How to use the service-linked role of zero-ETL-ApsaraDB for ClickHouse-阿里云帮助中心

AliyunServiceRoleForClickHouseZeroETL is a service-linked role provided by Resource Access Management (RAM) that ApsaraDB for ClickHouse uses to access your source and destination clusters when running zero-ETL jobs.

Role details

Field	Value
Role name	`AliyunServiceRoleForClickHouseZeroETL`
Policy name	`AliyunServiceRolePolicyForClickHouseZeroETL`
Service name	`zetl.clickhouse.aliyuncs.com`

The role grants the minimum permissions required to read cluster metadata, manage security groups, and update IP whitelists on both the RDS source and the ClickHouse destination.

Policy document:

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "rds:DescribeDBInstances",
                "rds:DescribeDBInstanceAttribute",
                "rds:DescribeDBInstanceNetInfo",
                "rds:DescribeDBInstanceHAConfig",
                "rds:DescribeDBInstanceIPArrayList",
                "rds:DescribeSecurityGroupConfiguration",
                "rds:ModifySecurityGroupConfiguration",
                "rds:DescribeCharacterSetName",
                "rds:ModifySecurityIps",
                "clickhouse:DescribeDBInstanceAttribute",
                "clickhouse:DescribeDBInstances",
                "clickhouse:ModifySecurityIPList",
                "clickhouse:DescribeSecurityIPList",
                "clickhouse:DescribeEndpoints",
                "clickhouse:DescribeDBClusterAccessWhiteList",
                "clickhouse:DescribeDBClusterAttribute",
                "clickhouse:DescribeDBClusterNetInfoItems",
                "clickhouse:DescribeDBClusters",
                "clickhouse:ModifyDBClusterAccessWhiteList"
            ],
            "Effect": "Allow",
            "Resource": "*"
        },
        {
            "Action": "ram:DeleteServiceLinkedRole",
            "Resource": "*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": "zetl.clickhouse.aliyuncs.com"
                }
            }
        }
    ]
}

Delete the service-linked role

Before deleting AliyunServiceRoleForClickHouseZeroETL, release all ApsaraDB for ClickHouse clusters that depend on it. Deleting the role while a cluster is still using it will fail.

Release the ApsaraDB for ClickHouse cluster. See Delete a cluster.
Delete the service-linked role in the RAM console. See Delete a RAM role.