AHAS service-linked role-Application High Availability Service(AHAS)-阿里云帮助中心

This topic describes the AHAS service-linked role AliyunServiceRoleForAHAS and explains how to delete it.

Background

AliyunServiceRoleForAHAS is a service-linked role for AHAS. AHAS assumes this RAM role to access other cloud services as needed for its operations. For more information about service-linked roles, see Service-linked roles.

Use cases

AHAS assumes the AliyunServiceRoleForAHAS service-linked role to access resources from other cloud services like SLB, VPC, and ECS for features such as architecture-aware resource topology and traffic protection.

Permissions

The AliyunServiceRoleForAHAS service-linked role has permissions to access the cloud services listed below. For more information, see Manage permission policies.

Permissions to access ECS

        {
            "Action": [
                "ecs:DescribeInstanceAutoRenewAttribute",
                "ecs:DescribeInstances",
                "ecs:DescribeInstanceStatus",
                "ecs:DescribeInstanceVncUrl",
                "ecs:DescribeSpotPriceHistory",
                "ecs:DescribeUserdata",
                "ecs:DescribeInstanceRamRole",
                "ecs:DescribeDisks",
                "ecs:DescribeSnapshots",
                "ecs:DescribeAutoSnapshotPolicy",
                "ecs:DescribeSnapshotLinks",
                "ecs:DescribeImages",
                "ecs:DescribeImageSharePermission",
                "ecs:DescribeClassicLinkInstances",
                "ecs:AuthorizeSecurityGroup",
                "ecs:DescribeSecurityGroupAttribute",
                "ecs:DescribeSecurityGroups",
                "ecs:ModifySecurityGroupAttribute",
                "ecs:AuthorizeSecurityGroupEgress",
                "ecs:ModifySecurityGroupRule",
                "ecs:DescribeSecurityGroupReferences",
                "ecs:ModifySecurityGroupPolicy",
                "ecs:RevokeSecurityGroup",
                "ecs:DescribeNetworkInterfaces",
                "ecs:DescribeTags",
                "ecs:DescribeRegions",
                "ecs:DescribeZones",
                "ecs:DescribeInstanceMonitorData",
                "ecs:DescribeEipMonitorData",
                "ecs:DescribeDiskMonitorData",
                "ecs:DescribeInstanceTypes",
                "ecs:DescribeInstanceTypeFamilies",
                "ecs:DescribeTasks",
                "ecs:DescribeTaskAttribute",
                "ecs:DescribeInstanceAttribute",
                "ecs:InvokeCommand",
                "ecs:CreateCommand",
                "ecs:StopInvocation",
                "ecs:DeleteCommand",
                "ecs:DescribeCommands",
                "ecs:DescribeInvocations",
                "ecs:DescribeInvocationResults",
                "ecs:ModifyCommand",
                "ecs:InstallCloudAssistant",
                "ecs:CreateNetworkInterfacePermission",
                "ecs:DeleteNetworkInterfacePermission",
                "ecs:CreateNetworkInterface",
                "ecs:CreateSecurityGroup",
                "ecs:DeleteSecurityGroup",
                "ecs:ModifyNetworkInterfaceAttribute",
                "ecs:ModifyInstanceAttribute",
                "ecs:DescribeNetworkInterfaces",
                "ecs:RebootInstances",
                "ecs:StopInstances",
                "ecs:StartInstances"
            ],
            "Resource": "*",
            "Effect": "Allow"
        }

Permissions to access SLB

        {
            "Action": [
                "slb:DescribeLoadBalancers",
                "slb:DescribeLoadBalancerAttribute",
                "slb:DescribeLoadBalancerHTTPListenerAttribute",
                "slb:DescribeLoadBalancerHTTPSListenerAttribute",
                "slb:DescribeLoadBalancerTCPListenerAttribute",
                "slb:DescribeLoadBalancerUDPListenerAttribute",
                "slb:DescribeHealthStatus",
                "slb:DescribeVServerGroups",
                "slb:DescribeVServerGroupAttribute",
                "slb:DescribeTags",
                "slb:DescribeRules"
            ],
            "Resource": "*",
            "Effect": "Allow"
        }

Permissions to access VPC

        {
            "Action": [
                "vpc:DescribeVSwitches",
                "vpc:DescribeVpcs",
                "vpc:DescribeNatGateways",
                "vpc:DescribeForwardTableEntries",
                "vpc:DescribeSnatTableEntries",
                "vpc:DescribeBandwidthPackages",
                "vpc:DescribeEipAddresses",
                "vpc:DescribeEipGatewayInfo",
                "vpc:DescribeEipMonitorData"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },

Delete the AHAS service-linked role

Deleting the AliyunServiceRoleForAHAS service-linked role affects how AHAS retrieves data. To delete the role, follow these steps.

Note If any ACK clusters exist in your account, you must delete them before you can delete AliyunServiceRoleForAHAS. Otherwise, the deletion attempt will fail.

Log on to the RAM console. In the left-side navigation pane, choose Identities > Roles.
On the Roles page, enter AliyunServiceRoleForAHAS in the search box to find the corresponding RAM role.
In the Actions column, click Delete.
In the Delete Role dialog box, click OK.
Important Deleting the service-linked role will affect how AHAS retrieves data. Proceed with caution.

FAQ

Q: Why can't my RAM user automatically create the AliyunServiceRoleForAHAS service-linked role?

A: A RAM user must have specific permissions to automatically create or delete AliyunServiceRoleForAHAS. If a RAM user cannot automatically create the role, you must attach the following permission policy.

{
    "Statement": [
        {
            "Action": [
                "ram:CreateServiceLinkedRole"
            ],
            "Resource": "acs:ram:*:main-account-id:role/*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": [
                        "ahas.aliyuncs.com"
                    ]
                }
            }
        }
    ],
    "Version": "1"
}

Note Replace main-account-id with the ID of your Alibaba Cloud account.