Manage a service-linked role

Background information

AliyunServiceRoleForIpaDataSync is a service-linked role for Network Quality Analyzer. Network Quality Analyzer uses this Resource Access Management (RAM) role to access other Alibaba Cloud services. For more information about service-linked roles, see Service-linked roles.

Scenarios for AliyunServiceRoleForIpaDataSync

When Network Quality Analyzer needs to access Simple Log Service (SLS) resources, it uses the automatically created service-linked role AliyunServiceRoleForIpaDataSync to obtain the required access permissions.

Permissions

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "log:CreateProject",
                "log:ListProject",
                "log:GetProject"
            ],
            "Resource": "acs:log:*:*:project/*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "log:CreateDashboard",
                "log:UpdateDashboard"
            ],
            "Resource": "acs:log:*:*:project/*/dashboard/dashboard-*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "log:CreateSavedSearch",
                "log:UpdateSavedSearch"
            ],
            "Resource": "acs:log:*:*:project/*/savedsearch/savedsearch-*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "log:CreateLogStore",
                "log:GetIndex",
                "log:CreateIndex",
                "log:UpdateIndex",
                "log:ListShards",
                "log:GetCursorOrData",
                "log:GetConsumerGroupCheckPoint",
                "log:ConsumerGroupHeartBeat",
                "log:ConsumerGroupUpdateCheckPoint",
                "log:ListConsumerGroup",
                "log:CreateConsumerGroup",
                "log:UpdateConsumerGroup",
                "log:PostLogStoreLogs",
                "log:DeleteConsumerGroup"
            ],
            "Resource": [
                "acs:log:*:*:project/*/logstore/ipa-*",
                "acs:log:*:*:project/*/logstore/ipa-*/*"
            ]
        },
        {
            "Action": "ram:DeleteServiceLinkedRole",
            "Resource": "*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": "data-sync.ipa.aliyuncs.com"
                }
            }
        }
    ]
}

Deletion procedure

Before you can delete the AliyunServiceRoleForIpaDataSync service-linked role, you must delete all associated endpoint applications from the Access Point Management section of Network Quality Analyzer.

Steps

1. Log on to the RAM console with your Alibaba Cloud account. In the navigation pane on the left, click Identity Management > Roles.

2. On the Roles page, enter AliyunServiceRoleForIpaDataSync in the search box to the right of Create Role. The AliyunServiceRoleForIpaDataSync role is automatically found.

3. In the Actions column for AliyunServiceRoleForIpaDataSync, click Delete Role.

4. In the Delete Role dialog box, enter the name of the role to confirm the deletion, and click OK.

FAQ

Why can't my RAM user automatically create the AliyunServiceRoleForIpaDataSync service-linked role?

A RAM user needs specific permissions to automatically create or delete AliyunServiceRoleForIpaDataSync. If a RAM user cannot automatically create the role, add the following access policy to the RAM user.

{
    "Statement": [
        {
            "Action": [
                "ram:CreateServiceLinkedRole"
            ],
            "Resource": "acs:ram:*:Alibaba Cloud account ID:role/*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": [
                        "data-sync.ipa.aliyuncs.com"
                    ]
                }
            }
        }
    ],
    "Version": "1"
}