Grant DataBase Audit access to cloud resources

Scenarios

If DataBase Audit needs to access resources of other Alibaba Cloud services, such as Simple Log Service (SLS), a virtual private cloud (VPC), or security groups, Alibaba Cloud automatically creates the service-linked role for DataBase Audit, AliyunServiceRoleForDbaudit. This role grants DataBase Audit access to the associated Alibaba Cloud services.

Grant access to cloud resources

1. Log on to the DataBase Audit console.

2. In the Welcome to DataBase Audit dialog box, click Confirm Create.

   After you grant authorization, Alibaba Cloud automatically creates the service-linked role for Database Audit, AliyunServiceRoleForDbaudit. The AliyunServiceRoleForDbaudit role allows your Database Audit instance to access resources from Alibaba Cloud services such as SLS and VPC.

View the service-linked role

After the AliyunServiceRoleForDbaudit service-linked role is created, you can view its details in the Resource Access Management (RAM) console. The details include the basic information, trust policy, and access policy of the role.

1. Log on to the Resource Access Management (RAM) console.

2. In the navigation pane on the left, choose Identity > Roles.

3. On the Roles page, enter AliyunServiceRoleForDbaudit in the search box and then click the role name AliyunServiceRoleForDbaudit.

4. View the basic information of the role.

   On the role details page, find the Basic Information section to view information such as the RAM role name, creation time, and ARN.

5. View the trust policy of the role.

   On the role details page, click the Trust Policy tab. The `Service` field indicates which Alibaba Cloud service can assume this role: "Service": ["dbaudit.aliyuncs.com"].

6. View the access policy of the role.

   1. On the role details page, click the Permissions tab.

   2. Click the access policy name AliyunServiceRolePolicyForDbaudit.

   3. On the Policy Document tab, view the details of the access policy.

      Note

      You cannot directly view the access policy of a service-linked role in the policy list of the RAM console.

Delete AliyunServiceRoleForDbaudit

If you use DataBase Audit and need to delete the service-linked role AliyunServiceRoleForDbaudit, you must first release all your DataBase Audit instances. You can delete the role only after all instances are released. The following steps describe how to delete AliyunServiceRoleForDbaudit.

1. Log on to the RAM console.

2. In the navigation pane on the left, choose Identity > Roles.

3. On the Roles page, enter AliyunServiceRoleForDbaudit in the search box.

   The service-linked role named AliyunServiceRoleForDbaudit is displayed.

4. In the Actions column for the role, click Delete Role.

5. In the Delete RAM Role dialog box, enter the role name to confirm the deletion, and then click OK.

FAQ

Why can't a RAM user automatically create the AliyunServiceRoleForDbaudit service-linked role for DataBase Audit?

A Resource Access Management (RAM) user must have specific permissions to automatically create or delete the AliyunServiceRoleForDbaudit service-linked role. If a RAM user cannot create the role, you must attach the following access policy to the RAM user. For more information, see Manage RAM user permissions.

{
    "Statement": [
        {
            "Action": [
                "ram:CreateServiceLinkedRole"
            ],
            "Resource": "acs:ram:*:Alibaba Cloud account ID:role/*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": [
                        "dbaudit.aliyuncs.com"
                    ]
                }
            }
        }
    ],
    "Version": "1"
}