Global Accelerator:AliyunServiceRoleForGaVpcEndpoint

AliyunServiceRoleForGaVpcEndpoint is a Global Accelerator service-linked role. To specify an ECS instance, ALB instance, NLB instance, CLB instance, ENI, or custom private IP address as an endpoint of Global Accelerator, you must assign the service-linked role to Global Accelerator.

By default, an Alibaba Cloud account is authorized to create the AliyunServiceRoleForGaVpcEndpoint service-linked role. RAM users must be granted the following permissions to create the service-linked role:

{
      "Action": "ram:CreateServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "vpcendpoint.ga.aliyuncs.com"
        }
      }
}

You can authorize a RAM user to create the service-linked role by using one of the following methods:

• Attach the AliyunGlobalAccelerationFullAccess administrator policy to the RAM user. For more information, see Manage permissions for a RAM role.

  Note

  In most cases, the permissions to create the Global Accelerator service-linked role AliyunServiceRoleForGaVpcEndpoint are included in the AliyunGlobalAccelerationFullAccess administrator policy. If the RAM user has administrator permissions on Global Accelerator, the RAM user can create this role for Global Accelerator.

• Attach a custom policy to the RAM user. The custom policy contains the following content:

  {
        "Action": "ram:CreateServiceLinkedRole",
        "Resource": "*",
        "Effect": "Allow",
        "Condition": {
          "StringEquals": {
            "ram:ServiceName": "vpcendpoint.ga.aliyuncs.com"
          }
        }
  }

  For more information, see Create a custom policy and Manage permissions for a RAM role.

When you specify an ECS instance, ALB instance, NLB instance, CLB instance, ENI, or custom private IP address as a Global Accelerator endpoint, the system determines whether Global Accelerator has the AliyunServiceRoleForGaVpcEndpoint service-linked role:

• If the AliyunServiceRoleForGaVpcEndpoint service-linked role is not assigned to Global Accelerator, the system automatically creates the role and attaches a policy named AliyunServiceRoleForGaVpcEndpoint. This policy grants Global Accelerator access to ECS, ALB, NLB, CLB, ENI, and custom private IP addresses. The policy contains the following content:

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Resource": "*",
        "Action": [
          "ecs:CreateNetworkInterface",
          "ecs:DeleteNetworkInterface",
          "ecs:DescribeNetworkInterfaces",
          "ecs:ModifyNetworkInterfaceAttribute",
          "ecs:DescribeSecurityGroups",
          "ecs:CreateSecurityGroup",
          "ecs:AuthorizeSecurityGroup",
          "ecs:AuthorizeSecurityGroupEgress",
          "ecs:RevokeSecurityGroup",
          "ecs:RevokeSecurityGroupEgress",
          "ecs:JoinSecurityGroup",
          "ecs:LeaveSecurityGroup",
          "ecs:DeleteSecurityGroup",
          "ecs:DescribeSecurityGroupAttribute",
          "ecs:DescribeSecurityGroups",
          "ecs:DescribeSecurityGroupReferences",
          "ecs:ModifySecurityGroupAttribute",
          "ecs:ModifySecurityGroupEgressRule",
          "ecs:ModifySecurityGroupPolicy",
          "ecs:ModifySecurityGroupRule",
          "vpc:DescribeVSwitches"
        ]
      },
      {
        "Action": "ram:DeleteServiceLinkedRole",
        "Resource": "*",
        "Effect": "Allow",
        "Condition": {
          "StringEquals": {
            "ram:ServiceName": "vpcendpoint.ga.aliyuncs.com"
          }
        }
      }
    ]
  }

• If the AliyunServiceRoleForGaVpcEndpoint service-linked role is assigned to Global Accelerator, the system does not re-create it.

The system does not automatically delete the Global Accelerator service-linked role AliyunServiceRoleForGaVpcEndpoint. To delete this role, you must first delete the ECS instance, ALB instance, NLB instance, CLB instance, ENI, or custom private IP address that serves as an endpoint. For more information, see the following topics:

1. Delete an endpoint

2. Delete a service-linked role