Service-linked role for EAS self-managed resource groups - Platform For AI

Elastic Algorithm Service (EAS) uses the service-linked role AliyunServiceRoleForPaiEasManageCustomerClusters to access the cloud services required for self-managed resource groups. This role is automatically created the first time you use an EAS self-managed resource group.

Background

The AliyunServiceRoleForPaiEasManageCustomerClusters service-linked role is a RAM role that allows EAS to access other cloud services when you use self-managed resource groups. For more information about service-linked roles, see Service-linked roles.

EAS uses this role to access PrivateLink, VPC, ECS, ACK, SLS, and PrivateZone.

AliyunServiceRoleForPaiEasManageCustomerClusters permissions

AliyunServiceRoleForPaiEasManageCustomerClusters has permissions to access the following cloud services:

PrivateLink permissions

{
      "Action": [
        "privatelink:OpenPrivateLinkService",
        "privatelink:CheckProductOpen",
        "privatelink:ListVpcEndpointServices",
        "privatelink:CreateVpcEndpoint",
        "privatelink:ListVpcEndpoints",
        "privatelink:UpdateVpcEndpointAttribute",
        "privatelink:GetVpcEndpointAttribute",
        "privatelink:ListVpcEndpointSecurityGroups",
        "privatelink:AttachSecurityGroupToVpcEndpoint",
        "privatelink:DetachSecurityGroupFromVpcEndpoint",
        "privatelink:AddZoneToVpcEndpoint",
        "privatelink:RemoveZoneFromVpcEndpoint",
        "privatelink:ListVpcEndpointZones",
        "privatelink:DeleteVpcEndpoint"
      ],
      "Resource": "*",
      "Effect": "Allow"
    }

VPC permissions

{
      "Action": [
        "vpc:DescribeVpcs",
        "vpc:DescribeVpcAttribute",
        "vpc:DescribeVSwitches",
        "vpc:DescribeVSwitchAttributes"
      ],
      "Resource": "*",
      "Effect": "Allow"
    }

ECS permissions

{
      "Action": [
        "ecs:DescribeSecurityGroups",
        "ecs:CreateSecurityGroup",
        "ecs:DeleteSecurityGroup",
        "ecs:AuthorizeSecurityGroup",
        "ecs:AuthorizeSecurityGroupEgress",
        "ecs:RevokeSecurityGroup",
        "ecs:RevokeSecurityGroupEgress"
      ],
      "Resource": "*",
      "Effect": "Allow"
    }

ACK permissions

{
      "Action": [
        "cs:DescribeClusterDetail",
        "cs:DescribeClusterUserKubeconfig"
      ],
      "Resource": "*",
      "Effect": "Allow"
    }

SLS permissions

{
      "Action": [
        "log:GetIndex",
        "log:GetConfig",
        "log:GetLogStore",
        "log:GetProject",
        "log:GetLogStoreLogs",
        "log:GetMachineGroup",
        "log:CreateConfig",
        "log:CreateIndex",
        "log:CreateLogStore",
        "log:CreateMachineGroup",
        "log:CreateProject",
        "log:DeleteConfig",
        "log:DeleteIndex",
        "log:DeleteLogStore",
        "log:DeleteMachineGroup",
        "log:DeleteProject",
        "log:ApplyConfigToGroup"
      ],
      "Resource":  [
        "acs:log:*:*:project/*/logstore/eas-*",
        "acs:log:*:*:project/eas-*"
      ],
      "Effect": "Allow"
    }

PrivateZone permissions

{
      "Action": [
        "pvtz:AddZone",
        "pvtz:BindZoneVpc",
        "pvtz:AddZoneRecord",
        "pvtz:DeleteZone"
      ],
      "Resource": "*",
      "Effect": "Allow"
    }

Delete AliyunServiceRoleForPaiEasManageCustomerClusters

If you delete AliyunServiceRoleForPaiEasManageCustomerClusters for security reasons, you can no longer use self-managed resource groups to deploy or update services. Existing services that use these resource groups will also become unavailable.

Follow these steps to delete the role:

Log on to the RAM console.
In the left-side navigation pane, choose Identities > Roles.
On the Roles page, enter AliyunServiceRoleForPaiEasManageCustomerClusters in the search box to find the role.
On the Roles page, find the RAM role that you want to delete and click Delete Role in the Actions column.
In the Delete Role dialog box, enter the RAM role name and click Delete Role.