Service-linked role of TSDB

How AliyunServiceRoleForTSDB works

TSDB for InfluxDB® relies on Elastic Compute Service (ECS), ApsaraDB for MongoDB, and ApsaraDB for Redis to function. The AliyunServiceRoleForTSDB role handles the authorization for these dependencies automatically, so you don't need to manually grant each permission.

For more information about service-linked roles, see Service-linked roles.

Permissions granted

The AliyunServiceRolePolicyForTSDB policy grants the following permissions:

ECS — ENI and security group management

Enables two-way access between TSDB for InfluxDB® and instances in the same virtual private cloud (VPC):

{
  "Action": [
    "ecs:CreateNetworkInterface",
    "ecs:DescribeNetworkInterfaces",
    "ecs:DeleteNetworkINterface",
    "ecs:AttachNetworkInterface",
    "ecs:DetachNetworkInterface",
    "ecs:CreateNetworkInterfacePermission",
    "ecs:DescribeNetworkInterfacePermissions",
    "ecs:DeleteNetworkInterfacePermission",
    "ecs:CreateSecurityGroup",
    "ecs:DescirbeSecurityGroups",
    "ecs:DescribeSecurityGroupAttribute",
    "ecs:DeleteSecurityGroup",
    "ecs:AuthorizeSecurityGroup",
    "ecs:AuthorizeSecurityGroupEgress",
    "ecs:RevokeSecurityGroup",
    "ecs:RevokeSecurityGroupEgress"
  ],
  "Resource": "*",
  "Effect": "Allow"
}

ApsaraDB for MongoDB — instance monitoring

Allows TSDB for InfluxDB® to read MongoDB instance information for monitoring:

{
  "Action": [
    "dds:DescribeDBInstances",
    "dds:DescribeDBInstanceAttribute"
  ],
  "Resource": "*",
  "Effect": "Allow"
}

ApsaraDB for Redis — instance monitoring

Allows TSDB for InfluxDB® to read Redis instance information for monitoring:

{
  "Action": [
    "kvstore:DescribeRegions",
    "kvstore:DescribeInstances",
    "kvstore:DescribeInstanceAttribute"
  ],
  "Resource": "*",
  "Effect": "Allow"
}

RAM — service-linked role deletion

Allows the role itself to be deleted when no longer needed:

{
  "Action": "ram:DeleteServiceLinkedRole",
  "Resource": "*",
  "Effect": "Allow",
  "Condition": {
    "StringEquals": {
      "ram:ServiceName": "hitsdb.aliyuncs.com"
    }
  }
}

Delete the service-linked role

Before deleting AliyunServiceRoleForTSDB, make sure no TSDB for InfluxDB® instances in your Alibaba Cloud account are using it. For deletion steps, see the "Delete a service-linked role" section in Service-linked roles.

Grant a RAM user permission to create the role

To allow a Resource Access Management (RAM) user to create AliyunServiceRoleForTSDB, attach the following policy statement to the RAM user or role:

{
  "Action": "ram:CreateServiceLinkedRole",
  "Resource": "*",
  "Effect": "Allow",
  "Condition": {
    "StringEquals": {
      "ram:ServiceName": "hitsdb.aliyuncs.com"
    }
  }
}