Resource Access Management:Access Analyzer service-linked role

Background

A service-linked role (SLR) is a type of RAM role that is associated with a specific Alibaba Cloud service. In certain scenarios, a cloud service needs permissions to access other cloud services to perform its functions. By using a service-linked role, you can securely authorize a cloud service to access other resources on your behalf without having to manually create and manage the role. For more information, see Service-linked roles.

Use cases

The Access Analyzer service-linked role (AliyunServiceRoleForAccessAnalyzer) applies to the following scenarios:

• External access analysis

  When you create an external access analyzer to identify resources in your account that are accessed by external accounts, Access Analyzer needs to read the bucket policies, ACLs, and trust policies of RAM roles in your account to identify resources that are accessible to external accounts.

• Over-privileged access analysis

  When you create an over-privileged access analyzer to identify RAM identities that have excessive permissions, Access Analyzer needs to read the RAM identity configurations (users, roles, permission policies, logon settings, and AccessKey pairs) and combine them with ActionTrail activity logs to analyze the actual usage of identities. This helps discover super administrators, privileged identities, inactive identities, and over-privileged identities.

Access Analyzer obtains these read-only permissions through the service-linked role to analyze permission information and ActionTrail activity logs.

Permission policy

Role name: AliyunServiceRoleForAccessAnalyzer

Permission policy: AliyunServiceRolePolicyForAccessAnalyzer

Policy content:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "oss:GetBucketPolicy",
        "oss:GetBucketAcl",
        "oss:ListBuckets",
        "oss:GetBucketPublicAccessBlock",
        "oss:GetBucketPolicyStatus",
        "ram:GetPolicy",
        "ram:GetRole",
        "ram:ListUsers",
        "ram:ListRoles",
        "ram:GetLoginProfile",
        "ram:ListAccessKeys",
        "ram:ListEntitiesForPolicy",
        "ram:ListUsersForGroup",
        "ram:GenerateServiceLastAccessedDetails",
        "ram:GetServiceLastAccessedDetails"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "actiontrail:CreateServiceTrail",
        "actiontrail:DeleteServiceTrail",
        "actiontrail:GetServiceTrail",
        "actiontrail:GetServiceTrailDeliveryStatus"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "ram:DeleteServiceLinkedRole",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "accessanalyzer.aliyuncs.com"
        }
      }
    }
  ]
}

The preceding permission policy contains three groups of permissions:

• The first group of permissions allows Access Analyzer to read OSS bucket policies, ACLs, and public access block configurations, as well as RAM user and role configurations (logon settings, AccessKey pairs, and permission policy attachments) for external access analysis and over-privileged access analysis.

• The second group of permissions allows Access Analyzer to create and manage ActionTrail service trails to collect activity logs for analyzing the permission usage of identities.

• The third group of permissions allows Access Analyzer to automatically delete the service-linked role after all analyzers are deleted.

Create the service-linked role

The Access Analyzer service-linked role (AliyunServiceRoleForAccessAnalyzer) is automatically created in the following scenarios:

• When you create an analyzer for the first time in the Access Analyzer console, the service-linked role is automatically created.

• When you create an analyzer by calling an API operation, the service-linked role is automatically created.

The creation behavior of the service-linked role varies depending on the scope of the analyzer:

• Account-scoped analyzers: The system creates the service-linked role in the current account.

• Resource directory-scoped analyzers: The system creates the service-linked role in all member accounts of the resource directory.

For the specific steps to create an analyzer, see Detect over-privileged identities and Identify external access.

View the service-linked role

After the service-linked role (AliyunServiceRoleForAccessAnalyzer) is created, you can view the basic information, trust policy, and permission policy of the role in the RAM console.

1. Log on to the RAM console.

2. In the left-side navigation pane, choose Identities > Roles.

3. In the role list, search for AliyunServiceRoleForAccessAnalyzer and click the role name to go to the role details page.

4. In the basic information section on the role details page, view the role ID, creation time, and other information.

5. Click the Trust Policy Management tab and check whether the Service field in the trust policy contains accessanalyzer.aliyuncs.com.

6. View the permission policy of the role:

   1. On the role details page, click the Permissions tab.

   2. In the policy list, find AliyunServiceRolePolicyForAccessAnalyzer and click the policy name.

   3. View the policy content to understand the specific authorization scope.

Delete the service-linked role

If you need to delete AliyunServiceRoleForAccessAnalyzer (the service-linked role), you must first ensure that the corresponding service is no longer in use.

FAQ