Security Center service-linked roles - scenarios and permissions - Security Center

Security Center uses service-linked roles (SLRs) to access other Alibaba Cloud services in specific scenarios. Learn about each SLR, its use cases, and how to create, view, or delete it.

A service-linked role (SLR) is a RAM role whose trusted entity is an Alibaba Cloud service. Security Center uses SLRs to access other cloud services and resources.

SLRs are usually created automatically when you perform a related operation. If automatic creation fails, or if Security Center does not support automatic creation for an SLR, you must create the SLR manually.

RAM assigns an immutable system policy to each SLR. View policy details from theSystem policy reference.

Scenarios

Security Center provides the following SLRs.

Service-linked role	Service identifier	Scenarios
AliyunServiceRoleForSas	sas.aliyuncs.com	Accesses Container Registry and ApsaraDB RDS to detect security risks in container assets. Accesses VPC and ECS resources for the cloud honeypot feature to detect attacks and trace attack sources. Accesses ECS resources for brute-force attack protection. Accesses Simple Log Service for log query and analysis. Accesses ECS instances, and ECS images. The agentless detection feature shares images with the Security Center service account for security scanning. Accesses Cloud Backup and ECS for anti-ransomware protection and data backup. Accesses Resource Directory for management and delegated administrator accounts. Enables the multi-account security management feature to centrally manage security risks across member accounts. Accesses OSS resources for malicious file detection to scan files for viruses. Accesses Key Management Service (KMS) resources to decrypt and scan OSS files encrypted with SSE-KMS.
AliyunServiceRoleForSasCloudSiem	cloudsiem.sas.aliyuncs.com	Accesses VPC and Cloud Firewall resources for threat analysis and response to collect and deliver logs, handle events, and analyze threats. This provides capabilities such as centralized alert management and threat source analysis.
AliyunServiceRoleForSasCspm	cspm.sas.aliyuncs.com	Accesses ActionTrail resources for Cloud Security Posture Management (CSPM) configuration checks.
AliyunServiceRoleForSasRd	rd.sas.aliyuncs.com	In multi-account scenarios, allows a delegated administrator account to access member account consoles in a resource directory. Enables centralized security configuration and real-time risk monitoring across member accounts.
AliyunServiceRoleForSasSecurityLake	security-lake.sas.aliyuncs.com	Accesses OSS and Data Lake Formation (DLF) resources for the threat analysis cold data feature to manage log data and run interactive queries.

Create a service-linked role

AliyunServiceRoleForSas

The system automatically creates this SLR when you first use one of the following features and grant permissions.

Module	Features
Risk governance	Malicious file detection Log analysis
Container security	Container assets Container image scan Container image signing Threat detection for Kubernetes
Host security	Cloud honeypot Brute-force attacks protection Agentless detection Anti-ransomware Virus scan Adaptive threat detection
Other configurations	Task Hub Multi-account security management

AliyunServiceRoleForSasCloudSiem

Created automatically when you first use threat analysis and response and grant permissions.Grant the threat analysis and response feature the permissions to access Alibaba Cloud resources.

AliyunServiceRoleForSasCspm

Created automatically when you first use Cloud Security Posture Management and grant permissions.

Note

Since November 21, 2022 (UTC+8), the CSPM access policy migrated from AliyunServiceRoleForSas to AliyunServiceRoleForSasCspm. To migrate, go to the Cloud Security Posture Management page. In the Role Policy Migration Reminder dialog box, click OK, then click Authorize Now to authorize.

AliyunServiceRoleForSasRd

Created automatically under a member account when a management or delegated administrator account uses multi-account security management to add the member to the monitored list.

AliyunServiceRoleForSasSecurityLake

Created automatically when you first use the threat analysis cold data feature and grant permissions.

View a service-linked role

After creating an SLR, view its details on the Roles page of the RAM console:

Basic information

The Basic Information section shows the role name, creation time, ARN, and description.
Access policy

On the Permissions tab, click the policy name to view the policy document.

Note
SLR access policies are only visible from the role details page, not from the Policies page.
Trust policy

The Trust Policy tab shows which Alibaba Cloud service can assume the role. Check the Service field.

View a RAM role.

Delete a service-linked role

Important

Deleting an SLR disables all features that depend on it.

If you no longer use Security Center for an extended period or before you log off from your Alibaba Cloud account, you may need to manually delete the SLR. To delete an SLR, go to the RAM console. Delete a RAM role.

References

Service-linked roles.