ApsaraDB for SelectDB:Rôle lié au service

Contexte

AliyunServiceRoleForSelectDB est un rôle RAM endossé par ApsaraDB for SelectDB afin d'accéder à d'autres services cloud pour votre compte. Pour plus d'informations sur les rôles liés au service, consultez Rôles liés au service.

Cas d'usage

Le rôle AliyunServiceRoleForSelectDB accorde l'accès aux services suivants :

• Accès à ECS : les instances ApsaraDB for SelectDB utilisent ECS pour obtenir et gérer des ressources de calcul.

• Accès au VPC : ApsaraDB for SelectDB s'appuie sur le VPC pour provisionner et administrer son environnement réseau.

• Accès au SLB : ce service est exploité par ApsaraDB for SelectDB pour assurer la répartition de charge.

• Accès à ARMS : ApsaraDB for SelectDB recourt à ARMS pour fournir des capacités de surveillance et d'alerte.

AliyunServiceRoleForSelectDB

• Nom du rôle : AliyunServiceRoleForSelectDB

• Politique : AliyunServiceRolePolicyForSelectDB

• Permissions :

  {
    "Statement": [
      {
        "Action": [
          "log:GetProject",
          "log:ListProject",
          "log:GetCursor",
          "log:GetCursorTime",
          "log:GetLogs",
          "log:GetHistograms",
          "log:GetContextLogs",
          "log:PullLogs",
          "log:GetLogStoreLogs",
          "log:GetLogStoreHistogram",
          "log:GetLogStore",
          "log:ListLogStores",
          "log:GetCursorOrData",
          "log:ListShards",
          "log:GetConfig",
          "log:ListConfig",
          "log:GetShipperStatus",
          "log:GetCheckPoint",
          "log:HeartBeat",
          "log:UpdateCheckPoint",
          "log:PostLogStoreLogs",
          "log:CreateConsumerGroup",
          "log:UpdateConsumerGroup",
          "log:DeleteConsumerGroup",
          "log:ListConsumerGroup",
          "log:ConsumerGroupUpdateCheckPoint",
          "log:ConsumerGroupHeartBeat",
          "log:GetConsumerGroupCheckPoint",
          "log:CreateExport",
          "log:GetExport",
          "log:ListExport",
          "log:UpdateExport",
          "log:DeleteExport",
          "log:CreateJob",
          "log:GetJob",
          "log:ListJobs",
          "log:UpdateJob",
          "log:DeleteJob",
          "ecs:AttachNetworkInterface",
          "ecs:AuthorizeSecurityGroup",
          "ecs:CreateNetworkInterface",
          "ecs:CreateNetworkInterfacePermission",
          "ecs:CreateRouteEntry",
          "ecs:CreateSecurityGroup",
          "ecs:DeleteNetworkInterface",
          "ecs:DeleteNetworkInterfacePermission",
          "ecs:DeleteRouteEntry",
          "ecs:DeleteSecurityGroup",
          "ecs:DescribeInstanceAttribute",
          "ecs:DescribeInstanceStatus",
          "ecs:DescribeInstanceTypeFamilies",
          "ecs:DescribeInstanceTypes",
          "ecs:DescribeInstances",
          "ecs:DescribeInstancesFullStatus",
          "ecs:DescribeNetworkInterfaceAttribute",
          "ecs:DescribeNetworkInterfaces",
          "ecs:DescribeRegions",
          "ecs:DescribeSecurityGroupAttribute",
          "ecs:DescribeSecurityGroups",
          "ecs:DescribeZones",
          "ecs:DetachNetworkInterface",
          "ecs:ListTagResources",
          "ecs:ModifyNetworkInterfaceAttribute",
          "ecs:RevokeSecurityGroup",
          "ecs:TagResources",
          "ecs:UntagResources",
          "vpc:CreateRouteEntry",
          "vpc:DeleteRouteEntry",
          "vpc:DescribeRegions",
          "vpc:DescribeVSwitchAttributes",
          "vpc:DescribeVSwitches",
          "vpc:DescribeVpcAttribute",
          "vpc:DescribeVpcs",
          "vpc:DescribeZones",
          "vpc:ListTagResources",
          "vpc:ModifyBypassToaAttribute",
          "vpc:TagResources",
          "vpc:UntagResources",
          "selectdb:DescribeSecurityIPList",
          "selectdb:ModifySecurityIPList"
        ],
        "Resource": "*",
        "Effect": "Allow"
      },
      {
        "Action": "ram:DeleteServiceLinkedRole",
        "Resource": "*",
        "Effect": "Allow",
        "Condition": {
          "StringEquals": {
            "ram:ServiceName": "selectdb.aliyuncs.com"
          }
        }
      },
      {
        "Action": [
          "kms:Listkeys",
          "kms:Listaliases",
          "kms:ListResourceTags",
          "kms:DescribeKey",
          "kms:UntagResource",
          "kms:TagResource",
          "kms:DescribeAccountKmsStatus"
        ],
        "Resource": "*",
        "Effect": "Allow"
      },
      {
        "Action": [
          "kms:Encrypt",
          "kms:Decrypt",
          "kms:GenerateDataKey"
        ],
        "Resource": "*",
        "Effect": "Allow",
        "Condition": {
          "StringEqualsIgnoreCase": {
            "kms:tag/acs:selectdb:instance-encryption": "true"
          }
        }
      },
      {
        "Action": [
          "rds:ModifySecurityIps",
          "rds:DescribeDBInstanceNetInfo",
          "rds:DescribeDBInstanceIPArrayList"
        ],
        "Resource": "*",
        "Effect": "Allow"
      },
      {
        "Action": [
          "arms:CheckServiceStatus",
          "arms:OpenArmsService",
          "arms:GetPrometheusApiToken",
          "arms:OpenVCluster",
          "arms:ListDashboards"
        ],
        "Resource": "*",
        "Effect": "Allow"
      },
      {
        "Action": [
          "slb:AddBackendServers",
          "slb:AddTags",
          "slb:AddVServerGroupBackendServers",
          "slb:CreateLoadBalancer",
          "slb:CreateLoadBalancerForCloudService",
          "slb:CreateLoadBalancerHTTPListener",
          "slb:CreateLoadBalancerHTTPSListener",
          "slb:CreateLoadBalancerTCPListener",
          "slb:CreateLoadBalancerUDPListener",
          "slb:CreateVServerGroup",
          "slb:DeleteLoadBalancer",
          "slb:DeleteLoadBalancerListener",
          "slb:DeleteVServerGroup",
          "slb:DescribeTags",
          "slb:DescribeVServerGroups",
          "slb:DescribeLoadBalancers",
          "slb:DescribeVServerGroupAttribute",
          "slb:DescribeLoadBalancerAttribute",
          "slb:DescribeLoadBalancerHTTPSListenerAttribute",
          "slb:DescribeLoadBalancerHTTPListenerAttribute",
          "slb:DescribeLoadBalancerListeners",
          "slb:DescribeLoadBalancerTCPListenerAttribute",
          "slb:DescribeLoadBalancerUDPListenerAttribute",
          "slb:ModifyLoadBalancerInstanceSpec",
          "slb:ModifyLoadBalancerInternetSpec",
          "slb:ModifyVServerGroupBackendServers",
          "slb:RemoveBackendServers",
          "slb:RemoveTags",
          "slb:DescribeAccessControlLists",
          "slb:RemoveVServerGroupBackendServers",
          "slb:SetLoadBalancerHTTPListenerAttribute",
          "slb:SetLoadBalancerHTTPSListenerAttribute",
          "slb:SetLoadBalancerTCPListenerAttribute",
          "slb:SetLoadBalancerUDPListenerAttribute",
          "slb:SetLoadBalancerModificationProtection",
          "slb:SetLoadBalancerDeleteProtection",
          "slb:SetVServerGroupAttribute",
          "slb:ServiceManagedControl",
          "slb:StartLoadBalancerListener",
          "slb:StopLoadBalancerListener",
          "slb:DeleteAccessControlList",
          "slb:CreateAccessControlList",
          "slb:DescribeAccessControlListAttribute",
          "slb:AddAccessControlListEntry",
          "slb:RemoveAccessControlListEntry"
        ],
        "Resource": "*",
        "Effect": "Allow"
      },
      {
        "Action": [
          "pvtz:DescribeUserServiceStatus",
          "pvtz:DescribeZones"
        ],
        "Resource": "*",
        "Effect": "Allow"
      },
      {
        "Effect": "Allow",
        "Action": [
          "bssapi:QueryAvailableInstances"
        ],
        "Resource": "*"
      },
      {
        "Action": "bss:DescribeAcccount",
        "Resource": "*",
        "Effect": "Allow"
      },
      {
        "Effect": "Allow",
        "Action": [
          "bssapi:CreateInstance"
        ],
        "Resource": "*",
        "Condition": {
          "StringEquals": {
            "bssapi:ProductCode": "pvtz",
            "bssapi:ProductType": [
              "pvtzpost"
            ]
          }
        }
      },
      {
        "Action": "ram:CreateServiceLinkedRole",
        "Resource": "*",
        "Effect": "Allow",
        "Condition": {
          "StringEquals": {
            "ram:ServiceName": "eipaccess.slb.aliyuncs.com"
          }
        }
      }
    ],
    "Version": "1"
  }

Création du rôle lié au service

Si vous n'avez pas encore créé le rôle lié au service AliyunServiceRoleForSelectDB pour ApsaraDB for SelectDB, la boîte de dialogue Activate ApsaraDB for SelectDB s'affiche à chaque ouverture de la console ApsaraDB for SelectDB. Cliquez sur OK pour que le système crée automatiquement ce rôle.

Suppression du rôle lié au service

Pour supprimer le rôle lié au service AliyunServiceRoleForSelectDB, accédez à la console RAM. Consultez Supprimer un rôle RAM pour obtenir la procédure détaillée.