How to view the details of the service-linked role and create it by using a RAM user-DataWorks(DataWorks)-阿里云帮助中心

When you use an exclusive resource group for the first time, you must grant DataWorks permissions to access other Alibaba Cloud products. After the authorization is complete, the system automatically creates a service-linked role named AliyunServiceRoleForDataWorks. This role grants DataWorks the permissions it needs to access your resources in other Alibaba Cloud products.

Background

For more information about service-linked roles, see Service-linked roles.

Introduction to AliyunServiceRoleForDataWorks

Role name: AliyunServiceRoleForDataWorks
Role purpose: Allows DataWorks to access your resources in Elastic Compute Service (ECS), virtual private cloud (VPC), File Storage NAS, Container Registry (ACR), MaxCompute, and Object Storage Service (OSS). Trust principal: dataworks.aliyuncs.com.
Attached role policy: AliyunServiceRolePolicyForDataWorks

Policy details:

Log on to the RAM console and choose Identity Management > Roles to view the details of the service-linked role.

Click the name of the service-linked role. On the Permission Management tab, you can review the attached system policy. The policy grants access to the following products:

Elastic Compute Service (ECS) — manage network interfaces and security groups to connect exclusive resource groups to your VPC.

{
  "Version": "1",
  "Statement": [
    {
      "Action": [
        "ecs:AttachNetworkInterface",
        "ecs:AuthorizeSecurityGroup",
        "ecs:AuthorizeSecurityGroupEgress",
        "ecs:CreateNetworkInterface",
        "ecs:CreateNetworkInterfacePermission",
        "ecs:CreateSecurityGroup",
        "ecs:DeleteNetworkInterface",
        "ecs:DeleteNetworkInterfacePermission",
        "ecs:DeleteSecurityGroup",
        "ecs:DescribeNetworkInterfacePermissions",
        "ecs:DescribeNetworkInterfaces",
        "ecs:DescribeSecurityGroupAttribute",
        "ecs:DescribeSecurityGroupReferences",
        "ecs:DescribeSecurityGroups",
        "ecs:DetachNetworkInterface",
        "ecs:JoinSecurityGroup",
        "ecs:LeaveSecurityGroup",
        "ecs:ModifyNetworkInterfaceAttribute",
        "ecs:ModifySecurityGroupAttribute",
        "ecs:ModifySecurityGroupPolicy",
        "ecs:ModifySecurityGroupRule",
        "ecs:RevokeSecurityGroup",
        "ecs:RevokeSecurityGroupEgress",
        "ecs:AssignIpv6Addresses",
        "ecs:UnassignIpv6Addresses"
      ],
      "Resource": "*",
      "Effect": "Allow"
    }
  ]
}

Virtual private cloud (VPC) — describe and create VPCs and vSwitches to set up the network environment for exclusive resource groups.

{
  "Version": "1",
  "Statement": [
    {
      "Action": [
        "vpc:DescribeVpcs",
        "vpc:DescribeVpcAttribute",
        "vpc:DescribeVSwitches",
        "vpc:DescribeVSwitchAttributes",
        "vpc:CreateVpc",
        "vpc:CreateVSwitch"
      ],
      "Resource": "*",
      "Effect": "Allow"
    }
  ]
}

File Storage NAS — describe file systems and manage mount targets to support shared storage for exclusive resource groups.

{
  "Version": "1",
  "Statement": [
    {
      "Action": [
        "nas:DescribeFileSystems",
        "nas:DescribeMountTargets",
        "nas:CreateMountTarget",
        "nas:ModifyMountTarget",
        "nas:DescribeProtocolMountTarget"
      ],
      "Effect": "Allow",
      "Resource": "*"
    }
  ]
}

Container Registry (ACR) — list and pull container images and manage VPC endpoints, enabling exclusive resource groups to access private image repositories.

{
  "Version": "1",
  "Statement": [
    {
      "Action": [
        "cr:ListNamespace",
        "cr:ListRepository",
        "cr:GetAuthorizationToken",
        "cr:ListInstanceEndpoint",
        "cr:PullRepository",
        "cr:PushRepository",
        "cr:GetInstance",
        "cr:GetInstanceVpcEndpoint",
        "cr:ListInstance",
        "cr:ListInstanceDomain",
        "cr:GetRepository",
        "cr:GetRepositoryLayers",
        "cr:ListRepositoryTag",
        "cr:GetNamespace",
        "cr:GetRepoTag",
        "cr:CreateInstanceVpcEndpointLinkedVpc",
        "cr:GetInstanceEndpoint"
      ],
      "Resource": "*",
      "Effect": "Allow"
    }
  ]
}

MaxCompute — manage custom runtime images used by MaxCompute jobs running in exclusive resource groups.

{
  "Version": "1",
  "Statement": [
    {
      "Action": [
        "odps:GetImage",
        "odps:AddImage",
        "odps:RemoveImage"
      ],
      "Resource": "*",
      "Effect": "Allow"
    }
  ]
}

Object Storage Service (OSS) — read, write, and delete objects in OSS buckets and manage bucket CORS configurations for data transfer operations.

{
  "Version": "1",
  "Statement": [
    {
      "Action": [
        "oss:GetObject",
        "oss:PutObject",
        "oss:DeleteObject",
        "oss:ListParts",
        "oss:AbortMultipartUpload",
        "oss:ListObjects",
        "oss:ListBuckets",
        "oss:PutBucketCors",
        "oss:GetBucketCors",
        "oss:DeleteBucketCors",
        "oss:GetBucketInfo",
        "oss:ListBuckets"
      ],
      "Resource": "*",
      "Effect": "Allow"
    }
  ]
}

DataWorks resource management — tag and manage DataWorks resources and move them between resource groups.

{
  "Version": "1",
  "Statement": [
    {
      "Action": [
        "dataworks:ListTagResources",
        "dataworks:TagResources",
        "dataworks:UntagResources",
        "dataworks:ChangeResourceManagerResourceGroup"
      ],
      "Resource": "*",
      "Effect": "Allow"
    }
  ]
}