All Products
Search

This Product

    Managed Security Service:Service-linked role

    Document Center

    Managed Security Service:Service-linked role

    Last Updated:Oct 23, 2025

    Managed Security Service (MSS) uses a service-linked role to gain the permissions needed to manage your cloud resources. An SLR is a type of resource access management (RAM) role that a trusted Alibaba Cloud service can assume. This role allows MSS to access your resources in other cloud services, such as Elastic Compute Service (ECS) and ApsaraDB RDS, to perform operations such as security assessments and security hardening on your behalf.

    Roles and permissions

    MSS creates different service-linked roles based on the features you use.

    AliyunServiceRoleForMssp

    You need this role to use the basic features of MSS. It lets MSS access your core cloud resources for services such as security assessments and security hardening.

    • Role name: AliyunServiceRoleForMssp.

    • Access policy: AliyunServiceRolePolicyForMssp.

    • Policy document: For more information, see AliyunServiceRolePolicyForMssp.

    AliyunServiceRoleForESAMssp

    To use MSS for security operations on Edge Security Acceleration (ESA), you need this additional service-linked role. It lets MSS access your ESA and Simple Log Service (SLS) resources.

    • Role name: AliyunServiceRoleForESAMssp.

    • Access policy: AliyunServiceRolePolicyForESAMssp.

    • Policy document: For more information, see AliyunServiceRolePolicyForESAMssp.

    Note

    The AliyunServiceRolePolicyForMssp and AliyunServiceRolePolicyForESAMssp access policies are system-generated. You cannot modify these policies.

    Delete a service-linked role

    MSS requires service-linked roles to perform security operations on your resources. For this reason, you cannot delete the service-linked roles associated with MSS while your service subscription is active. After your subscription expires, you can delete the service-linked roles by following these steps:

    1. Go to the Roles page.

    2. Search for AliyunServiceRoleForMssp or AliyunServiceRoleForESAMssp. In the Actions column, click Delete Role.

    References