The AliyunServiceRoleForDataworksDataMap service-linked role

Introduction to AliyunServiceRoleForDataworksDataMap

• Role name: AliyunServiceRoleForDataworksDataMap.

• Permission policy for the role: AliyunServiceRolePolicyForDataworksDataMap.

• Permission description: This service-linked role allows DataWorks to access your OSS resources and perform statistical analysis.

• Purpose of the permissions: To obtain access permissions for buckets that have the access_by=DW-OSS-MANAGE tag. These permissions include enabling or disabling bucket inventories, enabling or disabling access logs, retrieving bucket information, listing objects, and reading objects.

{
    "Statement": [
        {
            "Action": [
                "oss:GetObject",
                "oss:GetBucketInventory",
                "oss:PutBucketInventory",
                "oss:DeleteBucketInventory",
                "oss:GetBucketLogging",
                "oss:PutBucketLogging",
                "oss:DeleteBucketLogging",
                "oss:ListObjects",
                "oss:ListObjectsV2",
                "oss:GetBucketInfo",
                "oss:GetBucketStat"
            ],
            "Effect": "Allow",
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "oss:BucketTag/access_by": [
                        "DW-OSS-MANAGE"
                    ]
                }
            }
        },
        {
            "Action": [
                "oss:ListBuckets"
            ],
            "Effect": "Allow",
            "Resource": "*"
        },
        {
            "Action": "ram:DeleteServiceLinkedRole",
            "Resource": "*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": "datamap.dataworks.aliyuncs.com"
                }
            }
        }
    ],
    "Version": "1"
}

Impact of deleting the service-linked role

You can delete the AliyunServiceRoleForDataworksDataMap role at any time. If you delete this role, you can no longer use the OSS Data Management feature. For more information, see Delete a service-linked role.

Permissions required for a RAM user to create the service-linked role

{
    "Version": "1",
    "Statement": [
        {
            "Action": "dataworks:*",
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": "ram:CreateServiceLinkedRole",
            "Resource": "*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": "datamap.dataworks.aliyuncs.com"
                }
            }
        }
    ]
}