ApsaraDB for MongoDB:Service-linked role

Typically, a service-linked role is created automatically when you perform an action. If automatic creation fails, or if ApsaraDB for MongoDB does not support automatic creation for a specific scenario, you must create the role manually.

Resource Access Management (RAM) attaches a read-only system policy to each service-linked role. To view the policy details, go to the details page of the service-linked role. For more information, see ApsaraDB for MongoDB system policy reference.

Use cases

When you use the audit log feature of ApsaraDB for MongoDB, ApsaraDB for MongoDB automatically creates the service-linked role AliyunServiceRoleForMongoDB to allow ApsaraDB for MongoDB to access Simple Log Service resources.

RAM user permissions

If you use a RAM user to create or delete a service-linked role, ask your administrator to grant the AliyunMongoDBFullAccess permission to the RAM user. Alternatively, add the following permissions to the Action statement of a custom policy:

• Create a service-linked role: ram:CreateServiceLinkedRole

• Delete a service-linked role: ram:DeleteServiceLinkedRole

For more information about granting permissions, see Permissions required to manage service-linked roles.

Create a service-linked role

When you use the audit log feature of ApsaraDB for MongoDB, the system automatically creates the service-linked role. For more information, see Enable audit logs.

You can also manually create the service-linked role from the RAM console or by calling an API. For more information, see Create a service-linked role and CreateServiceLinkedRole.

View a service-linked role

After the service-linked role is created, go to the Roles page in the RAM console. Search for AliyunServiceRoleForMongoDB and view the following details:

• Basic information

  The Basic Information section on the details page for the AliyunServiceRoleForMongoDB role displays the role's name, creation time, Alibaba Cloud Resource Name (ARN), and description.

• Policy

  On the Permissions tab of the details page for the AliyunServiceRoleForMongoDB role, click a policy to view its content and the resources the role can access.

• Trust policy

  On the Trust Policy Management tab of the details page for the AliyunServiceRoleForMongoDB role, view the content of the trust policy. A trust policy specifies the trusted entities that can assume a RAM role. For a service-linked role, the trusted entity is a cloud service. You can identify this service in the Service field of the trust policy.

For more information about viewing service-linked roles, see View the details of a RAM role.

Delete a service-linked role

If you no longer use ApsaraDB for MongoDB, you can manually delete the service-linked role in the RAM console.

Before you delete the role, make sure the following condition is met:

• Release or unsubscribe from all ApsaraDB for MongoDB instances that depend on the AliyunServiceRoleForMongoDB role. For more information, see Release a pay-as-you-go instance or .

For more information, see Delete a RAM role.