Managed Service for Prometheus uses a service-linked role named AliyunServiceRoleForARMS to access resources in other Alibaba Cloud services on your behalf. This topic covers the role's purpose, its permissions, and how to delete it.
What is a service-linked role?
A service-linked role is a Resource Access Management (RAM) role that only a specific Alibaba Cloud service can assume. The service predefines the role's permissions, and no one can modify them. This guarantees that the service has exactly the access it needs -- nothing more, nothing less.
For more information, see Service-linked roles.
Role lifecycle
Automatic creation
When you enable Prometheus monitoring, the service automatically creates AliyunServiceRoleForARMS in your account. No manual setup is needed.
Editing
You cannot edit the permissions of AliyunServiceRoleForARMS. Application Real-Time Monitoring Service (ARMS) owns and manages the role definition. You can view the role and its policies in the RAM console, but you cannot change them.
Deletion
You can manually delete the role if you no longer use Prometheus monitoring. See Delete the AliyunServiceRoleForARMS role for instructions.
Accessed services and permissions
Prometheus monitoring assumes AliyunServiceRoleForARMS to read and manage resources across four services:
| Service | Scope | What the role does |
|---|---|---|
| Container Service for Kubernetes (ACK) | acs:cs:*:*:cluster/* | Manage cluster configurations, scale nodes, and retrieve cluster logs |
| Log Service | * | Create and manage projects, Logstores, indexes, dashboards, and machine groups for storing and querying monitoring data |
| Elastic Compute Service (ECS) | * | Describe instances, disks, security groups, and network interfaces; run Cloud Assistant commands for agent management |
| Virtual Private Cloud (VPC) | * | Describe VPCs and vSwitches for network connectivity |
Permission details
AliyunServiceRoleForARMS includes the following policy actions. Use these details for security auditing.
Delete the AliyunServiceRoleForARMS role
Delete AliyunServiceRoleForARMS from your account if you no longer use Prometheus monitoring.
Uninstall the Prometheus agent from every Kubernetes cluster in your account before deleting this role. The role cannot be deleted while the agent is installed. For instructions, see Uninstall the Prometheus agent.
Impact of deletion:
Your Kubernetes clusters stop synchronizing to the cluster list in the ARMS console.
ARMS stops reading and writing monitoring data.
Procedure:
Log on to the RAM console.
In the left-side navigation pane, choose Identities > Roles.
On the Roles page, search for AliyunServiceRoleForARMS.
In the Actions column, click Delete.
In the Delete RAM Role dialog box, click OK.
FAQ
Why is the AliyunServiceRoleForARMS role not automatically created for my RAM user?
Your RAM user must have the required permissions to automatically create or delete the AliyunServiceRoleForARMS role. Attach the following policy to grant the permission:
{
"Statement": [
{
"Action": [
"ram:CreateServiceLinkedRole"
],
"Resource": "acs:ram:*:<your-account-id>:role/*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": [
"arms.aliyuncs.com"
]
}
}
}
],
"Version": "1"
}Replace <your-account-id> with your Alibaba Cloud account ID.