Global Accelerator:AliyunServiceRoleForGaNlb

AliyunServiceRoleForGaNlb is a service-linked role for Global Accelerator. If you want to specify an NLB instance as an endpoint of Global Accelerator, you must assign the service-linked role to Global Accelerator.

By default, an Alibaba Cloud account is authorized to create the service-linked role AliyunServiceRoleForGaNlb. If a RAM user wants to create the service-linked role, you must grant the following permissions to the RAM user:

{
      "Action": "ram:CreateServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "nlb.ga.aliyuncs.com"
        }
      }
}

You can grant the RAM user the required permissions by using one of the following methods:

• Attach the AliyunGlobalAccelerationFullAccess administrator policy to the RAM user. For more information, see Grant permissions to a RAM role.

  Note

  In most cases, the permissions to create the Global Accelerator service-linked role AliyunServiceRoleForGaNlb are included in the AliyunGlobalAccelerationFullAccess administrator policy. If the RAM user has administrator permissions on Global Accelerator, the RAM user can create the service-linked role AliyunServiceRoleForGaNlb for Global Accelerator.

• Attach a custom policy to the RAM user. The following code block shows the content of the custom policy:

  {
        "Action": "ram:CreateServiceLinkedRole",
        "Resource": "*",
        "Effect": "Allow",
        "Condition": {
          "StringEquals": {
            "ram:ServiceName": "nlb.ga.aliyuncs.com"
          }
        }
  }

  For more information, see Create a custom policy and Grant permissions to a RAM role.

If you specify an NLB instance as an endpoint of a Global Accelerator instance, the system determines whether the Global Accelerator is assigned the service-linked role AliyunServiceRoleForGaNlb:

• If your Alibaba Cloud account is not assigned the service-linked role AliyunServiceRoleForGaNlb, the system automatically creates the service-linked role and adds a policy named AliyunServiceRoleForGaNlb to the service-linked role to grant Global Accelerator the permissions to access NLB. The following code block shows the content of the policy:

  {
    "Version": "1"
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
                  "nlb:GetLoadBalancerAttribute",
                  "nlb:UpdateLoadBalancerProtection"
              ],
        "Resource": "*"
      },
      {
        "Action": "ram:DeleteServiceLinkedRole",
        "Resource": "*",
        "Effect": "Allow",
        "Condition": {
          "StringEquals": {
            "ram:ServiceName": "nlb.ga.aliyuncs.com"
          }
        }
      }
    ],
  }

• If your Alibaba Cloud account is assigned the service-linked role AliyunServiceRoleForGaNlb, the system does not re-create the service-linked role.

The system does not automatically delete the service-linked role AliyunServiceRoleForGaNlb. To delete the service-linked role, you must first delete the NLB instance that serves as an endpoint of your GA instance. For more information, see the following topics:

1. Delete an endpoint group

2. Delete a service-linked role