Cloud Config uses the AliyunServiceRoleForConfig service-linked role to access other Alibaba Cloud services in specific scenarios.
For more information about service-linked roles, see Service-linked roles.
Scenarios
-
Cloud Config assumes the AliyunServiceRoleForConfig role to call API operations of other Alibaba Cloud services and read their resource configurations.
-
You can specify an Object Storage Service (OSS) bucket to receive resource snapshots. Cloud Config uses this role to write snapshots to the specified bucket.
-
You can specify a Simple Log Service Logstore to receive resource change logs. Cloud Config uses this role to write logs to the specified Logstore.
-
You can specify a Simple Message Queue (formerly MNS) topic to receive notifications of resource events. Cloud Config uses this role to send notifications to the specified topic.
Role description
The AliyunServiceRoleForConfig service-linked role has the following details:
-
Role name: AliyunServiceRoleForConfig.
-
Policy attached to the role: AliyunServiceRolePolicyForConfig.
-
Policy description: grants Cloud Config the permissions to read resource configurations of other Alibaba Cloud services, write resource snapshots to OSS buckets, write resource change logs to Simple Log Service Logstores, and send notifications of resource events to SMQ topics.
NoteFor more information about the policy, see AliyunServiceRolePolicyForConfig.
Create the AliyunServiceRoleForConfig service-linked role
You can create the AliyunServiceRoleForConfig service-linked role in the Cloud Config console.
-
Single-account mode
When you activate Cloud Config, the AliyunServiceRoleForConfig service-linked role is automatically created. For more information, see Activate Cloud Config.
-
Multi-account mode
When you add all or some members in your resource directory to an account group, Cloud Config automatically creates the AliyunServiceRoleForConfig role for all members in the account group. For more information about account groups, see Overview.
Delete the AliyunServiceRoleForConfig service-linked role
Before you delete an account, you must delete the AliyunServiceRoleForConfig service-linked role. You cannot delete this role directly. To delete it, perform the following steps:
-
Log on to the Cloud Config console and deactivate Cloud Config.
For more information, see Deactivate Cloud Config.
-
Log on to the RAM console and delete the AliyunServiceRoleForConfig role.
For more information, see Delete a RAM role.
For more information about how to delete the AliyunServiceRoleForConfig service-linked role by using different accounts, see How do I delete the AliyunServiceRoleForConfig service-linked role?