本文为您介绍自动修正功能的服务关联角色（AliyunServiceRoleForConfigRemediation）的应用场景、权限策略、创建及删除操作。

应用场景

当您使用配置审计的自动修正功能修正不合规资源时，需要获取不合规资源的访问权限。此时，配置审计提供了服务关联角色（AliyunServiceRoleForConfigRemediation），解决跨服务授权问题。
说明 更多关于服务关联角色的信息，请参见服务关联角色。

角色说明

自动修正功能的服务关联角色的详细信息如下：
  • 角色名称：AliyunServiceRoleForConfigRemediation。
  • 角色权限策略名称：AliyunServiceRolePolicyForConfigRemediation。
  • 角色权限策略说明：授予配置审计访问对应云服务中资源的权限。
    {
  "Version": "1",
  "Statement": [
    {
      "Action": [
        "actiontrail:CreateTrail",
        "actiontrail:StartLogging",
        "cbn:TagResources",
        "cdn:SetDomainServerCertificate",
        "cdn:TagResources",
        "cen:TagResources",
        "composer:CreateFlow",
        "composer:GroupInvokeFlow",
        "composer:InvokeFlow",
        "cs:GetClusterInfo",
        "cs:ListClusters",
        "cs:TagResources",
        "cs:UpdateClusterTags",
        "ddoscoo:CreateTagResources",
        "ddoscoo:TagResources",
        "dds:TagResources",
        "ecs:DescribeInstances",
        "ecs:ModifyInstanceAttribute",
        "ecs:ModifyInstanceNetworkSpec",
        "ecs:TagResources",
        "hbase:TagResources",
        "kms:TagResource",
        "kms:UpdateRotationPolicy",
        "kms:DescribeKey",
        "kms:SetDeletionProtection",
        "kvstore:ModifyAuditLogConfig",
        "kvstore:TagResources",
        "kvstore:ReleaseInstancePublicConnection",
        "kvstore:DescribeSecurityIps",
        "kvstore:ModifySecurityIps",
        "kvstore:ModifyInstanceConfig",
        "kvstore:DescribeDBInstanceNetInfo",
        "nas:AddTags",
        "nas:TagResources",
        "oos:StartExecution",
        "oos:TagResources",
        "oss:GetBucketTagging",
        "oss:PutBucketTagging",
        "oss:PutBucketACL",
        "oss:PutBucketEncryption",
        "oss:PutBucketLogging",
        "oss:PutBucketReferer",
        "oss:PutBucketVersioning",
        "polardb:TagResources",
        "ram:SetPasswordPolicy",
        "ram:UpdateLoginProfile",
        "rds:MigrateSecurityIPMode",
        "rds:ModifyActionEventPolicy",
        "rds:ModifySQLCollectorPolicy",
        "rds:ModifySQLCollectorRetention",
        "rds:TagResources",
        "rds:ModifySecurityIps",
        "rds:DescribeDBInstanceIPArrayList",
        "rds:DescribeDBInstanceNetInfo",
        "rds:ReleaseInstancePublicConnection",
        "slb:DescribeLoadBalancerAttribute",
        "slb:SetLoadBalancerDeleteProtection",
        "slb:SetLoadBalancerModificationProtection",
        "slb:TagResources",
        "tag:ListTagResources",
        "tag:TagResources",
        "tag:UntagResources",
        "vpc:TagResources",
        "vpc:DescribeNatGateways",
        "vpc:DescribeForwardTableEntries",
        "vpc:DeleteForwardEntry",
        "yundun-ddoscoo:TagResources",
        "yundun-ddoscoo:CreateTagResources",
        "yundun-high:TagResources",
        "yundun-high:CreateTagResources",
        "yundun-waf:ModifyLogServiceStatus",
        "yundun-waf:ModifyProtectionModuleStatus",
        "apigateway:DescribeApi",
        "apigateway:AbolishApi",
        "apigateway:DescribeApiGroups",
        "apigateway:ModifyApiGroupNetworkPolicy",
        "apigateway:ModifyInstanceAttribute",
        "apigateway:ModifyApi",
        "apigateway:TagResources"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": "ram:PassRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "acs:Service": [
            "composer.aliyuncs.com",
            "oos.aliyuncs.com"
          ]
        }
      }
    },
    {
      "Action": "ram:DeleteServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "remediation.config.aliyuncs.com"
        }
      }
    }
  ]
}

创建自动修正功能的服务关联角色

如果您针对规则设置了修正模板，当配置审计通过该规则检测资源为不合规时，会自动在RAM控制台创建自动修正服务关联角色。

删除自动修正功能的服务关联角色

  1. 删除修正设置。
    • 删除规则的修正设置。具体操作，请参见删除修正设置。
    • 删除已设置修正的所有规则。具体操作，请参见