Permission requirements-Application High Availability Service(AHAS)-阿里云帮助中心

This topic describes the access policy required for the Multi-active Service High Availability (MSHA) Quick Start scenario.

Prerequisites

Enable MSHA modules

Complete the steps in Enable modules to enable the components in your target regions.

Architecture type	Component
Active zone-redundancy	Access layer component: Cloud-native gateway
Cross-region active-active application	Access layer component: Cloud-native gateway Data layer component: MySQL service

Enable resource products

Resource product	Purpose	Instructions
Virtual Private Cloud (VPC)	Used to create VPC and vSwitch resources.	Enable VPC
Elastic Compute Service (ECS)	Used to create ECS instances and security groups, and to deploy the demo application.	Enable ECS
Microservices Engine (MSE)	Used to create a registry, a configuration center, and a cloud-native gateway. Also used to push baselines and configure access layer rules.	Enable the MSE registry and configuration center Create an MSE cloud-native gateway
VPC Peering Connection	(For cross-region architectures only) Used to establish network connectivity between two regions.	Use a VPC peering connection to establish private connectivity between VPCs
CDT feature	Traffic for VPC peering connections is billed through Cloud Data Transfer (CDT). You must enable the CDT feature before you can use VPC peering connections.	Go to the VPC Peering Connection console and click Enable.

Service-linked roles

Service-linked role

Role Overview

AliyunServiceRoleForMSE

MSE service-linked role

Go to the MSE console. If the following pages do not appear, the authorization is complete.

AliyunServiceRoleForMSHA

MSHA service-linked role

Go to the MSHA console. If the following pop-up window does not appear, the authorization is complete.

Authorization example

{
  "Version": "1",
  "Statement": [
    {
      "Action": [
        "msha:*",
        "vpc:DescribeVSwitches",
        "vpc:DescribeRouteTableList",
        "vpc:GetVpcPeerConnectionAttribute",
        "vpc:CreateVpc",
        "vpc:CreateVSwitch",
        "vpc:CreateVpcPeerConnection",
        "vpc:CreateRouteEntry",
        "vpc:DeleteVpc",
        "vpc:DeleteVSwitch",
        "vpc:DeleteVpcPeerConnection",
        "cdt:OpenCdtService",
        "cdt:GetCdtServiceStatus",
        "cdt:GetCdtCbServiceStatus",
        "ecs:RunInstances",
        "ecs:DescribeSecurityGroups",
        "ecs:DeleteInstance",
        "ecs:DeleteSecurityGroup",
        "ecs:DescribeAvailableResource",
        "mse:AddGateway",
        "mse:CreateCluster",
        "mse:CreateEngineNamespace",
        "mse:DeleteCluster",
        "mse:DeleteGateway",
        "mse:AddCustomPlugin",
        "mse:AddSecurityGroupRule"
      ],
      "Resource": "*",
      "Effect": "Allow"
    }
  ]
}