Service Catalog:Service-linked role

Scenarios

AliyunServiceRoleForServiceCatalog is a Resource Access Management (RAM) role that allows Service Catalog to access other cloud services. For more information, see Service-linked roles.

When you launch a product as an end user in Service Catalog, Service Catalog assumes the AliyunServiceRoleForServiceCatalog role to access Resource Orchestration Service (ROS) resources.

Permissions

Service-linked role: AliyunServiceRoleForServiceCatalog

Attached policy: AliyunServiceRolePolicyForServiceCatalog

This policy grants permissions to validate and preview ROS templates, check for risks in ROS templates, and query the details, events, and resources of ROS stacks.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ros:ValidateTemplate",
                "ros:PreviewStack",
                "ros:ListStackOperationRisks",
                "ros:GetStack",
                "ros:ListStackEvents",
                "ros:GetStackResource",
                "ros:ListStackResources"
            ],
            "Resource": "*"
        },
        {
            "Action": "ram:DeleteServiceLinkedRole",
            "Resource": "*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": "servicecatalog.aliyuncs.com"
                }
            }
        }
    ]
}

Create a service-linked role

When you activate Service Catalog for the first time, the service-linked role AliyunServiceRoleForServiceCatalog is automatically created.

Delete the service-linked role

Before you delete the AliyunServiceRoleForServiceCatalog role, you must terminate all product instances associated with it. Perform the following steps:

1. Terminate the associated product instances.

   For more information, see the Terminate a product instance section of the "Manage a product instance" topic.

2. Delete the service-linked role.

   For more information, see Delete a RAM role.