Platform For AI:Peran terkait layanan untuk kelompok sumber daya self-managed EAS

Latar Belakang

Peran terkait layanan AliyunServiceRoleForPaiEasManageCustomerClusters adalah Peran RAM yang memungkinkan EAS mengakses layanan cloud lainnya saat Anda menggunakan kelompok sumber daya self-managed. Untuk informasi selengkapnya mengenai peran terkait layanan, lihat Service-linked roles.

EAS menggunakan peran ini untuk mengakses PrivateLink, VPC, ECS, ACK, SLS, dan PrivateZone.

Izin AliyunServiceRoleForPaiEasManageCustomerClusters

AliyunServiceRoleForPaiEasManageCustomerClusters memiliki izin untuk mengakses layanan cloud berikut:

• Izin PrivateLink

  {
        "Action": [
          "privatelink:OpenPrivateLinkService",
          "privatelink:CheckProductOpen",
          "privatelink:ListVpcEndpointServices",
          "privatelink:CreateVpcEndpoint",
          "privatelink:ListVpcEndpoints",
          "privatelink:UpdateVpcEndpointAttribute",
          "privatelink:GetVpcEndpointAttribute",
          "privatelink:ListVpcEndpointSecurityGroups",
          "privatelink:AttachSecurityGroupToVpcEndpoint",
          "privatelink:DetachSecurityGroupFromVpcEndpoint",
          "privatelink:AddZoneToVpcEndpoint",
          "privatelink:RemoveZoneFromVpcEndpoint",
          "privatelink:ListVpcEndpointZones",
          "privatelink:DeleteVpcEndpoint"
        ],
        "Resource": "*",
        "Effect": "Allow"
      }

• Izin VPC

  {
        "Action": [
          "vpc:DescribeVpcs",
          "vpc:DescribeVpcAttribute",
          "vpc:DescribeVSwitches",
          "vpc:DescribeVSwitchAttributes"
        ],
        "Resource": "*",
        "Effect": "Allow"
      }

• Izin ECS

  {
        "Action": [
          "ecs:DescribeSecurityGroups",
          "ecs:CreateSecurityGroup",
          "ecs:DeleteSecurityGroup",
          "ecs:AuthorizeSecurityGroup",
          "ecs:AuthorizeSecurityGroupEgress",
          "ecs:RevokeSecurityGroup",
          "ecs:RevokeSecurityGroupEgress"
        ],
        "Resource": "*",
        "Effect": "Allow"
      }

• Izin ACK

  {
        "Action": [
          "cs:DescribeClusterDetail",
          "cs:DescribeClusterUserKubeconfig"
        ],
        "Resource": "*",
        "Effect": "Allow"
      }

• Izin SLS

  {
        "Action": [
          "log:GetIndex",
          "log:GetConfig",
          "log:GetLogStore",
          "log:GetProject",
          "log:GetLogStoreLogs",
          "log:GetMachineGroup",
          "log:CreateConfig",
          "log:CreateIndex",
          "log:CreateLogStore",
          "log:CreateMachineGroup",
          "log:CreateProject",
          "log:DeleteConfig",
          "log:DeleteIndex",
          "log:DeleteLogStore",
          "log:DeleteMachineGroup",
          "log:DeleteProject",
          "log:ApplyConfigToGroup"
        ],
        "Resource":  [
          "acs:log:*:*:project/*/logstore/eas-*",
          "acs:log:*:*:project/eas-*"
        ],
        "Effect": "Allow"
      }

• Izin PrivateZone

  {
        "Action": [
          "pvtz:AddZone",
          "pvtz:BindZoneVpc",
          "pvtz:AddZoneRecord",
          "pvtz:DeleteZone"
        ],
        "Resource": "*",
        "Effect": "Allow"
      }

Hapus AliyunServiceRoleForPaiEasManageCustomerClusters

Jika Anda menghapus AliyunServiceRoleForPaiEasManageCustomerClusters karena alasan keamanan, Anda tidak dapat lagi menggunakan kelompok sumber daya self-managed untuk men-deploy atau memperbarui layanan. Layanan yang sudah ada dan menggunakan kelompok sumber daya tersebut juga akan menjadi tidak tersedia.

Ikuti langkah-langkah berikut untuk menghapus peran tersebut:

1. Masuk ke RAM console.

2. Di panel navigasi sebelah kiri, pilih Identities > Roles.

3. Di halaman Roles, masukkan AliyunServiceRoleForPaiEasManageCustomerClusters di kotak pencarian untuk menemukan peran tersebut.

4. Di halaman Roles, temukan Peran RAM yang ingin Anda hapus, lalu klik Delete Role di kolom Actions.

5. Di kotak dialog Delete Role, masukkan nama Peran RAM tersebut dan klik Delete Role.