AliyunServiceRoleForGaAlb service-linked role: required permissions, automatic creation, and deletion. - Global Accelerator

When you configure an Application Load Balancer (ALB) as an endpoint for Global Accelerator, the system automatically creates the AliyunServiceRoleForGaAlb service-linked role if it does not exist.

Introduction to AliyunServiceRoleForGaAlb

AliyunServiceRoleForGaAlb is a service-linked role (SLR) that Global Accelerator requires to add an ALB as an endpoint.

Note

A service-linked role is a Resource Access Management (RAM) role associated with an Alibaba Cloud service. Some cloud services require permissions to access other services. Service-linked roles simplify this authorization and help prevent accidental operations. For more information, see Service-linked roles.

Permissions required to create the AliyunServiceRoleForGaAlb service-linked role

An Alibaba Cloud account can create the AliyunServiceRoleForGaAlb service-linked role by default. A RAM user must have the following permissions:

{
      "Action": "ram:CreateServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "alb.ga.aliyuncs.com"
        }
      }
}

You can grant a RAM user the required permissions in the following ways:

Attach the AliyunGlobalAccelerationFullAccess administrative policy to the RAM user. For more information, see Manage permissions for a RAM role.
Note The AliyunGlobalAccelerationFullAccess administrative policy includes the permission to create this service-linked role. Any user with Global Accelerator administrative permissions can create it.

Create a custom policy and attach it to the RAM user. The custom policy must include the following permissions:

{
      "Action": "ram:CreateServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "alb.ga.aliyuncs.com"
        }
      }
}

For more information, see Create a custom policy and Manage permissions for a RAM role.

Create the AliyunServiceRoleForGaAlb service-linked role

When you configure an ALB as an endpoint for Global Accelerator, the system checks whether the AliyunServiceRoleForGaAlb service-linked role exists:

If the AliyunServiceRoleForGaAlb service-linked role does not exist, the system automatically creates it and attaches an access policy named AliyunServiceRoleForGaAlb to the role. This policy grants Global Accelerator permissions to access ALB:

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "alb:GetLoadBalancerAttribute",
      "Resource": "*"
    },
    {
      "Action": "ram:DeleteServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "alb.ga.aliyuncs.com"
        }
      }
    }
  ],
  "Version": "1"
}

If the AliyunServiceRoleForGaAlb service-linked role already exists, the system does not create it again.

Delete the AliyunServiceRoleForGaAlb service-linked role

The AliyunServiceRoleForGaAlb service-linked role is not automatically deleted. To delete the role, first delete all ALB endpoints, and then delete the service-linked role: