MaxCompute service-linked role AliyunServiceRoleForMaxComputeIdentityMgmt - MaxCompute

A service-linked role (SLR) is a RAM role whose trusted entity is an Alibaba Cloud service. SLRs enable cross-service authorization. For example, for MaxCompute to access other services on the big data computing platform, such as Hologres, you must create the AliyunServiceRoleForMaxComputeIdentityMgmt service-linked role.

Required permissions for RAM users

To create or delete a service-linked role as a RAM user, you must attach the AliyunMaxComputeFullAccess policy to the RAM user, or add the following permissions to the Action statement of a custom permission policy:

Create a service-linked role: ram:CreateServiceLinkedRole
Delete a service-linked role: ram:DeleteServiceLinkedRole

For more information, see Permissions required to manage a service-linked role.

Create a service-linked role

The MaxCompute SLR has the following details:

Role name: AliyunServiceRoleForMaxComputeIdentityMgmt
Purpose: Authorizes MaxCompute to access other services on the big data computing platform, such as Hologres.
Attached policy: AliyunServiceRolePolicyForMaxComputeIdentityMgmt

Permission policy details:

{
 "Statement": [
 {
 "Effect": "Allow",
 "Action": "odps:ActOnBehalfOfAUser",
 "Resource": "acs:odps:*:*:users/*"
 },
 {
 "Action": "ram:DeleteServiceLinkedRole",
 "Resource": "*",
 "Effect": "Allow",
 "Condition": {
 "StringEquals": {
 "ram:ServiceName": "identity.odps.aliyuncs.com"
 }
 }
 }
 ],
 "Version": "1"
}

First-time activation

On the MaxCompute activation page, click Create Service-linked Role to authorize the service.

On the activation page, choose a region such as China (Hangzhou), select Standard for Specification Type, and select pay-as-you-go for computing, storage, and download services.

Already activated

Go to the RAM Quick Authorization page to authorize the role.

This page indicates that the cloud-native big data computing service requests to create the service-linked role AliyunServiceRoleForMaxComputeIdentityMgmt. Click Confirm Authorization.

View a service-linked role

After the service-linked role is created, go to the Roles page in the RAM console and search for AliyunServiceRoleForMaxComputeIdentityMgmt. You can view the following details:

Basic information

On the role details page, view basic information in the Basic information section, including the name, creation time, role ARN, and description.
Permission policy

On the Permissions tab, click a permission policy name to view the policy content and the cloud resources that the role can access.
Trust policy

On the Trust policy tab, view the trust policy. A trust policy defines the trusted entity of a RAM role, which is an identity that can assume the role. For a service-linked role, the trusted entity is a cloud service, shown in the Service field of the trust policy.

For detailed instructions, see View RAM role information.

Delete a service-linked role

If you no longer need MaxCompute, you can delete the service-linked role in the RAM console. For instructions, see Delete a RAM role.

Note

If you delete the AliyunServiceRoleForMaxComputeIdentityMgmt service-linked role, MaxCompute can no longer access other services on the big data computing platform. Proceed with caution.