This topic describes the service-linked roles, associated services, and read-only and administrative permissions used by Cloud Service Diagnosis. For more information, see other topics about Cloud Service Diagnosis.
What is a service-linked role
In certain scenarios, a cloud service needs to access other cloud services to perform specific functions. Alibaba Cloud provides service-linked roles (SLRs) for this purpose. For example, to regularly check the health status of the cloud resources under your account, a service-linked role is required to query resources and access services like CloudMonitor and Log Service to perform health checks on your behalf.
For more information about service-linked roles, see Service-linked roles.
Cloud Service Diagnosis uses the following service-linked roles:
Role | Permission policy | Permissions | Details |
AliyunServiceRoleForHealth | AliyunServiceRolePolicyForHealth | Allows Cloud Service Diagnosis to access your cloud resources and diagnostic APIs to update health status and initiate diagnoses. | This is the service-linked role for Cloud Service Diagnosis. The role is automatically created when you activate the service. Deleting the role deactivates the service. |
AliyunServiceRoleForResourceMetaCenter | AliyunServiceRolePolicyForResourceMetaCenter | Allows Resource Center to access your cloud resources to provide services such as resource lists and search. | |
AliyunServiceRoleForNis | AliyunServiceRolePolicyForNis | Used to diagnose resources such as Server Load Balancer, Elastic IP Address, and VPN Gateway, as well as network path connectivity. | See Service-linked roles. |
Create a service-linked role
When you use Cloud Service Diagnosis for the first time, the system prompts you to confirm the creation of the required service-linked role. You do not need to create it manually.
A service-linked role only needs to be created once per Alibaba Cloud account. Once the role is created by an Alibaba Cloud account or a RAM user, other users in the same account do not need to create it again.
Note: Creating the service-linked role is simpler for an Alibaba Cloud account. A RAM user needs permission from the Alibaba Cloud account to create the role. If the RAM user does not have the permission, the system displays a prompt, and the user can request the permission from an administrator.
Delete a service-linked role
Deleting a service-linked role that Cloud Service Diagnosis depends on will affect its normal operation. This role may also be used by other products or features. Proceed with caution.
Log on to the RAM console with your Alibaba Cloud account. In the left-side navigation pane, choose Identities > Roles.
On the Roles page, enter the name of the service-linked role in the search box to find the role.
In the Actions column, click Delete.
In the dialog box, re-enter the role name and click OK.
Deleting the AliyunServiceRoleForHealth role deactivates Cloud Service Diagnosis and permanently deletes all your health status and diagnostic records. This data cannot be recovered. Proceed with caution.
Restore a service-linked role
If you need to use Cloud Service Diagnosis after deleting the AliyunServiceRoleForHealth role, the system will prompt you to reactivate the service. Confirming the reactivation automatically recreates the role.
If you delete other dependent service-linked roles but not AliyunServiceRoleForHealth, some features may not function correctly. When you use these features again, the system automatically recreates the required service-linked roles.
Associated services
In some scenarios, Cloud Service Diagnosis relies on other Alibaba Cloud services to implement certain features.
Cloud Service Diagnosis uses the following associated services:
Service | Description | Fees | Details |
Resource Center | Provides a unified view and search capabilities for resources across accounts, products, and regions. | Resource Center is a free service. | |
Network Intelligence Service | Provides diagnostic capabilities for network instances and network path connectivity. | The service is free during the public preview. If the billing method changes, you will be prompted for confirmation. |
Resource Center provides resource query and display capabilities and is a prerequisite for Cloud Service Diagnosis. You cannot use Cloud Service Diagnosis if Resource Center is not activated. However, Resource Center is activated automatically when you activate Cloud Service Diagnosis.
The following diagnostic tools depend on Network Intelligence Service:
Diagnostic tools in the Network and CDN category, such as those for Server Load Balancer, Elastic IP Address, and VPN Gateway
Diagnose inaccessible websites
Diagnose network path connectivity
If a feature requires an associated service that is not yet activated, the system prompts you to activate it. Once activated, you can use the feature.
Read-only and administrative permissions
To access Cloud Service Diagnosis, an administrator must grant the required permissions to a RAM user.
The administrative permission for Cloud Service Diagnosis is AliyunHealthFullAccess. This permission is required to perform create, update, or delete operations, such as initiating diagnoses and deleting diagnostic tasks. The administrative permission includes the read-only permission, so you do not need to grant the read-only permission separately.
The read-only permission for Cloud Service Diagnosis is AliyunHealthReadOnlyAccess. This permission allows you to view the health status of cloud resources, the list and details of diagnostic tasks. You cannot perform create, update, or delete operations, such as initiating diagnoses or deleting diagnostic tasks.
If a RAM user does not have the required permissions, the system displays a prompt. The user can proceed after the permissions are granted according to the on-screen instructions.