ApsaraDB RDS:Manage service-linked roles by using Terraform

Resources

The following Terraform resources are used in this topic:

Create a service-linked role

1. Create a working directory and a file named main.tf in the directory. Add the following configuration:

   resource "alicloud_rds_service_linked_role" "default" {
     service_name = "AliyunServiceRoleForRdsPgsqlOnEcs"
   }

   Note

   For more information about service-linked role (SLR) authorization, see Service-linked roles.

2. Initialize Terraform:

   terraform init

   Expected output:

   Initializing the backend...
   
   Initializing provider plugins...
   - Checking for available provider plugins...
   - Downloading plugin for provider "alicloud" (hashicorp/alicloud) 1.90.1...
   ...
   
   You may now begin working with Terraform. Try running "terraform plan" to see
   any changes that are required for your infrastructure. All Terraform commands
   should now work.
   
   If you ever set or change modules or backend configuration for Terraform,
   rerun this command to reinitialize your working directory. If you forget, other
   commands will detect it and remind you to do so if necessary.

3. Preview the changes:

   terraform plan

4. Create the resources:

   terraform apply

   Enter yes when prompted and press Enter. Expected output:

   Do you want to perform these actions?
     Terraform will perform the actions described above.
     Only 'yes' will be accepted to approve.
   
     Enter a value: yes
   
   alicloud_rds_service_linked_role.default: Creating...
   alicloud_rds_service_linked_role.default: Creation complete after 3s [id=AliyunServiceRoleForRdsPgsqlOnEcs]

5. Verify the result:

   terraform show

   Expected output:

   # alicloud_rds_service_linked_role.default:
   resource "alicloud_rds_service_linked_role" "default" {
       arn          = "acs:ram::140****:role/aliyunserviceroleforrdspgsqlonecs"
       id           = "AliyunServiceRoleForRdsPgsqlOnEcs"
       role_id      = "399****"
       role_name    = "AliyunServiceRoleForRdsPgsqlOnEcs"
       service_name = "AliyunServiceRoleForRdsPgsqlOnEcs"
   }

Query the created service-linked role

1. Create a working directory and a file named main.tf in the directory. Add the following configuration:

   data "alicloud_resource_manager_roles" "slr" {
   }

2. Initialize Terraform, create an execution plan, and apply the configuration:

   terraform init
   terraform plan
   terraform apply

   Enter yes when prompted and press Enter. Expected output:

   data.alicloud_resource_manager_roles.slr: Reading...
   data.alicloud_resource_manager_roles.slr: Read complete after 2s [id=163141****]
   
   No changes. Your infrastructure matches the configuration.
   
   Terraform has compared your real infrastructure against your configuration and found no differences, so no changes are
   needed.
   
   Apply complete!  Resources: 0 added, 0 changed, 0 destroyed.

3. Verify the result:

   terraform show

   Expected output (truncated):

   # data.alicloud_resource_manager_roles.slr:
   data "alicloud_resource_manager_roles" "slr" {
       enable_details = false
       id             = "163141****"
       ids            = [
           "AliyunActionTrailDefaultRole",
           "AliyunAdamAccessingDatabaseRole",
           ...
       ]
       names          = [
           "AliyunActionTrailDefaultRole",
           "AliyunAdamAccessingDatabaseRole",
           ...
       ]
       roles          = [
           {
               arn                         = "acs:ram::140****:role/aliyunactiontraildefaultrole"
               assume_role_policy_document = ""
               description = "By default, ActionTrail assumes this role to access your cloud resources."
               id                          = "AliyunActionTrailDefaultRole"
               max_session_duration        = 3600
               role_id                     = "394****"
               role_name                   = "AliyunActionTrailDefaultRole"
               update_date                 = "2019-05-07T02:29:41Z"
           },
           ...
       ]
   }

Complete sample code

provider "alicloud" {
  region = "cn-hangzhou"
}

# Create the service-linked role for RDS PostgreSQL
resource "alicloud_rds_service_linked_role" "default" {
  service_name = "AliyunServiceRoleForRdsPgsqlOnEcs"
}

# Query all service-linked roles
data "alicloud_resource_manager_roles" "slr" {
}