Details of the EAS service-linked role - Platform For AI

EAS uses the service-linked role AliyunServiceRoleForPaiEas to access other cloud services. This role is automatically created when you use EAS for the first time. If you need to delete this role, see the instructions below.

Background

The service-linked role for EAS, AliyunServiceRoleForPaiEas, is a RAM role that EAS assumes to access other cloud services. For more information about service-linked roles, see Service-linked roles.

EAS assumes the AliyunServiceRoleForPaiEas role to access resources in OSS, SLS, ECS, or VPC.

AliyunServiceRoleForPaiEas permissions

AliyunServiceRoleForPaiEas can access the following cloud services:

OSS

    {
      "Action": [
        "oss:GetObject",
        "oss:PutObject",
        "oss:DeleteObject",
        "oss:ListParts",
        "oss:AbortMultipartUpload",
        "oss:ListObjects",
        "oss:ListBuckets",
        "oss:PutBucketCors",
        "oss:GetBucketCors",
        "oss:DeleteBucketCors"
      ],
      "Resource": "*",
      "Effect": "Allow"
    }

SLS

    {
      "Action": [
        "log:CreateConfig",
        "log:GetConfig",
        "log:UpdateConfig",
        "log:DeleteConfig",
        "log:CreateMachineGroup",
        "log:GetMachineGroup",
        "log:DeleteMachineGroup",
        "log:ApplyConfigToGroup",
        "log:ListProject",
        "log:ListLogStores"
      ],
      "Resource": "*",
      "Effect": "Allow"
    }

ECS

    {
      "Action": [
        "ecs:CreateNetworkInterface",
        "ecs:DeleteNetworkInterface",
        "ecs:DescribeNetworkInterfaces",
        "ecs:CreateNetworkInterfacePermission",
        "ecs:DescribeNetworkInterfacePermissions",
        "ecs:DeleteNetworkInterfacePermission",
        "ecs:DescribeSecurityGroups"
      ],
      "Resource": "*",
      "Effect": "Allow"
    }

VPC

    {
      "Action": [
        "vpc:DescribeVSwitchAttributes",
        "vpc:DescribeVpcs",
        "vpc:DescribeVSwitches",
        "vpc:DescribeVpcAttribute"
      ],
      "Resource": "*",
      "Effect": "Allow"
    }

Delete AliyunServiceRoleForPaiEas

If you need to delete AliyunServiceRoleForPaiEas for security reasons, note that you may no longer be able to update service versions, create VPC direct connections, or deliver service logs to SLS.

To delete the role, follow these steps:

Log on to the RAM console.
In the left-side navigation pane, choose Identities > Roles.
On the Roles page, enter AliyunServiceRoleForPaiEas in the search box. The role appears in the search results.
In the Actions column for the target role, click Delete Role.
In the Delete Role confirmation dialog box, enter the role name, and then click Delete Role.

If a RAM user cannot delete AliyunServiceRoleForPaiEas, see FAQ about EAS.