什么是CPFS文件系统服务关联角色_文件存储 CPFS(CPFS)-阿里云帮助中心

本文为您介绍什么是CPFS文件系统服务关联角色以及如何删除服务关联角色。

应用场景

NAS服务关联角色的应用场景如下：

AliyunServiceRoleForNasCpfsNetwork
CPFS文件系统在创建或删除弹性网卡、安全组时，需要通过AliyunServiceRoleForNasCpfsNetwork角色访问您的专有网络VPC服务与云服务器ECS服务。
AliyunServiceRoleForNasCpfsClient
CPFS文件系统在创建或删除ECS、云助手、授权信息及安全组时，需要通过AliyunServiceRoleForNasCpfsClient角色访问您的专有网络VPC服务与云服务器ECS服务。
AliyunServiceRoleForNasOssDataFlow
使用CPFS文件系统数据流动服务时，需要通过AliyunServiceRoleForNasOssDataFlow角色查询和读写对象存储OSS中指定Bucket的数据。
AliyunServiceRoleForNasEventNotification
使用CPFS文件系统数据流动服务时，需要通过AliyunServiceRoleForNasEventNotification角色创建和修改EventBridge相关参数。

更多服务关联角色的信息，请参见服务关联角色。

权限说明

CPFS服务关联角色的权限内容如下：

AliyunServiceRoleForNasCpfsNetwork

{
    "Version": "1",
    "Statement": [{
            "Action": [
                "vpc:DescribeVSwitchAttributes",
                "vpc:DescribeVpcs",
                "vpc:DescribeVSwitches"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "ecs:CreateSecurityGroup",
                "ecs:DescribeSecurityGroups",
                "ecs:CreateNetworkInterface",
                "ecs:DeleteNetworkInterface",
                "ecs:DescribeNetworkInterfaces",
                "ecs:CreateNetworkInterfacePermission",
                "ecs:DescribeNetworkInterfacePermissions",
                "ecs:DeleteNetworkInterfacePermission"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ecs:DescribeSecurityGroupAttribute",
                "ecs:DeleteSecurityGroup",
                "ecs:AuthorizeSecurityGroup",
                "ecs:AuthorizeSecurityGroupEgress",
                "ecs:RevokeSecurityGroup",
                "ecs:RevokeSecurityGroupEgress"
            ],
            "Resource": "acs:ecs:*:*:*/*",
            "Condition": {
                "StringEqualsIgnoreCase": {
                    "ecs:tag/nas:cpfs": "true"
                }
            }
        },
        {
            "Action": "ram:DeleteServiceLinkedRole",
            "Resource": "*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": "cpfs-network.nas.aliyuncs.com"
                }
            }
        }
    ]
}

AliyunServiceRoleForNasCpfsClient

{
 "Version": "1",
 "Statement": [
 {
 "Action": [
 "vpc:DescribeVSwitchAttributes",
 "vpc:DescribeVpcs",
 "vpc:DescribeVSwitches"
 ],
 "Resource": "*",
 "Effect": "Allow"
 },
 {
 "Action": [
 "ecs:RunInstances",
 "ecs:CreateInstance",
 "ecs:DescribeInstances",
 "ecs:CreateSecurityGroup",
 "ecs:DescribeSecurityGroups",
 "ecs:InstallCloudAssistant",
 "ecs:DescribeInvocations"
 ],
 "Resource": "*",
 "Effect": "Allow"
 },
 {
 "Effect": "Allow",
 "Action": [
 "ecs:StartInstances",
 "ecs:DeleteInstances",
 "ecs:RunCommand",
 "ecs:DescribeSecurityGroupAttribute",
 "ecs:DeleteSecurityGroup",
 "ecs:AuthorizeSecurityGroup",
 "ecs:AuthorizeSecurityGroupEgress",
 "ecs:RevokeSecurityGroup",
 "ecs:RevokeSecurityGroupEgress"
 ],
 "Resource": "acs:ecs:*:*:*/*",
 "Condition": {
 "StringEqualsIgnoreCase": {
 "ecs:tag/nas:cpfs": "true"
 }
 }
 },
 {
 "Action": "ram:DeleteServiceLinkedRole",
 "Resource": "*",
 "Effect": "Allow",
 "Condition": {
 "StringEquals": {
 "ram:ServiceName": "cpfs-client.nas.aliyuncs.com"
 }
 }
 } 
 ]
 }

AliyunServiceRoleForNasOssDataFlow

{
 "Statement": [
 {
 "Effect": "Allow",
 "Action": [
 "oss:ListBuckets",
 "oss:GetBucketTagging"
 ],
 "Resource": [
 "acs:oss:*:*:*"
 ]
 },
 {
 "Effect": "Allow",
 "Action": [
 "oss:HeadBucket",
 "oss:GetBucketLocation",
 "oss:GetBucketInventory",
 "oss:GetBucketInfo",
 "oss:GetBucketVersion",
 "oss:GetBucketAcl",
 "oss:GetBucketStat",
 "oss:GetBucket",
 "oss:ListObjects",
 "oss:GetObject",
 "oss:PutObject",
 "oss:CopyObject",
 "oss:AppendObject",
 "oss:DeleteObject",
 "oss:GetObjectMeta",
 "oss:PutObjectACL",
 "oss:GetObjectACL",
 "oss:PutObjectTagging",
 "oss:GetObjectTagging",
 "oss:InitiateMultipartUpload",
 "oss:CompleteMultipartUpload",
 "oss:AbortMultipartUpload",
 "oss:ListMultipartUploads",
 "oss:UploadPart",
 "oss:UploadPartCopy",
 "oss:ListParts"
 ],
 "Resource": [
 "acs:oss:*:*:*",
 "acs:oss:*:*:*/*"
 ],
 "Condition": {
 "StringEqualsIgnoreCase": {
 "oss:tag/cpfs-dataflow": "true"
 }
 }
 },
 {
 "Action": "ram:DeleteServiceLinkedRole",
 "Resource": "*",
 "Effect": "Allow",
 "Condition": {
 "StringEquals": {
 "ram:ServiceName": "oss-dataflow.nas.aliyuncs.com"
 }
 }
 }
 ],
 "Version": "1"
}

AliyunServiceRoleForNasEventNotification

{
 "Statement": [
 {
 "Effect": "Allow",
 "Action": [
 "eventbridge:GetEventBus",
 "eventbridge:CreateRule"
 ],
 "Resource": [
 "acs:eventbridge:*:*:*"
 ]
 },
 {
 "Effect": "Allow",
 "Action": [
 "eventbridge:GetRule",
 "eventbridge:ListRules",
 "eventbridge:UpdateRule",
 "eventbridge:EnableRule",
 "eventbridge:DisableRule",
 "eventbridge:DeleteRule",
 "eventbridge:CreateTargets",
 "eventbridge:UpdateTargets",
 "eventbridge:DeleteTargets"
 ],
 "Resource": [
 "acs:eventbridge:*:*:*"
 ]
 },
 {
 "Action": "ram:DeleteServiceLinkedRole",
 "Resource": "*",
 "Effect": "Allow",
 "Condition": {
 "StringEquals": {
 "ram:ServiceName": "event-notification.nas.aliyuncs.com"
 }
 }
 }
 ],
 "Version": "1"
}

删除CPFS服务关联角色

如果您暂时不需要使用CPFS服务关联角色，例如不再使用CPFS文件系统的数据流动功能时，可以删除CPFS服务关联角色。删除时，请先删除该角色关联的CPFS文件系统实例。具体操作，请参见创建文件系统和删除服务关联角色。

常见问题

为什么RAM用户无法自动创建CPFS服务关联角色？

RAM用户需要拥有指定的权限，才能自动创建或删除CPFS服务关联角色。因此，在RAM用户无法自动创建CPFS服务关联角色时，您需为其添加以下系统策略和自定义策略。具体操作，请参见为RAM角色授权。

系统策略
- AliyunVPCFullAccess：管理专有网络VPC的权限。
- AliyunBSSFullAccess：管理费用中心BSS的权限。
- AliyunNASFullAccess：管理文件存储NAS的权限。
- AliyunECSNetworkInterfaceManagementAccess：管理ECS弹性网卡的权限。

自定义策略

管理挂载点，需要cpfs-network.nas.aliyuncs.com和cpfs-client.nas.aliyuncs.com权限。
管理数据流动，需要oss-dataflow.nas.aliyuncs.com和event-notification.nas.aliyuncs.com权限。

示例如下：

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ram:CreateServiceLinkedRole"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": { 
         "ram:ServiceName": [
            "cpfs-network.nas.aliyuncs.com",
            "cpfs-client.nas.aliyuncs.com",
            "oss-dataflow.nas.aliyuncs.com",
            "event-notification.nas.aliyuncs.com" 
         ]
        }
      }
    }
  ]
}