ApsaraDB for SelectDB:Função vinculada ao service

Contexto

A função AliyunServiceRoleForSelectDB é uma função do RAM assumida pelo ApsaraDB for SelectDB para acessar outros serviços de nuvem em seu nome. Para obter mais informações sobre funções vinculadas ao service, consulte Service-linked roles.

Casos de uso

A AliyunServiceRoleForSelectDB concede acesso aos seguintes serviços:

• Acesso ao ECS: as instâncias do ApsaraDB for SelectDB usam o ECS para obter e gerenciar recursos de computação.

• Acesso à VPC: o ApsaraDB for SelectDB usa a VPC para provisionar e gerenciar o ambiente de rede.

• Acesso ao SLB: o ApsaraDB for SelectDB usa o SLB para fornecer balanceamento de carga.

• Acesso ao ARMS: o ApsaraDB for SelectDB usa o ARMS para habilitar monitoramento e alertas.

AliyunServiceRoleForSelectDB

• Nome da função: AliyunServiceRoleForSelectDB

• Política: AliyunServiceRolePolicyForSelectDB

• Permissões:

  {
    "Statement": [
      {
        "Action": [
          "log:GetProject",
          "log:ListProject",
          "log:GetCursor",
          "log:GetCursorTime",
          "log:GetLogs",
          "log:GetHistograms",
          "log:GetContextLogs",
          "log:PullLogs",
          "log:GetLogStoreLogs",
          "log:GetLogStoreHistogram",
          "log:GetLogStore",
          "log:ListLogStores",
          "log:GetCursorOrData",
          "log:ListShards",
          "log:GetConfig",
          "log:ListConfig",
          "log:GetShipperStatus",
          "log:GetCheckPoint",
          "log:HeartBeat",
          "log:UpdateCheckPoint",
          "log:PostLogStoreLogs",
          "log:CreateConsumerGroup",
          "log:UpdateConsumerGroup",
          "log:DeleteConsumerGroup",
          "log:ListConsumerGroup",
          "log:ConsumerGroupUpdateCheckPoint",
          "log:ConsumerGroupHeartBeat",
          "log:GetConsumerGroupCheckPoint",
          "log:CreateExport",
          "log:GetExport",
          "log:ListExport",
          "log:UpdateExport",
          "log:DeleteExport",
          "log:CreateJob",
          "log:GetJob",
          "log:ListJobs",
          "log:UpdateJob",
          "log:DeleteJob",
          "ecs:AttachNetworkInterface",
          "ecs:AuthorizeSecurityGroup",
          "ecs:CreateNetworkInterface",
          "ecs:CreateNetworkInterfacePermission",
          "ecs:CreateRouteEntry",
          "ecs:CreateSecurityGroup",
          "ecs:DeleteNetworkInterface",
          "ecs:DeleteNetworkInterfacePermission",
          "ecs:DeleteRouteEntry",
          "ecs:DeleteSecurityGroup",
          "ecs:DescribeInstanceAttribute",
          "ecs:DescribeInstanceStatus",
          "ecs:DescribeInstanceTypeFamilies",
          "ecs:DescribeInstanceTypes",
          "ecs:DescribeInstances",
          "ecs:DescribeInstancesFullStatus",
          "ecs:DescribeNetworkInterfaceAttribute",
          "ecs:DescribeNetworkInterfaces",
          "ecs:DescribeRegions",
          "ecs:DescribeSecurityGroupAttribute",
          "ecs:DescribeSecurityGroups",
          "ecs:DescribeZones",
          "ecs:DetachNetworkInterface",
          "ecs:ListTagResources",
          "ecs:ModifyNetworkInterfaceAttribute",
          "ecs:RevokeSecurityGroup",
          "ecs:TagResources",
          "ecs:UntagResources",
          "vpc:CreateRouteEntry",
          "vpc:DeleteRouteEntry",
          "vpc:DescribeRegions",
          "vpc:DescribeVSwitchAttributes",
          "vpc:DescribeVSwitches",
          "vpc:DescribeVpcAttribute",
          "vpc:DescribeVpcs",
          "vpc:DescribeZones",
          "vpc:ListTagResources",
          "vpc:ModifyBypassToaAttribute",
          "vpc:TagResources",
          "vpc:UntagResources",
          "selectdb:DescribeSecurityIPList",
          "selectdb:ModifySecurityIPList"
        ],
        "Resource": "*",
        "Effect": "Allow"
      },
      {
        "Action": "ram:DeleteServiceLinkedRole",
        "Resource": "*",
        "Effect": "Allow",
        "Condition": {
          "StringEquals": {
            "ram:ServiceName": "selectdb.aliyuncs.com"
          }
        }
      },
      {
        "Action": [
          "kms:Listkeys",
          "kms:Listaliases",
          "kms:ListResourceTags",
          "kms:DescribeKey",
          "kms:UntagResource",
          "kms:TagResource",
          "kms:DescribeAccountKmsStatus"
        ],
        "Resource": "*",
        "Effect": "Allow"
      },
      {
        "Action": [
          "kms:Encrypt",
          "kms:Decrypt",
          "kms:GenerateDataKey"
        ],
        "Resource": "*",
        "Effect": "Allow",
        "Condition": {
          "StringEqualsIgnoreCase": {
            "kms:tag/acs:selectdb:instance-encryption": "true"
          }
        }
      },
      {
        "Action": [
          "rds:ModifySecurityIps",
          "rds:DescribeDBInstanceNetInfo",
          "rds:DescribeDBInstanceIPArrayList"
        ],
        "Resource": "*",
        "Effect": "Allow"
      },
      {
        "Action": [
          "arms:CheckServiceStatus",
          "arms:OpenArmsService",
          "arms:GetPrometheusApiToken",
          "arms:OpenVCluster",
          "arms:ListDashboards"
        ],
        "Resource": "*",
        "Effect": "Allow"
      },
      {
        "Action": [
          "slb:AddBackendServers",
          "slb:AddTags",
          "slb:AddVServerGroupBackendServers",
          "slb:CreateLoadBalancer",
          "slb:CreateLoadBalancerForCloudService",
          "slb:CreateLoadBalancerHTTPListener",
          "slb:CreateLoadBalancerHTTPSListener",
          "slb:CreateLoadBalancerTCPListener",
          "slb:CreateLoadBalancerUDPListener",
          "slb:CreateVServerGroup",
          "slb:DeleteLoadBalancer",
          "slb:DeleteLoadBalancerListener",
          "slb:DeleteVServerGroup",
          "slb:DescribeTags",
          "slb:DescribeVServerGroups",
          "slb:DescribeLoadBalancers",
          "slb:DescribeVServerGroupAttribute",
          "slb:DescribeLoadBalancerAttribute",
          "slb:DescribeLoadBalancerHTTPSListenerAttribute",
          "slb:DescribeLoadBalancerHTTPListenerAttribute",
          "slb:DescribeLoadBalancerListeners",
          "slb:DescribeLoadBalancerTCPListenerAttribute",
          "slb:DescribeLoadBalancerUDPListenerAttribute",
          "slb:ModifyLoadBalancerInstanceSpec",
          "slb:ModifyLoadBalancerInternetSpec",
          "slb:ModifyVServerGroupBackendServers",
          "slb:RemoveBackendServers",
          "slb:RemoveTags",
          "slb:DescribeAccessControlLists",
          "slb:RemoveVServerGroupBackendServers",
          "slb:SetLoadBalancerHTTPListenerAttribute",
          "slb:SetLoadBalancerHTTPSListenerAttribute",
          "slb:SetLoadBalancerTCPListenerAttribute",
          "slb:SetLoadBalancerUDPListenerAttribute",
          "slb:SetLoadBalancerModificationProtection",
          "slb:SetLoadBalancerDeleteProtection",
          "slb:SetVServerGroupAttribute",
          "slb:ServiceManagedControl",
          "slb:StartLoadBalancerListener",
          "slb:StopLoadBalancerListener",
          "slb:DeleteAccessControlList",
          "slb:CreateAccessControlList",
          "slb:DescribeAccessControlListAttribute",
          "slb:AddAccessControlListEntry",
          "slb:RemoveAccessControlListEntry"
        ],
        "Resource": "*",
        "Effect": "Allow"
      },
      {
        "Action": [
          "pvtz:DescribeUserServiceStatus",
          "pvtz:DescribeZones"
        ],
        "Resource": "*",
        "Effect": "Allow"
      },
      {
        "Effect": "Allow",
        "Action": [
          "bssapi:QueryAvailableInstances"
        ],
        "Resource": "*"
      },
      {
        "Action": "bss:DescribeAcccount",
        "Resource": "*",
        "Effect": "Allow"
      },
      {
        "Effect": "Allow",
        "Action": [
          "bssapi:CreateInstance"
        ],
        "Resource": "*",
        "Condition": {
          "StringEquals": {
            "bssapi:ProductCode": "pvtz",
            "bssapi:ProductType": [
              "pvtzpost"
            ]
          }
        }
      },
      {
        "Action": "ram:CreateServiceLinkedRole",
        "Resource": "*",
        "Effect": "Allow",
        "Condition": {
          "StringEquals": {
            "ram:ServiceName": "eipaccess.slb.aliyuncs.com"
          }
        }
      }
    ],
    "Version": "1"
  }

Criar a função vinculada ao service

Se você ainda não criou a função vinculada ao service AliyunServiceRoleForSelectDB do ApsaraDB for SelectDB, a caixa de diálogo Activate ApsaraDB for SelectDB será exibida sempre que você abrir o console do ApsaraDB for SelectDB. Após clicar em OK, o sistema cria a função automaticamente.

Excluir a função vinculada ao service

Para excluir a função vinculada ao service AliyunServiceRoleForSelectDB, acesse o console do RAM. Para obter instruções, consulte Delete a RAM role.