Server Migration Center (SMC) uses the service-linked role AliyunServiceRoleForSMC to access other Alibaba Cloud services and resources required for data migration.
A service-linked role is a Resource Access Management (RAM) role whose trusted entity is an Alibaba Cloud service. SMC assumes the service-linked role AliyunServiceRoleForSMC to access other Alibaba Cloud services and resources.
In most cases, the service-linked role is automatically created when you perform an operation. If automatic creation fails or is not supported, you must manually create the role.
RAM provides a system policy for each service-linked role. You cannot modify this policy. To view the policy details, go to the details page of the service-linked role. For more information, see AliyunSMCFullAccess.
Scenarios
The service-linked role AliyunServiceRoleForSMC allows SMC to access Elastic Compute Service (ECS) during data migration.
Required permissions for a RAM user to assume a service-linked role
If you want to create or delete a service-linked role as a RAM user, contact the administrator to grant the RAM user the AliyunSWASFullAccess permission. You can also add the following permissions in the Action statement of your custom policy:
-
Create a service-link role:
ram:CreateServiceLinkedRole -
Delete a service-linked role:
ram:DeleteServiceLinkedRole
For more information, see the Permissions to manage service-linked roles section of the "Service-linked roles" topic.
Create the service-linked role
SMC automatically creates the service-linked role AliyunServiceRoleForSMC when you import the information about a migration source. For more information, see Step 1: Import the information about a migration source.
After the service-linked role is created, SMC can assume the RAM role to access other Alibaba Cloud services. You may be charged for creating snapshots and ECS instances.
View the information about the service-linked role
After the service-linked role is created, you can view its details on the Roles page in the RAM console. Search for AliyunServiceRoleForSMC to find the role.
-
Basic information
In the Basic Information section of the role details page, you can view the role name, creation time, Alibaba Cloud Resource Name (ARN), and description.
-
Permission policy
On the Permissions tab of the role details page, click the policy name to view the permission policy and the cloud resources that SMC can access.
-
Trust policy
On the Trust Policy tab of the role details page, view the trust policy. A trust policy defines the trusted entities that can assume the RAM role. For a service-linked role, the trusted entity is a cloud service. Check the
Servicefield in the trust policy to identify the trusted entity.
For more information, see View a RAM role.
Delete the service-linked role
After the service-linked role is deleted, the features that depend on the role cannot be used. Proceed with caution.
If you no longer need to use SMC, you can manually delete the service-linked role in the RAM console. For more information, see Delete a RAM role.
Before you delete the service-linked role for SMC, you can use one of the following methods to delete the migration source that depends on the service-linked role:
-
Log on to the SMC console to delete a migration source.
For example, in the left-side navigation pane, choose , click the migration source ID, and click Delete Migration Source in the upper-right corner of the page.
-
Call the DeleteSourceServer operation to delete the migration source.