AliyunServiceRoleForVpn is a service-linked role that the system automatically creates when you first create a VPN gateway or an IPsec-VPN connection associated with a transit router. This role allows a VPN gateway to access cloud resources such as elastic network interfaces (ENIs) and security groups.
Background information
What is a service-linked role
A service-linked role (SLR) is a type of RAM role predefined by Alibaba Cloud to enable cross-service access. It has the following characteristics:
Bound to a specific cloud service: An SLR is a special type of RAM role that is bound to a specific Alibaba Cloud service.
Assumed only by the bound service: An SLR can be assumed only by the Alibaba Cloud service to which it is bound, and cannot be used by other identities.
Predefined by Alibaba Cloud: The role itself, the permissions it contains, and the trust policy of the role (which specifies the cloud services that can assume the role) are all predefined by the Alibaba Cloud service.
Maintenance-free: You do not need to manually configure and maintain the SLR.
Why do you need a service-linked role
Without service-linked roles, when a cloud service needs to access other cloud services, you must manually create a RAM role and configure complex permission policies and trust policies. This is not only cumbersome, but also prone to service exceptions or security risks caused by improper configuration. Service-linked roles effectively solve these problems:
Resolves the issue of cross-service authorized access on Alibaba Cloud.For example, the Cloud Config service needs to read information about your cloud resources (such as the resource list and resource configurations) to generate compliance reports, which requires access permissions to other cloud services such as ECS and RDS. By creating and assuming a service-linked role, the Cloud Config service can obtain the permissions required to perform its own functions.
Reduces configuration complexity and the risk of misoperations.The permission policy of a service-linked role is predefined by the Alibaba Cloud service, which ensures that each cloud service obtains only the minimum permissions required to complete its tasks, and you do not need to manually configure permissions. This helps improve account security and ensures the stable operation of cloud services.
For more information, see Service-linked roles.
Create AliyunServiceRoleForVpn
The system automatically creates AliyunServiceRoleForVpn when you first create a VPN gateway or an IPsec-VPN connection associated with a transit router. If this role already exists, the system does not create it again.
For more information about how to create a VPN gateway, see VPN gateway.
To create an IPsec-VPN connection, see Create an IPsec-VPN connection or Create a VPN connection.
The AliyunServiceRolePolicyForVpn policy is attached to AliyunServiceRoleForVpn and grants the following permissions:
{
"Version": "1",
"Statement": [
{
"Action": [
"vpc:DescribeVSwitchAttributes",
"vpc:TagResources",
"vpc:DescribeRouteTableList"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"ecs:CreateNetworkInterface",
"ecs:CreateSecurityGroup",
"ecs:AuthorizeSecurityGroup",
"ecs:RevokeSecurityGroup",
"ecs:DeleteSecurityGroup",
"ecs:JoinSecurityGroup",
"ecs:LeaveSecurityGroup",
"ecs:DescribeSecurityGroups",
"ecs:AttachNetworkInterface",
"ecs:DetachNetworkInterface",
"ecs:DeleteNetworkInterface",
"ecs:DescribeNetworkInterfaces",
"ecs:CreateNetworkInterfacePermission",
"ecs:DescribeNetworkInterfacePermissions",
"ecs:DeleteNetworkInterfacePermission",
"ecs:CreateSecurityGroupPermission",
"ecs:AuthorizeSecurityGroupPermission",
"ecs:RevokeSecurityGroupPermission",
"ecs:JoinSecurityGroupPermission",
"ecs:DeleteSecurityGroupPermission",
"ecs:LeaveSecurityGroupPermission",
"ecs:DescribeSecurityGroupPermissions",
"ecs:AttachNetworkInterfacePermissions",
"ecs:DetachNetworkInterfacePermissions",
"ecs:AssignPrivateIpAddresses",
"ecs:UnassignPrivateIpAddresses",
"ecs:DescribeNetworkInterfaceAttribute"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": "ram:DeleteServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": "vpn.aliyuncs.com"
}
}
}
]
}Delete AliyunServiceRoleForVpn
You can delete AliyunServiceRoleForVpn only after all VPN gateways and IPsec-VPN connections are removed from your Alibaba Cloud account. For more information, see the following sections of related topics:
FAQ
Why can't a RAM user create AliyunServiceRoleForVpn?
By default, an Alibaba Cloud account is authorized to create AliyunServiceRoleForVpn. To allow a Resource Access Management (RAM) user to create this role, use the Alibaba Cloud account to grant the required permissions.
Create a custom policy with the following content as an example and attach it to the RAM user. For more information, see Create a custom policy and Manage permissions for a RAM role.
{
"Statement": [
{
"Action": "ram:CreateServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": "vpn.aliyuncs.com"
}
}
}
],
"Version": "1"
}