Service-linked roles of ApsaraDB for OceanBase-ApsaraDB for OceanBase (Deprecated)(OceanBase)-阿里云帮助中心

This topic describes the scenarios and permissions of AliyunServiceRoleForOceanBaseEncryption, a service-linked role of ApsaraDB for OceanBase.

Background information

A service-linked role is a Resource Access Management (RAM) role whose trusted entity is an Alibaba Cloud service. ApsaraDB for OceanBase uses a service-linked role to access other cloud services or resources. Generally, a service-linked role is automatically created by the system when you perform an operation. If automatic role creation fails or is not supported by ApsaraDB for OceanBase, you need to manually create the role.

AliyunServiceRoleForOceanBaseEncryption is a RAM role provided in certain cases to access other cloud services for performing a task in ApsaraDB for OceanBase. For more information, see Service-linked roles.

Scenarios

Keys used in Transparent Data Encryption (TDE) of ApsaraDB for OceanBase are protected through encryption by Key Management Service (KMS). ApsaraDB for OceanBase accesses KMS by using the service-linked role AliyunServiceRoleForOceanBaseEncryption.

Permissions required by a RAM user to use a service-linked role

To create or delete a service-linked role by using a RAM user, you must request the administrator to grant the AliyunOceanBaseFullAccess permission to the RAM user, or add the following permissions in the Action statement of the custom policy:

Permission to create a service-linked role: ram:CreateServiceLinkedRole
Permission to delete a service-linked role: ram:DeleteServiceLinkedRole

For more information, see Permissions required to create and delete a service-linked role.

Permissions of AliyunServiceRoleForOceanBaseEncryption

Role name: AliyunServiceRoleForOceanBaseEncryption

Role policy: AliyunServiceRolePolicyForOceanBaseEncryption

Role permissions:

{
  "Statement": [
    {
      "Action": [
        "kms:ListKeys",
        "kms:ListAliasesByKeyId",
        "kms:ListAliases",
        "kms:DescribeKey"
      ],
      "Effect": "Allow",
      "Resource": "acs:kms:*:*:*"
    },
    {
      "Action": [
        "kms:Encrypt",
        "kms:Decrypt",
        "kms:GenerateDataKey"
      ],
      "Condition": {
        "StringEqualsIgnoreCase": {
          "kms:tag/oceanbase:encryption": "true"
        }
      },
      "Effect": "Allow",
      "Resource": "acs:kms:*:*:*"
    },
    {
      "Action": "ram:DeleteServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "encryption.oceanbase.aliyuncs.com"
        }
      }
    }
  ],
  "Version": "1"
}