Microservices Engine (MSE) service-linked roles are predefined Resource Access Management (RAM) roles designed for specific features. By creating and granting these roles to MSE, you allow MSE to automatically obtain and manage the required permissions. This eliminates the need to manually assign complex and error-prone access policies, simplifying permission management and improving security. This topic describes the service-linked roles for MSE and how to delete them.
AliyunServiceRoleForMSE
Scenarios
When MSE needs to access resources from other Alibaba Cloud services, such as Elastic Compute Service (ECS), Virtual Private Cloud (VPC), Application Real-Time Monitoring Service (ARMS), Server Load Balancer (SLB), Container Service for Kubernetes (ACK), Enterprise Distributed Application Service (EDAS), and Alibaba Cloud Service Mesh (ASM), it uses the automatically created AliyunServiceRoleForMSE service-linked role to obtain access permissions.
Permission description
The AliyunServiceRoleForMSE role has access permissions for the following Alibaba Cloud services:
AliyunServiceRolePolicyForMSEEngineService
Scenarios
If you want to integrate the Nacos engine with other cloud products, such as Security Guardrail, you can use the AliyunServiceRolePolicyForMSEEngineService role.
Permission description
{
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": "yundun-greenweb:MultiModalGuard",
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "ram:DeleteServiceLinkedRole",
"Resource": "*",
"Condition": {
"StringEquals": {
"ram:ServiceName": "engine-service.mse.aliyuncs.com"
}
}
}
]
}
Deleting permissions
Deleting an MSE service-linked role prevents you from using the features that depend on it. This action may affect your business. Evaluate the impact and proceed with caution.
Log on to the Resource Access Management (RAM) console using your Alibaba Cloud account. In the navigation pane on the left, click Identities > Roles.
On the Roles page, enter the role name, such as
AliyunServiceRoleForMSE, in the search box to find the role.In the search results, find the role and click Delete Role in the Actions column.
In the Delete Role dialog box, enter the role name and click Delete Role.
FAQ
Why can't my RAM user automatically create the AliyunServiceRoleForMSE service-linked role?
The AliyunServiceRoleForMSE role can be automatically created or deleted only by a user with specific permissions. If a RAM user cannot automatically create the AliyunServiceRoleForMSE role, you must attach the following access policy to the user.
Replace Alibaba Cloud account ID with your Alibaba Cloud account ID.
{
"Statement": [
{
"Action": [
"ram:CreateServiceLinkedRole"
],
"Resource": "acs:ram:*:Alibaba Cloud account ID:role/*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": [
"mse.aliyuncs.com"
]
}
}
}
],
"Version": "1"
}