To use the transparent data encryption (TDE) feature of Lindorm, grant the service-linked role AliyunServiceRoleForTSDBLindormEncryption to Lindorm. This allows Lindorm to use the transparent data encryption feature in your Alibaba Cloud account.
Background information
A service-linked role is a role that is associated with a specific cloud service. The associated service automatically creates and deletes this role when you use certain features. For example, the service-linked role (AliyunServiceRoleForTSDBLindormEncryption) allows Lindorm to access Key Management Service (KMS) in some scenarios. The system automatically creates this service-linked role when you enable transparent data encryption. For more information, see Service-linked roles.
You cannot modify or delete the policy, or change the permissions of the role.
The AliyunServiceRoleForTSDBLindormEncryption service-linked role
Role name: AliyunServiceRoleForTSDBLindormEncryption
Policy name: AliyunServiceRoleForTSDBLindormEncryption
Permissions description: Allows Lindorm to access related resources in KMS. The transparent data encryption (TDE) feature uses this permission to query and manage keys. The full policy is as follows:
{
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"kms:ListKeys",
"kms:ListResourceTags",
"kms:DescribeKey"
],
"Resource": [
"acs:kms:*:*:*"
]
},
{
"Effect": "Allow",
"Action": [
"kms:Encrypt",
"kms:Decrypt",
"kms:GenerateDataKey",
"kms:CreateAlias"
],
"Resource": [
"acs:kms:*:*:*"
],
"Condition": {
"StringEqualsIgnoreCase": {
"kms:tag/acs:lindorm:instance-encryption": "true"
}
}
},
{
"Action": "ram:DeleteServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": "encryption.hitsdb.aliyuncs.com"
}
}
}
]
}Delete a service-linked role
Before deleting the AliyunServiceRoleForTSDBLindormEncryption service-linked role, confirm that no instances are using it. For instructions, see Delete a service-linked role.
Role creation permissions for RAM users
The permission to create a service-linked role is typically included in the administrator policy for the corresponding cloud service. Therefore, a user with administrative permissions for the service can create the service-linked role.
If a RAM user has insufficient permissions to create the service-linked role, grant them the permission shown below. For instructions on how to add permissions, see Create a custom policy and Grant permissions to a RAM user. Alternatively, you can create the role by using your Alibaba Cloud account.
{
"Action": "ram:CreateServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": "encryption.hitsdb.aliyuncs.com"
}
}
}