How to grant access to the service-linked role created by EventBridge in DataWorks-DataWorks(DataWorks)-阿里云帮助中心

When you authorize DataWorks to use EventBridge, a service-linked role named AliyunServiceRoleForDataWorksOpenPlatform is automatically created in RAM.

Background

To subscribe to and consume event messages in DataWorks by using EventBridge, you must grant DataWorks access to your EventBridge resources. After the authorization, a service-linked role named AliyunServiceRoleForDataWorksOpenPlatform is automatically created in the Resource Access Management (RAM) console. DataWorks Open Platform uses this role to access your resources in other Alibaba Cloud services. For more information about RAM service-linked roles, see Service-linked roles.

Permissions of AliyunServiceRoleForDataWorksOpenPlatform

Log on to the RAM console. In the left-side navigation pane, choose Identities > Role.
On the Role page, enter AliyunServiceRoleForDataWorksOpenPlatform in the search box. The AliyunServiceRoleForDataWorksOpenPlatform RAM role is listed in the search results.
Click the role name AliyunServiceRoleForDataWorksOpenPlatform to view its basic information.

On the role details page, click the Permission Management tab to view the details of the attached AliyunServiceRolePolicyForDataWorksOpenPlatform access policy.

{    
   "Version": "1",    
   "Statement":[        
     {
       "Effect": "Allow",  
       "Action": [
         "eventbridge:GetEventBus",
         "eventbridge:GetRule",
         "eventbridge:CreateEventBus",
         "eventbridge:DeleteEventBus",
         "eventbridge:PutEvents",
         "eventbridge:ListEventBuses"
       ],
       "Resource": "*"

     },
     {
        "Action":"ram:DeleteServiceLinkedRole",
        "Resource":"*",
        "Effect":"Allow",
        "Condition":{
          "StringEquals": {
            "ram:ServiceName": "openplatform.dataworks.aliyuncs.com"
          }
        }  
     }    
   ]   
}

Delete the AliyunServiceRoleForDataWorksOpenPlatform role

Log on to the RAM console. In the left-side navigation pane, choose Identities > Role.
On the Roles page, enter AliyunServiceRoleForDataWorksOpenPlatform in the search box. The AliyunServiceRoleForDataWorksOpenPlatform RAM role is listed in the search results.
In the Actions column, click Delete Role.

FAQ

Question: Why can't my RAM user automatically create the DataWorks service-linked role AliyunServiceRoleForDataWorksOpenPlatform?

Solution: Your RAM user must have the required permissions to create or delete AliyunServiceRoleForDataWorksOpenPlatform. If your RAM user cannot automatically create AliyunServiceRoleForDataWorksOpenPlatform, attach the following policy to the RAM user.

{
    "Statement": [
       {
        "Action": [                
                "ram:CreateServiceLinkedRole"
            ],
          "Resource": "acs:ram:*:Alibaba Cloud account ID:role/*",
          "Effect": "Allow",
           "Condition": {
               "StringEquals": {
                    "ram:ServiceName": [
                        "openplatform.dataworks.aliyuncs.com"                
                   ]
                }           
           }
     }
  ],
  "Version": "1"
}

Note

Replace Alibaba Cloud account ID with the actual ID of your Alibaba Cloud account.