AliyunServiceRoleForGaOss for accessing OSS origin servers - Global Accelerator - Alibaba Cloud - Global Accelerator

When you configure an Object Storage Service (OSS) bucket as a Global Accelerator endpoint, the system automatically creates the AliyunServiceRoleForGaOss service-linked role if the role does not already exist.

Introduction to AliyunServiceRoleForGaOss

AliyunServiceRoleForGaOss is a service-linked role (SLR) that Global Accelerator requires to add an Object Storage Service (OSS) bucket as an endpoint.

Note A service-linked role is a Resource Access Management (RAM) role linked to an Alibaba Cloud service. In certain scenarios, a service must access other Alibaba Cloud services to perform specific operations. Service-linked roles provide the necessary permissions and help prevent risks from accidental operations. For more information, see Service-linked roles.

Permissions required to create the AliyunServiceRoleForGaOss service-linked role

An Alibaba Cloud account has the required permissions by default. A RAM user must have the following permissions to create the AliyunServiceRoleForGaOss service-linked role:

{
      "Action": "ram:CreateServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "oss.ga.aliyuncs.com"
        }
      }
}

To grant a RAM user the required permissions to create the AliyunServiceRoleForGaOss role, use one of the following methods:

Attach the administrative policy AliyunGlobalAccelerationFullAccess to the RAM user. For more information, see Manage permissions for a RAM role.
Note The permission to create the AliyunServiceRoleForGaOss service-linked role is included in the AliyunGlobalAccelerationFullAccess administrative policy. Therefore, a user with administrative permissions for Global Accelerator can create this service-linked role.

Create a custom policy and attach it to the RAM user. The custom policy must include the following permissions:

{
      "Action": "ram:CreateServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "oss.ga.aliyuncs.com"
        }
      }
}

For more information, see Create a custom policy and Manage permissions for a RAM role.

Create the AliyunServiceRoleForGaOss service-linked role

When you configure an Object Storage Service (OSS) bucket as a Global Accelerator endpoint, the system checks whether the AliyunServiceRoleForGaOss service-linked role exists:

If the role does not exist, the system automatically creates it and attaches the AliyunServiceRoleForGaOss access policy to it. This grants Global Accelerator permissions to access Object Storage Service (OSS). The policy is as follows:

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "oss:getBucketInfo",
      "Resource": "*"
    },
    {
      "Action": "ram:DeleteServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "oss.ga.aliyuncs.com"
        }
      }
    }
  ],
  "Version": "1"
}

If the role already exists, the system does not create it again.

Delete the AliyunServiceRoleForGaOss service-linked role

The AliyunServiceRoleForGaOss service-linked role is not automatically deleted. To delete the role, first delete all OSS-type endpoints, and then delete the service-linked role. For more information, see: