人工智能平台 PAI：EAS自运维资源服务关联角色

背景信息

EAS服务关联角色AliyunServiceRoleForPaiEasManageCustomerClusters是EAS在使用自运维资源组时，为获取其他云服务访问权限而提供的RAM角色。关于服务关联角色的详细说明，请参见服务关联角色。

EAS通过该角色访问PrivateLink、VPC、ECS、ACK、SLS和PrivateZone。

AliyunServiceRoleForPaiEasManageCustomerClusters权限说明

AliyunServiceRoleForPaiEasManageCustomerClusters拥有以下云服务的访问权限：

• 私网连接PrivateLink的访问权限

  {
        "Action": [
          "privatelink:OpenPrivateLinkService",
          "privatelink:CheckProductOpen",
          "privatelink:ListVpcEndpointServices",
          "privatelink:CreateVpcEndpoint",
          "privatelink:ListVpcEndpoints",
          "privatelink:UpdateVpcEndpointAttribute",
          "privatelink:GetVpcEndpointAttribute",
          "privatelink:ListVpcEndpointSecurityGroups",
          "privatelink:AttachSecurityGroupToVpcEndpoint",
          "privatelink:DetachSecurityGroupFromVpcEndpoint",
          "privatelink:AddZoneToVpcEndpoint",
          "privatelink:RemoveZoneFromVpcEndpoint",
          "privatelink:ListVpcEndpointZones",
          "privatelink:DeleteVpcEndpoint"
        ],
        "Resource": "*",
        "Effect": "Allow"
      }

• 专有网络VPC的访问权限

  {
        "Action": [
          "vpc:DescribeVpcs",
          "vpc:DescribeVpcAttribute",
          "vpc:DescribeVSwitches",
          "vpc:DescribeVSwitchAttributes"
        ],
        "Resource": "*",
        "Effect": "Allow"
      }

• 云服务器ECS的访问权限

  {
        "Action": [
          "ecs:DescribeSecurityGroups",
          "ecs:CreateSecurityGroup",
          "ecs:DeleteSecurityGroup",
          "ecs:AuthorizeSecurityGroup",
          "ecs:AuthorizeSecurityGroupEgress",
          "ecs:RevokeSecurityGroup",
          "ecs:RevokeSecurityGroupEgress"
        ],
        "Resource": "*",
        "Effect": "Allow"
      }

• 容器服务ACK的访问权限

  {
        "Action": [
          "cs:DescribeClusterDetail",
          "cs:DescribeClusterUserKubeconfig"
        ],
        "Resource": "*",
        "Effect": "Allow"
      }

• 日志服务SLS的访问权限

  {
        "Action": [
          "log:GetIndex",
          "log:GetConfig",
          "log:GetLogStore",
          "log:GetProject",
          "log:GetLogStoreLogs",
          "log:GetMachineGroup",
          "log:CreateConfig",
          "log:CreateIndex",
          "log:CreateLogStore",
          "log:CreateMachineGroup",
          "log:CreateProject",
          "log:DeleteConfig",
          "log:DeleteIndex",
          "log:DeleteLogStore",
          "log:DeleteMachineGroup",
          "log:DeleteProject",
          "log:ApplyConfigToGroup"
        ],
        "Resource":  [
          "acs:log:*:*:project/*/logstore/eas-*",
          "acs:log:*:*:project/eas-*"
        ],
        "Effect": "Allow"
      }

• 云解析PrivateZone的访问权限

  {
        "Action": [
          "pvtz:AddZone",
          "pvtz:BindZoneVpc",
          "pvtz:AddZoneRecord",
          "pvtz:DeleteZone"
        ],
        "Resource": "*",
        "Effect": "Allow"
      }

删除AliyunServiceRoleForPaiEasManageCustomerClusters

如果出于安全考虑需要删除AliyunServiceRoleForPaiEasManageCustomerClusters，请注意：删除后您将无法使用自运维资源组部署或更新服务，已部署在自运维资源组中的服务也将不可用。

删除步骤如下：

1. 登录RAM控制台。

2. 在左侧导航栏，选择身份管理 > 角色。

3. 在角色页面的搜索框中，输入AliyunServiceRoleForPaiEasManageCustomerClusters并找到该角色。

4. 在角色页面，单击目标RAM角色操作列的删除角色。

5. 在删除角色对话框，输入RAM角色名称，然后单击删除角色。