AliyunServiceRoleForGaCdt service-linked role required for pay-by-data-transfer - Global Accelerator - Alibaba Cloud - Global Accelerator

When you configure the pay-by-data-transfer billing method for Global Accelerator bandwidth, the system automatically creates the AliyunServiceRoleForGaCdt service-linked role if it does not already exist. This role allows Cloud Data Transfer (CDT) to settle and bill traffic fees.

About AliyunServiceRoleForGaCdt

AliyunServiceRoleForGaCdt is a service-linked role (SLR) that Global Accelerator uses to enable the pay-by-data-transfer billing method for bandwidth.

Note A service-linked role is a Resource Access Management (RAM) role associated with an Alibaba Cloud service. In some scenarios, a service requires permissions to access other Alibaba Cloud services to enable a feature. Service-linked roles provide the necessary permissions and reduce the risk of misconfigurations. For more information, see Service-linked roles.

Permissions to create AliyunServiceRoleForGaCdt

By default, an Alibaba Cloud account has permissions to create the AliyunServiceRoleForGaCdt service-linked role. A RAM user must have the following permissions to create this role:

{
      "Action": "ram:CreateServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "cdt.ga.aliyuncs.com"
        }
      }
}

You can grant a RAM user the required permissions by using one of the following methods:

Add the administrative policy AliyunGlobalAccelerationFullAccess to the RAM user. For more information, see Manage permissions for a RAM role.
Note The permission to create the AliyunServiceRoleForGaCdt service-linked role is included in the AliyunGlobalAccelerationFullAccess administrative policy. Therefore, any user with administrative permissions for Global Accelerator can create this service-linked role.

Create a custom policy that includes the following permissions and attach it to the RAM user:

{
      "Action": "ram:CreateServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "cdt.ga.aliyuncs.com"
        }
      }
}

For more information, see Create a custom policy and Manage permissions for a RAM role.

Create the AliyunServiceRoleForGaCdt service-linked role

When you configure the pay-by-data-transfer billing method for Global Accelerator bandwidth, the system checks if the AliyunServiceRoleForGaCdt service-linked role exists:

If the AliyunServiceRoleForGaCdt service-linked role does not exist, the system automatically creates it and attaches an access policy named AliyunServiceRoleForGaCdt. This policy grants Global Accelerator permissions to access CDT. The policy content is as follows:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "cdt:GetCdtCbServiceStatus",
        "cdt:GetCdtInternetServiceStatus",
        "cdt:GetCdtServiceStatus",
        "cdt:OpenCdtCbService",
        "cdt:OpenCdtInternetService",
        "cdt:OpenCdtService"
      ],
      "Resource": "*"
    },
    {
      "Action": "ram:DeleteServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "cdt.ga.aliyuncs.com"
        }
      }
    }
  ]
}

If the AliyunServiceRoleForGaCdt service-linked role already exists, the system does not create it again.

Delete the AliyunServiceRoleForGaCdt service-linked role

The system does not automatically delete the AliyunServiceRoleForGaCdt service-linked role. To delete this role, first delete all Global Accelerator instances that use the pay-by-data-transfer billing method, and then delete the role. For more information, see Delete a service-linked role.