PolarDB:PolarDB-X service-linked role

Background

The PolarDB-X service-linked role, AliyunServiceRoleForPolarDBX, is a RAM role that PolarDB-X assumes in certain scenarios to access other cloud services and perform specific functions. For more information about service-linked roles, see Service-linked roles.

Use cases for AliyunServiceRoleForPolarDBX

Some features of PolarDB-X require a service-linked role to access resources in other cloud services.

• The SQL audit and analysis feature requires access to the Log Service cloud service.

• AI features, such as intelligent inspection and virtual nodes (VNodes), require access to the Container Service for Kubernetes, ECS, VPC, PolarDB for Xscale, and DAS cloud services.

• The one-click migration of RDS MySQL to PolarDB-X feature requires access to the DTS cloud service.

AliyunServiceRoleForPolarDBX

• Role name: AliyunServiceRoleForPolarDBX

• Permission policy: AliyunServiceRolePolicyForPolarDBX

• Permissions:

  {
    "Statement": [
      {
        "Action": [
          "polardbx:DescribeDBPerformance",
          "polardbx:DescribeBackupPolicy",
          "polardbx:DescribeBackupSetList",
          "polardbx:DescribeDBInstanceTopology",
          "polardbx:DescribeDBInstances",
          "polardbx:DescribeDBInstanceAttribute",
          "polardbx:DescribeDBInstanceSSL",
          "polardbx:DescribeDBInstanceTDE",
          "polardbx:DescribeSecurityIps",
          "polardbx:DescribeSqlLogConfig",
          "polardbx:DescribeTasks",
          "polardbx:Chat",
          "polardbx:DescribeCustomEndpointList",
          "polardbx:DescribeAccountList",
          "polardbx:DescribeDBInstanceHA",
          "polardbx:DescribeDBInstanceConfig",
          "polardbx:DescribeCharacterSet",
          "polardbx:DescribeStoragePoolInfo",
          "polardbx:DescribeDbList",
          "polardbx:DescribeShowStorageInfo",
          "polardbx:DescribeParameters",
          "polardbx:DescribeParameterTemplates",
          "polardbx:DescribeCdcInfo",
          "polardbx:DescribeColumnarInfo",
          "polardbx:DescribeColumnarVersionList",
          "polardbx:DescribeColumnarClassList",
          "polardbx:DescribeAvailableCrossRegions",
          "polardbx:DescribeEnabledCrossRegions",
          "polardbx:DescribeBinaryLogList"
        ],
        "Resource": "*",
        "Effect": "Allow"
      },
      {
        "Action": [
          "log:GetProject",
          "log:ListLogStores",
          "log:GetIndex",
          "log:CreateProject",
          "log:GetLogStore",
          "log:CreateLogStore",
          "log:CreateIndex",
          "log:CreateDashboard",
          "log:CreateSavedSearch",
          "log:UpdateDashboard",
          "log:UpdateSavedSearch",
          "log:UpdateIndex",
          "dts:CreateDtsInstance",
          "dts:ConfigureDtsJob",
          "dts:StartDtsJob",
          "dts:DescribePreCheckStatus",
          "dts:DescribeDtsJobDetail",
          "dts:DescribeDtsJobs",
          "dts:ModifyDtsJob",
          "dts:SuspendDtsJob",
          "dts:StopDtsJob",
          "dts:DeleteDtsJob",
          "dts:CheckDefaultRole",
          "dts:ReverseTwoWayDirection"
        ],
        "Resource": "*",
        "Effect": "Allow"
      },
      {
        "Action": [
          "log:PostLogStoreLogs"
        ],
        "Resource": "acs:log:*:*:project/*/logstore/polardbx-sqlaudit-log",
        "Effect": "Allow"
      },
      {
        "Effect": "Allow",
        "Action": [
          "kms:GenerateAndExportDataKey",
          "kms:GenerateDataKey",
          "kms:GenerateDataKeyWithoutPlaintext"
        ],
        "Resource": "*"
      },
      {
        "Action": [
          "vpc:DescribeVpcAttribute",
          "vpc:DescribeVSwitches",
          "vpc:DescribeVSwitchAttributes",
          "vpc:DescribeVSwitches",
          "vpc:DescribeVpcs",
          "vpc:*Eip*",
          "vpc:*HighDefinitionMonitor*",
          "vpc:*PublicIpAddressPool*",
          "vpc:*HighDefinitionMonitor*",
          "ecs:CreateNetworkInterface",
          "ecs:DeleteNetworkInterface",
          "ecs:DescribeNetworkInterfaces",
          "ecs:CreateNetworkInterfacePermission",
          "ecs:DescribeNetworkInterfacePermissions",
          "ecs:DeleteNetworkInterfacePermission",
          "ecs:DescribeImages",
          "ecs:ModifyImageSharePermission",
          "ecs:CreateSecurityGroup",
          "ecs:DeleteSecurityGroup",
          "ecs:DescribeSecurityGroupAttribute",
          "ecs:DescribeSecurityGroups",
          "ecs:ModifySecurityGroupAttribute",
          "ecs:AuthorizeSecurityGroup",
          "ecs:AuthorizeSecurityGroupEgress",
          "ecs:RevokeSecurityGroup",
          "ecs:RevokeSecurityGroupEgress",
          "cs:DescribeClustersForRegion",
          "cs:DescribeClustersV1",
          "cs:DescribeClusterDetail",
          "cs:GetClusters",
          "cs:DescribeClusterDetail"
        ],
        "Resource": "*",
        "Effect": "Allow"
      },
      {
        "Action": [
          "hdm:Chat",
          "hdm:GetDasAgentSSE"
        ],
        "Effect": "Allow",
        "Resource": [
          "*"
        ]
      },
      {
        "Action": [
          "hdm:Get*",
          "hdm:Describe*",
          "hdm:Query*",
          "hdm:Support*"
        ],
        "Effect": "Allow",
        "Resource": "acs:polardbx:*:*:*"
      }
    ]
  }

Delete AliyunServiceRoleForPolarDBX

Before deleting the PolarDB-X service-linked role AliyunServiceRoleForPolarDBX, you must understand the consequences. After you delete the role, the features that depend on it, such as SQL audit and analysis, AI features, and one-click migration of RDS MySQL to PolarDB-X, will stop functioning.

For detailed steps, see Delete a service-linked role.