Service-linked role for Data Exchange dataset subscription and export

Background information

The service-linked role for Data Exchange dataset subscription and export, AliyunServiceRoleForDataExchangeSubscribeDataSet, is a Resource Access Management (RAM) role provided by Data Exchange. Data Exchange uses this role to access other Alibaba Cloud services and perform specific operations. For more information about service-linked roles, see Service-linked roles.

Scenarios for AliyunServiceRoleForDataExchangeSubscribeDataSet

When the Data Exchange dataset subscription and export feature needs to access resources in Object Storage Service (OSS), it obtains access permissions using the automatically created service-linked role, AliyunServiceRoleForDataExchangeSubscribeDataSet.

Permissions of AliyunServiceRoleForDataExchangeSubscribeDataSet

AliyunServiceRoleForDataExchangeSubscribeDataSet has permissions to access the following Alibaba Cloud services:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "oss:GetBucketPolicy",
        "oss:PutBucketPolicy",
        "oss:GetBucketRequestPayment"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "oss:BucketTag/dataexchange": [
            "yunmarket"
          ]
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": "oss:GetBucketTagging",
      "Resource": "*"
    }
  ]
}

Delete AliyunServiceRoleForDataExchangeSubscribeDataSet

If you have used the Data Exchange dataset subscription and export feature and want to delete the AliyunServiceRoleForDataExchangeSubscribeDataSet service-linked role for security reasons, you must first understand the consequences. After this role is deleted, you can no longer use the one-click feature to export datasets in Data Exchange.

To delete AliyunServiceRoleForDataExchangeSubscribeDataSet, follow these steps:

1. Log on to the RAM console. In the navigation pane on the left, choose Identity > Roles.

2. On the Roles page, enter AliyunServiceRoleForDataExchangeSubscribeDataSet in the search box to find the RAM role.

3. In the Actions column, click Delete.

4. In the Delete RAM Role dialog box, click OK.

   • If a dataset export task is in progress in your account, the deletion fails.

   • If your account has no ongoing dataset dump tasks, you can directly delete AliyunServiceRoleForDataExchangeSubscribeDataSet.

FAQ

Why can't my RAM user automatically create the AliyunServiceRoleForDataExchangeSubscribeDataSet service-linked role?

A RAM user must have specific permissions to automatically create or delete AliyunServiceRoleForDataExchangeSubscribeDataSet. If a RAM user cannot automatically create the role, grant the following access policy to the RAM user.

{
	"Statement": [{
		"Action": [
			"ram:CreateServiceLinkedRole"
		],
		"Resource": "acs:ram:*:Alibaba Cloud account ID:role/*",
		"Effect": "Allow",
		"Condition": {
			"StringEquals": {
				"ram:ServiceName": [
					"datasetsubscriber.dataexchange.aliyuncs.com"
				]
			}
		}
	}],
	"Version": "1"
}

References

• Service-linked roles