Service-linked Role - Alibaba Cloud Model Studio - Alibaba Cloud Documentation Center

To enable specific features, Alibaba Cloud Model Studio requires a service-linked role (SLR) to access other Alibaba Cloud services, such as Function Compute and Content Moderation, or cloud resources. When you first enable a feature in Alibaba Cloud Model Studio, such as a Function Compute node, the system automatically creates the corresponding service-linked role for you. This topic describes the service-linked roles that are created by Alibaba Cloud Model Studio and explains how to delete them.

Service-linked Roles Created by Alibaba Cloud Model Studio

You can view all service-linked roles on the Role Management page of the Resource Access Management (RAM) console.

Service-linked Role Name	Service-linked Role Description
AliyunServiceRoleForSFMAccessFC	Model Studio workflow applications use this service-linked role to access your resources in FC.
AliyunServiceRoleForSFMDataHubOSSImport	Data Management uses this service-linked role to access your resources in OSS.
AliyunServiceRoleForSFMAccessingMNS	Data Management accesses OSS change messages in MNS queues through this service-linked role.

AliyunServiceRoleForSFMAccessFC

Scenarios

This service-linked role allows Alibaba Cloud Model Studio workflow application to access your resources in FC.

Role and Permissions Description

Service-linked role name: AliyunServiceRoleForSFMAccessFC

System policy: AliyunServiceRolePolicyForSFMAccessFC

This system policy grants the following permissions:

{
  "Action": [
    "fc:ListFunctions",
    "fc:InvokeFunction"
  ],
  "Resource": "*",
  "Effect": "Allow"
}

Delete Service-linked Role

Warning

If you delete this service-linked role, workflow applications cannot create or call Function Compute nodes. Proceed with caution.

Before you delete the AliyunServiceRoleForSFMAccessFC service-linked role, you must delete the Function Compute nodes from all published workflow applications and then republish the applications or flows.

For more information about how to delete a service-linked role, see Service-linked Role.

AliyunServiceRoleForSFMDataHubOSSImport

Scenarios

The OSS data import feature in Data Management of Model Studio uses this service-linked role to access your resources in OSS.

Role and Permissions Description

Service-linked role name: AliyunServiceRoleForSFMDataHubOSSImport

System policy: AliyunServiceRolePolicyForSFMDataHubOSSImport

This system policy grants the following permissions:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "oss:ListBuckets",
        "oss:GetBucketLocation",
        "oss:GetBucketTagging"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "oss:DoMetaQuery",
        "oss:GetBucketInfo",
        "oss:GetBucketStat",
        "oss:GetBucketTransferAcceleration",
        "oss:GetCnameToken",
        "oss:GetMetaQueryStatus",
        "oss:GetObject",
        "oss:GetObjectTagging",
        "oss:DescribeRegions",
        "oss:ListObjects",
        "oss:ListObjectVersions"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "oss:BucketTag/bailian-datahub-access": [
            "read"
          ]
        }
      }
    },
    {
      "Action": "ram:DeleteServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "datahub.sfm.aliyuncs.com"
        }
      }
    }
  ]
}

Delete Service-linked Role

Warning

If you delete this service-linked role, Data Management cannot access your OSS resources. Proceed with caution.

Before you delete the AliyunServiceRoleForSFMDataHubOSSImport service-linked role, ensure that no OSS data import tasks are running in Data Management.

For more information about how to delete a service-linked role, see Service-linked Role.

AliyunServiceRoleForSFMAccessingMNS

Scenarios

This service-linked role allows Data Management in Alibaba Cloud Model Studio to access OSS change messages in MNS queues to automatically synchronize changes to your OSS data.

Role and Permissions Description

Service-linked role name: AliyunServiceRoleForSFMAccessingMNS

System policy: AliyunServiceRolePolicyForSFMAccessingMNS

This system policy grants the following permissions:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "mns:GetQueueAttributes",
        "mns:GetSubscriptionAttributes",
        "mns:GetTopicAttributes",
        "mns:ListEventNotifications",
        "mns:GetAccountAttributes",
        "mns:ListEvents",
        "mns:ListProducts",
        "mns:ListQueue",
        "mns:ListSubscriptionByTopic",
        "mns:ListTagResources",
        "mns:ListTopic",
        "mns:ReceiveMessage",
        "mns:DeleteMessage"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "mns:CreateQueue",
        "mns:DeleteQueue",
        "mns:SetQueueAttributes"
      ],
      "Resource": "acs:mns:*:*:/queues/bailian-oss-event*"
    },
    {
      "Action": "ram:DeleteServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "mns-access.sfm.aliyuncs.com"
        }
      }
    }
  ]
}

Delete Service-linked Role

This policy is defined and used by Alibaba Cloud Model Studio. Do not modify, delete, or grant it to any RAM identity other than a service-linked role.