Platform For AI：EAS自營運資源服務關聯角色

背景資訊

EAS服務關聯角色AliyunServiceRoleForPaiEasManageCustomerClusters是EAS在使用自營運資源群組時，為擷取其他雲端服務存取權限而提供的RAM角色。關於服務關聯角色的詳細說明，請參見服務關聯角色。

EAS通過該角色訪問PrivateLink、VPC、ECS、ACK、SLS和PrivateZone。

AliyunServiceRoleForPaiEasManageCustomerClusters許可權說明

AliyunServiceRoleForPaiEasManageCustomerClusters擁有以下雲端服務的存取權限：

• 私網串連PrivateLink的存取權限

  {
        "Action": [
          "privatelink:OpenPrivateLinkService",
          "privatelink:CheckProductOpen",
          "privatelink:ListVpcEndpointServices",
          "privatelink:CreateVpcEndpoint",
          "privatelink:ListVpcEndpoints",
          "privatelink:UpdateVpcEndpointAttribute",
          "privatelink:GetVpcEndpointAttribute",
          "privatelink:ListVpcEndpointSecurityGroups",
          "privatelink:AttachSecurityGroupToVpcEndpoint",
          "privatelink:DetachSecurityGroupFromVpcEndpoint",
          "privatelink:AddZoneToVpcEndpoint",
          "privatelink:RemoveZoneFromVpcEndpoint",
          "privatelink:ListVpcEndpointZones",
          "privatelink:DeleteVpcEndpoint"
        ],
        "Resource": "*",
        "Effect": "Allow"
      }

• Virtual Private Cloud的存取權限

  {
        "Action": [
          "vpc:DescribeVpcs",
          "vpc:DescribeVpcAttribute",
          "vpc:DescribeVSwitches",
          "vpc:DescribeVSwitchAttributes"
        ],
        "Resource": "*",
        "Effect": "Allow"
      }

• Elastic Compute Service的存取權限

  {
        "Action": [
          "ecs:DescribeSecurityGroups",
          "ecs:CreateSecurityGroup",
          "ecs:DeleteSecurityGroup",
          "ecs:AuthorizeSecurityGroup",
          "ecs:AuthorizeSecurityGroupEgress",
          "ecs:RevokeSecurityGroup",
          "ecs:RevokeSecurityGroupEgress"
        ],
        "Resource": "*",
        "Effect": "Allow"
      }

• Container ServiceACK的存取權限

  {
        "Action": [
          "cs:DescribeClusterDetail",
          "cs:DescribeClusterUserKubeconfig"
        ],
        "Resource": "*",
        "Effect": "Allow"
      }

• Log ServiceSLS的存取權限

  {
        "Action": [
          "log:GetIndex",
          "log:GetConfig",
          "log:GetLogStore",
          "log:GetProject",
          "log:GetLogStoreLogs",
          "log:GetMachineGroup",
          "log:CreateConfig",
          "log:CreateIndex",
          "log:CreateLogStore",
          "log:CreateMachineGroup",
          "log:CreateProject",
          "log:DeleteConfig",
          "log:DeleteIndex",
          "log:DeleteLogStore",
          "log:DeleteMachineGroup",
          "log:DeleteProject",
          "log:ApplyConfigToGroup"
        ],
        "Resource":  [
          "acs:log:*:*:project/*/logstore/eas-*",
          "acs:log:*:*:project/eas-*"
        ],
        "Effect": "Allow"
      }

• 雲解析PrivateZone的存取權限

  {
        "Action": [
          "pvtz:AddZone",
          "pvtz:BindZoneVpc",
          "pvtz:AddZoneRecord",
          "pvtz:DeleteZone"
        ],
        "Resource": "*",
        "Effect": "Allow"
      }

刪除AliyunServiceRoleForPaiEasManageCustomerClusters

如果出於安全考慮需要刪除AliyunServiceRoleForPaiEasManageCustomerClusters，請注意：刪除後您將無法使用自營運資源群組部署或更新服務，已部署在自營運資源群組中的服務也將不可用。

刪除步驟如下：

1. 登入RAM控制台。

2. 在左側導覽列，選擇身份管理 > 角色。

3. 在角色頁面的搜尋方塊中，輸入AliyunServiceRoleForPaiEasManageCustomerClusters並找到該角色。

4. 在角色頁面，單擊目標RAM角色操作列的删除角色。

5. 在删除角色對話方塊，輸入RAM角色名稱，然後單擊删除角色。