Scenarios and permissions of the service-linked role for Cloud Hardware Security Module (HSM) - Key Management Service

AliyunServiceRoleForHSMLogDelivery is a service-linked role that grants Cloud Hardware Security Module (HSM) the permissions it needs to deliver security audit logs to Object Storage Service (OSS).

Permissions

AliyunServiceRoleForHSMLogDelivery has the following permissions:

Permission	Resource	Purpose
`oss:ListBuckets`	All buckets (`acs:oss:::*`)	Retrieves the list of OSS buckets
`oss:GetObject`, `oss:PutObject`	`acs:oss:::*/aliyun-hsm-audit-log` and subpaths	Reads and writes audit log files to the `aliyun-hsm-audit-log` path in the destination bucket
`ram:DeleteServiceLinkedRole`	All (`*`), conditioned on `ram:ServiceName: logdelivery.hsm.aliyuncs.com`	Allows Resource Access Management (RAM) to delete this role when you no longer need it

The full policy for this role is:

{
  "Statement": [
    {
      "Action": "ram:DeleteServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "logdelivery.hsm.aliyuncs.com"
        }
      }
    },
    {
      "Action": [
        "oss:GetObject",
        "oss:PutObject"
      ],
      "Effect": "Allow",
      "Resource": [
        "acs:oss:*:*:*/aliyun-hsm-audit-log",
        "acs:oss:*:*:*/aliyun-hsm-audit-log/*"
      ]
    },
    {
      "Action": [
        "oss:ListBuckets"
      ],
      "Effect": "Allow",
      "Resource": [
        "acs:oss:*:*:*"
      ]
    }
  ]
}

Delete the service-linked role

Before deleting AliyunServiceRoleForHSMLogDelivery, confirm that:

No HSM instances are active
The security audit service is disabled

Both conditions ensure that no active workload depends on the role. Once both are met, delete the role from the RAM console.