All Products
Search

This Product

    NAT Gateway:Service-linked role

    Document Center

    NAT Gateway:Service-linked role

    Last Updated:Apr 01, 2026

    NAT Gateway uses a service-linked role to access other Alibaba Cloud services on your behalf. This page explains what the role does, when it gets created, and how to delete it.

    What is a service-linked role

    A service-linked role is a Resource Access Management (RAM) role that a specific Alibaba Cloud service can assume to access other services. Because the role is created and managed by the service itself, you don't need to set up trust policies or manage permissions manually. For background, see Service-linked roles.

    Create a service-linked role

    When you create an enhanced NAT gateway, the system automatically creates the service-linked role AliyunServiceRoleForNatgw if one doesn't already exist, then attaches the permission policy AliyunServiceRolePolicyForNatgw to it.

    Note Standard NAT gateways do not trigger automatic creation of the service-linked role.

    The full permission policy is:

    {
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "vpc:DescribeVSwitchAttributes"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "ecs:CreateNetworkInterface",
                "ecs:CreateSecurityGroup",
                "ecs:AuthorizeSecurityGroup",
                "ecs:RevokeSecurityGroup",
                "ecs:DeleteSecurityGroup",
                "ecs:JoinSecurityGroup",
                "ecs:DeleteSecurityGroup",
                "ecs:LeaveSecurityGroup",
                "ecs:DescribeSecurityGroups",
                "ecs:AttachNetworkInterface",
                "ecs:DetachNetworkInterface",
                "ecs:DeleteNetworkInterface",
                "ecs:DescribeNetworkInterfaces",
                "ecs:CreateNetworkInterfacePermission",
                "ecs:DescribeNetworkInterfacePermissions",
                "ecs:DeleteNetworkInterfacePermission",
                "ecs:CreateSecurityGroupPermission",
                "ecs:AuthorizeSecurityGroupPermission",
                "ecs:RevokeSecurityGroupPermission",
                "ecs:DeleteSecurityGroupPermission",
                "ecs:JoinSecurityGroupPermission",
                "ecs:DeleteSecurityGroupPermission",
                "ecs:LeaveSecurityGroupPermission",
                "ecs:DescribeSecurityGroupPermissions",
                "ecs:AttachNetworkInterfacePermissions",
                "ecs:DetachNetworkInterfacePermissions",
                "ecs:AssignPrivateIpAddresses",
                "ecs:UnassignPrivateIpAddresses",
                "ecs:DescribeNetworkInterfaceAttribute"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": "ram:DeleteServiceLinkedRole",
            "Resource": "*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": "nat.aliyuncs.com"
                }
            }
        }
    ]
}

    Delete a service-linked role

    Before deleting AliyunServiceRoleForNatgw, delete all NAT gateways that depend on it. The role cannot be deleted while it is in use.

    1. Delete your Internet NAT gateway. See Delete an Internet NAT gateway.

    2. Delete the service-linked role. See Delete a service-linked role.

    FAQ

    Why wasn't AliyunServiceRoleForNatgw created automatically for my RAM user?

    The role is only created automatically if the RAM user has permission to call ram:CreateServiceLinkedRole for NAT Gateway. Attach the following policy to the RAM user:

    {
  "Statement": [
    {
      "Action": "ram:CreateServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "nat.aliyuncs.com"
        }
      }
    }
  ],
  "Version": "1"
}