What is the service-linked role AliyunServiceRoleForGaNlb and how to create the service-linked role AliyunServiceRoleForGaNlb - Global Accelerator

When you specify a Network Load Balancer (NLB) instance as an endpoint of Global Accelerator (GA), the system automatically creates the service-linked role AliyunServiceRoleForGaNlb if the role is not assigned to your Alibaba Cloud account.

Introduction to the service-linked role AliyunServiceRoleForGaNlb

AliyunServiceRoleForGaNlb is a service-linked role for Global Accelerator. To specify an NLB instance as an endpoint of Global Accelerator, you must assign this role to Global Accelerator.

Note

A service-linked role is a Resource Access Management (RAM) role linked to an Alibaba Cloud service. Some cloud service features require permissions on other services. Service-linked roles simplify authorization and help prevent accidental operations. For more information, see Service-linked roles.

Permissions that are required to create the service-linked role AliyunServiceRoleForGaNlb

By default, an Alibaba Cloud account is authorized to create the service-linked role AliyunServiceRoleForGaNlb. If a RAM user wants to create the service-linked role, you must grant the following permissions to the RAM user:

{
      "Action": "ram:CreateServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "nlb.ga.aliyuncs.com"
        }
      }
}

Grant the required permissions to the RAM user by using one of the following methods:

Attach the AliyunGlobalAccelerationFullAccess administrator policy to the RAM user. For more information, see Manage permissions for a RAM role.

Note
The AliyunGlobalAccelerationFullAccess policy typically includes the permissions to create the AliyunServiceRoleForGaNlb role for Global Accelerator. If the RAM user has administrator permissions on Global Accelerator, the RAM user can create this role for Global Accelerator.

Attach a custom policy with the following content to the RAM user:

{
      "Action": "ram:CreateServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "nlb.ga.aliyuncs.com"
        }
      }
}

For more information, see Create a custom policy and Manage permissions for a RAM role.

Create the service-linked role AliyunServiceRoleForGaNlb

When you specify an NLB instance as an endpoint of a Global Accelerator instance, the system checks whether Global Accelerator is assigned the AliyunServiceRoleForGaNlb role:

If the AliyunServiceRoleForGaNlb role is not assigned to your Alibaba Cloud account, the system automatically creates the role and attaches the AliyunServiceRoleForGaNlb policy to grant Global Accelerator permissions to access NLB. The policy contains the following content:

{
  "Version": "1"
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
                "nlb:GetLoadBalancerAttribute",
                "nlb:UpdateLoadBalancerProtection"
            ],
      "Resource": "*"
    },
    {
      "Action": "ram:DeleteServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "nlb.ga.aliyuncs.com"
        }
      }
    }
  ],
}

If the AliyunServiceRoleForGaNlb role is already assigned to your Alibaba Cloud account, the system does not re-create the role.

Delete the service-linked role AliyunServiceRoleForGaNlb

The AliyunServiceRoleForGaNlb role is not automatically deleted. Before you delete this role, you must delete the NLB instance that serves as an endpoint of your GA instance. For more information, see the following topics: