Global Accelerator:AliyunServiceRoleForGaSsl

Introduction to AliyunServiceRoleForGaSsl

AliyunServiceRoleForGaSsl is a service-linked role for Global Accelerator. To associate an SSL certificate with an HTTPS listener on a Global Accelerator instance, Global Accelerator must be assigned this service-linked role.

Permissions required to create the service-linked role AliyunServiceRoleForGaSsl

By default, an Alibaba Cloud account has the permissions to create AliyunServiceRoleForGaSsl. A RAM user must have the following permissions:

{
      "Action": "ram:CreateServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "ssl.ga.aliyuncs.com"
        }
      }
}

You can grant a RAM user the permissions to create AliyunServiceRoleForGaSsl by using one of the following methods:

• Attach the AliyunGlobalAccelerationFullAccess administrator policy to the RAM user. For more information, see Grant permissions to a RAM role.

  Note

  In most cases, the AliyunGlobalAccelerationFullAccess administrator policy includes the permissions to create AliyunServiceRoleForGaSsl. If this policy is attached to the RAM user, the RAM user can create the service-linked role.

• Attach a custom policy to the RAM user. The custom policy contains the following content:

  {
        "Action": "ram:CreateServiceLinkedRole",
        "Resource": "*",
        "Effect": "Allow",
        "Condition": {
          "StringEquals": {
            "ram:ServiceName": "ssl.ga.aliyuncs.com"
          }
        }
  }

For more information, see Create a custom policy and Grant permissions to a RAM role.

Create the service-linked role AliyunServiceRoleForGaSsl

When you configure an HTTPS listener for a Global Accelerator instance, the system checks whether Global Accelerator is assigned AliyunServiceRoleForGaSsl:

• If AliyunServiceRoleForGaSsl is not assigned to Global Accelerator, the system automatically creates the role and attaches a policy named AliyunServiceRoleForGaSsl to grant Global Accelerator the permissions to access SSL certificates. The policy contains the following content:

  {
  	"Version": "1",
  	"Statement": [{
  			"Effect": "Allow",
  			"Action": [
  				"yundun-cert:GetUserCertificateDetail"
  			],
  			"Resource": "*"
  		},
  		{
  			"Action": "ram:DeleteServiceLinkedRole",
  			"Resource": "*",
  			"Effect": "Allow",
  			"Condition": {
  				"StringEquals": {
  					"ram:ServiceName": "ssl.ga.aliyuncs.com"
  				}
  			}
  		}
  	]
  }

• If AliyunServiceRoleForGaSsl is already assigned to Global Accelerator, the system does not create the role again.

Delete the service-linked role AliyunServiceRoleForGaSsl

AliyunServiceRoleForGaSsl is not automatically deleted. To delete the role, first delete the HTTPS listener of the Global Accelerator instance, and then delete the service-linked role. For more information, see the following topics:

• Delete a listener

• Delete a service-linked role