueryInstanceBaseInfo",
"mq:SUB"
],
"Resource":"*",
"Effect":"Allow"
},
{
"Action":"ram:DeleteServiceLinkedRole",
"Resource":"*",
"Effect":"Allow",
"Condition":{
"StringEquals":{
"ram:ServiceName":"source-rocketmq.eventbridge.aliyuncs.com"
}
}
}
]
}
AliyunServiceRoleForEventBridgeSendToRocketMQ
EventBridge assumes the AliyunServiceRoleForEventBridgeSendToRocketMQ role to obtain permissions to access Message Queue for Apache RocketMQ and implement features that need to publish messages.
The following AliyunServiceRolePolicyForEventBridgeSendToRocketMQ policy is attached to the AliyunServiceRoleForEventBridgeSendToRocketMQ role:
{
"Version":"1",
"Statement":[
{
"Action":[
"mq:PUB",
"mq:QueryInstanceBaseInfo",
"mq:QueryTopicStatus",
"mq:QueryConsumerAccumulate",
"mq:QueryConsumerStatus"
],
"Resource":"*",
"Effect":"Allow"
},
{
"Action":"ram:DeleteServiceLinkedRole",
"Resource":"*",
"Effect":"Allow",
"Condition":{
"StringEquals":{
"ram:ServiceName":"sendevent-rocketmq.eventbridge.aliyuncs.com"
}
}
}
]
}
AliyunServiceRoleForEventBridgeConnectVPC
EventBridge assumes the AliyunServiceRoleForEventBridgeConnectVPC role to obtain permissions to access Virtual Private Cloud (VPC) and implement resource access features.
The following AliyunServiceRolePolicyForEventBridgeConnectVPC policy is attached to the AliyunServiceRoleForEventBridgeConnectVPC role:
{
"Version":"1",
"Statement":[
{
"Action":[
"vpc:DescribeVpcs",
"vpc:DescribeVSwitches",
"vpc:DescribeVSwitchAttributes"
],
"Resource":"*",
"Effect":"Allow"
},
{
"Action":[
"ecs:DescribeSecurityGroups",
"ecs:CreateNetworkInterface",
"ecs:DeleteNetworkInterface",
"ecs:DescribeNetworkInterfaces",
"ecs:CreateNetworkInterfacePermission",
"ecs:DescribeNetworkInterfacePermissions",
"ecs:DeleteNetworkInterfacePermission"
],
"Resource":"*",
"Effect":"Allow"
},
{
"Action":"ram:DeleteServiceLinkedRole",
"Resource":"*",
"Effect":"Allow",
"Condition":{
"StringEquals":{
"ram:ServiceName":"connect-vpc.eventbridge.aliyuncs.com"
}
}
}
]
}
AliyunServiceRoleForEventBridgeSourceActionTrail
EventBridge assumes the AliyunServiceRoleForEventBridgeSourceActionTrail role to obtain permissions to access ActionTrail and implement features that need to query and deliver operation records.
The following AliyunServiceRolePolicyForEventBridgeSourceActionTrail policy is attached to the AliyunServiceRoleForEventBridgeSourceActionTrail role:
{
"Version": "1",
"Statement": [
{
"Action": [
"actiontrail:CreateServiceTrail",
"actiontrail:DeleteServiceTrail"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": "ram:DeleteServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": "source-actiontrail.eventbridge.aliyuncs.com"
}
}
}
]
}
AliyunServiceRoleForEventBridgeSourceRabbitMQ
EventBridge assumes the AliyunServiceRoleForEventBridgeSourceRabbitMQ role to obtain permissions to access Message Queue for RabbitMQ and implement resource access features.
The following AliyunServiceRolePolicyForEventBridgeSourceRabbitMQ policy is attached to the AliyunServiceRoleForEventBridgeSourceRabbitMQ role:
{
"Version": "1",
"Statement": [
{
"Action": [
"amqp:GetVhost",
"amqp:BasicRecover",
"amqp:BasicCancel",
"amqp:BasicConsume",
"amqp:BasicAck",
"amqp:BasicNack",
"amqp:BasicReject",
"amqp:QueuePurge",
"amqp:BasicGet"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": "ram:DeleteServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": "source-rabbitmq.eventbridge.aliyuncs.com"
}
}
}
]
}
AliyunServiceRoleForEventBridgeSendToRabbitMQ
EventBridge assumes the AliyunServiceRoleForEventBridgeSendToRabbitMQ role to obtain permissions to access Message Queue for RabbitMQ and implement features that need to publish messages.
The following AliyunServiceRolePolicyForEventBridgeSendToRabbitMQ policy is attached to the AliyunServiceRoleForEventBridgeSendToRabbitMQ role:
{
"Version":"1",
"Statement":[
{
"Action":[
"amqp:ListInstance",
"amqp:ListVhost",
"amqp:ListExchange",
"amqp:GetVhost",
"amqp:CreateExchange",
"amqp:GetExchange",
"amqp:CreateQueue",
"amqp:GetQueue",
"amqp:BasicRecover",
"amqp:BasicPublish",
"amqp:BasicAck",
"amqp:BasicNack"
],
"Resource":"*",
"Effect":"Allow"
},
{
"Action":"ram:DeleteServiceLinkedRole",
"Resource":"*",
"Effect":"Allow",
"Condition":{
"StringEquals":{
"ram:ServiceName":"sendevent-rabbitmq.eventbridge.aliyuncs.com"
}
}
}
]
}
AliyunServiceRoleForEventBridgeSourceKafka
EventBridge assumes the AliyunServiceRoleForEventBridgeSourceKafka role to obtain permissions to access Message Queue for Apache Kafka and implement resource access features.
The following AliyunServiceRolePolicyForEventBridgeSourceKafka policy is attached to the AliyunServiceRoleForEventBridgeSourceKafka role:
{
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"alikafka:ListInstance",
"alikafka:ListSaslUser"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "ram:DeleteServiceLinkedRole",
"Resource": "*",
"Condition": {
"StringEquals": {
"ram:ServiceName": "source-kafka.eventbridge.aliyuncs.com"
}
}
}
]
}
AliyunServiceRoleForEventBridgeSendToKafka
EventBridge assumes the AliyunServiceRoleForEventBridgeSendToKafka role to obtain permissions to access Message Queue for Apache Kafka and implement features that need to publish messages.
The following AliyunServiceRolePolicyForEventBridgeSendToKafka policy is attached to the AliyunServiceRoleForEventBridgeSendToKafka role:
{
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"alikafka:ListInstance",
"alikafka:ListSaslUser"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "ram:DeleteServiceLinkedRole",
"Resource": "*",
"Condition": {
"StringEquals": {
"ram:ServiceName": "sendevent-kafka.eventbridge.aliyuncs.com"
}
}
}
]
}
AliyunServiceRoleForEventBridgeSendToRDS
EventBridge assumes the AliyunServiceRoleForEventBridgeSendToRDS role to obtain permissions to access ApsaraDB RDS and implement features that need to deliver data to ApsaraDB RDS.
The following AliyunServiceRolePolicyForEventBridgeSendToRDS policy is attached to the AliyunServiceRoleForEventBridgeSendToRDS role:
{
"Version": "1",
"Statement": [
{
"Action": [
"rds:DescribeDBInstanceAttribute",
"rds:DescribeDatabases",
"rds:DescribeAccounts"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": "ram:DeleteServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": "sendevent-rds.eventbridge.aliyuncs.com"
}
}
}
]
}
Usage notes
If you delete a service-linked role, EventBridge cannot publish events to the corresponding Alibaba Cloud service. Exercise caution when you delete the role. To use the corresponding feature, you must create the role again. For more information, see Create a service-linked role.
For more information about how to delete a service-linked role, see Delete a service-linked role.
FAQ
Q: Why is a service-linked role for EventBridge not automatically created for my RAM user?
A: If a service-linked role has been created for your Alibaba Cloud account, your RAM user inherits the service-linked role of your Alibaba Cloud account. If your RAM user cannot inherit the service-linked role, log on to the RAM console, create the following custom policy, and then attach the custom policy to the RAM user:
{
"Version":"1",
"Statement":[
{
"Action":"ram:CreateServiceLinkedRole",
"Resource":"acs:ram:*:Alibaba Cloud account ID:role/*",
"Effect":"Allow",
"Condition":{
"StringEquals":{
"ram:ServiceName":[
"sendevent-fc.eventbridge.aliyuncs.com",
"sendevent-mns.eventbridge.aliyuncs.com",
"sendevent-sms.eventbridge.aliyuncs.com",
"sendevent-directmail.eventbridge.aliyuncs.com",
"source-rocketmq.eventbridge.aliyuncs.com",
"sendevent-rocketmq.eventbridge.aliyuncs.com",
"connect-vpc.eventbridge.aliyuncs.com",
"source-actiontrail.eventbridge.aliyuncs.com",
"source-rabbitmq.eventbridge.aliyuncs.com",
"sendevent-rabbitmq.eventbridge.aliyuncs.com",
"source-kafka.eventbridge.aliyuncs.com",
"sendevent-kafka.eventbridge.aliyuncs.com",
"sendevent-rds.eventbridge.aliyuncs.com"
]
}
}
}
]
}
If the service-linked role is still not automatically created for your RAM user after you attach the custom policy to the RAM user, attach the AliyunEventBridgeFullAccess policy to the RAM user. For more information about policies, see Policies.