Elasticsearch service-linked roles

Elasticsearch uses service-linked roles (SLRs) to access other Alibaba Cloud services when you access Kibana or clusters over a VPC through PrivateLink, manage Beats shippers, or work with manual snapshots, or use elastic scaling for ES clusters. Elasticsearch automatically creates these roles if they do not exist. This topic covers Elasticsearch and ES Serverless SLRs and how to delete them.

Scenarios

Elasticsearch uses the following service-linked roles:

AliyunServiceRoleForElasticsearch: Required to access Kibana or a node for an Elasticsearch cluster deployed in the cloud-native control architecture over your VPC.
AliyunServiceRoleForElasticsearchCollector: Required to create and manage Beats shippers.
AliyunServiceRoleForElasticsearchOSS: Required to create or restore manual snapshots. Grants Elasticsearch access to OSS buckets.
AliyunServiceRoleForElasticsearchOps: Required for elastic scaling tasks.
AliyunServiceRoleForESServerless: Required to enable private network access for ES Serverless applications or Kibana.

The Service-linked roles topic explains how SLRs work.

Role details

AliyunServiceRoleForElasticsearch

When you access Kibana or a node for an Elasticsearch cluster deployed in the cloud-native control architecture over your VPC, Elasticsearch automatically creates this SLR if it does not exist. Elasticsearch then assumes the role to call PrivateLink and ECS APIs, creating endpoints and network configurations for VPC access.

Role name: AliyunServiceRoleForElasticsearch
Policy name: AliyunServiceRolePolicyForElasticsearch
Policy document (the following policy applies to the China (Beijing), China (Shanghai), China (Hangzhou), China (Shenzhen), China (Zhangjiakou), and China (Qingdao) regions; other regions retain the original policy):

{
  "Version": "1",
  "Statement": [
    {
      "Action": [
        "ecs:AssignIpv6Addresses",
        "ecs:AssignPrivateIpAddresses",
        "ecs:AttachNetworkInterface",
        "ecs:AuthorizeSecurityGroup",
        "ecs:AuthorizeSecurityGroupEgress",
        "ecs:CreateNetworkInterface",
        "ecs:CreateNetworkInterfacePermission",
        "ecs:CreateSecurityGroup",
        "ecs:DeleteNetworkInterface",
        "ecs:DeleteSecurityGroup",
        "ecs:DescribeInstanceAttribute",
        "ecs:DescribeInstances",
        "ecs:DescribeNetworkInterfaceAttribute",
        "ecs:DescribeNetworkInterfaces",
        "ecs:DescribeSecurityGroupAttribute",
        "ecs:DescribeSecurityGroupReferences",
        "ecs:DescribeSecurityGroups",
        "ecs:DetachNetworkInterface",
        "ecs:JoinSecurityGroup",
        "ecs:LeaveSecurityGroup",
        "ecs:ModifyNetworkInterfaceAttribute",
        "ecs:ModifySecurityGroupAttribute",
        "ecs:ModifySecurityGroupEgressRule",
        "ecs:ModifySecurityGroupPolicy",
        "ecs:ModifySecurityGroupRule",
        "ecs:RevokeSecurityGroup",
        "ecs:RevokeSecurityGroupEgress",
        "ecs:UnassignIpv6Addresses",
        "ecs:UnassignPrivateIpAddresses"
      ],
      "Resource": [
        "*"
      ],
      "Effect": "Allow"
    },
    {
      "Action": [
        "elasticsearch:ListInstance",
        "elasticsearch:DescribeInstance",
        "elasticsearch:RunEsDiagnosticCommand"
      ],
      "Resource": [
        "*"
      ],
      "Effect": "Allow"
    },
    {
      "Action": [
        "pvtz:AddZone",
        "pvtz:AddZoneRecord",
        "pvtz:DeleteZone",
        "pvtz:DeleteZoneRecord",
        "pvtz:DescribeZoneRecords",
        "pvtz:UpdateZoneRecord"
      ],
      "Resource": [
        "*"
      ],
      "Effect": "Allow"
    },
    {
      "Action": [
        "vpc:DescribeVSwitches"
      ],
      "Resource": [
        "*"
      ],
      "Effect": "Allow"
    },
    {
      "Action": [
        "privatelink:CreateVpcEndpoint",
        "privatelink:ListVpcEndpoints",
        "privatelink:UpdateVpcEndpointAttribute",
        "privatelink:GetVpcEndpointAttribute",
        "privatelink:ListVpcEndpointSecurityGroups",
        "privatelink:AttachSecurityGroupToVpcEndpoint",
        "privatelink:DetachSecurityGroupFromVpcEndpoint",
        "privatelink:AddZoneToVpcEndpoint",
        "privatelink:RemoveZoneFromVpcEndpoint",
        "privatelink:ListVpcEndpointZones",
        "privatelink:OpenPrivateLinkService",
        "privatelink:CheckProductOpen",
        "privatelink:DeleteVpcEndpoint"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "cms:DescribeAlertLogCount",
        "cms:DescribeAlertLogList",
        "cms:DescribeAlertLogHistogram",
        "cms:DescribeSubscriptionList",
        "cms:DescribeContactListByContactGroup",
        "cms:DescribeContactGroupList",
        "cms:DescribeContactList",
        "cms:PutContact",
        "cms:PutContactGroup",
        "cms:DescribeSystemEventHistogram",
        "cms:DescribeSystemEventMetaList",
        "cms:DescribeSystemEventAttribute",
        "cms:DescribeSystemEventCount",
        "cms:DescribeMetricList",
        "cms:DescribeMetricLast",
        "cms:DescribeMetricMetaList",
        "cms:DescribeConsoleViews",
        "cms:QueryMetricLast",
        "cms:QueryMetricList",
        "cms:DescribeMetricListFromProxy",
        "cms:DescribeMetricLastFromProxy"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": "ram:CreateServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "privatelink.aliyuncs.com"
        }
      }
    },
    {
      "Action": "ram:DeleteServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "elasticsearch.aliyuncs.com"
        }
      }
    }
  ]
}

Compared with the policy for other regions, the policy for the preceding regions adds the following capabilities:

ES instance query and diagnostics: Adds elasticsearch permissions (ListInstance, DescribeInstance, and RunEsDiagnosticCommand) for querying and diagnosing ES instances.
PrivateLink service activation: Adds privatelink permissions (OpenPrivateLinkService and CheckProductOpen) for activating PrivateLink and checking product activation status.
CloudMonitor: Adds cms permissions (21 actions in total) for alert log queries, contact and contact group management, system event queries, and metric data queries.

The following policy applies to other regions:

{
  "Version": "1",
  "Statement": [
    {
      "Action": [
        "ecs:AssignIpv6Addresses",
        "ecs:AssignPrivateIpAddresses",
        "ecs:AttachNetworkInterface",
        "ecs:AuthorizeSecurityGroup",
        "ecs:AuthorizeSecurityGroupEgress",
        "ecs:CreateNetworkInterface",
        "ecs:CreateNetworkInterfacePermission",
        "ecs:CreateSecurityGroup",
        "ecs:DeleteNetworkInterface",
        "ecs:DeleteSecurityGroup",
        "ecs:DescribeInstanceAttribute",
        "ecs:DescribeInstances",
        "ecs:DescribeNetworkInterfaceAttribute",
        "ecs:DescribeNetworkInterfaces",
        "ecs:DescribeSecurityGroupAttribute",
        "ecs:DescribeSecurityGroupReferences",
        "ecs:DescribeSecurityGroups",
        "ecs:DetachNetworkInterface",
        "ecs:JoinSecurityGroup",
        "ecs:LeaveSecurityGroup",
        "ecs:ModifyNetworkInterfaceAttribute",
        "ecs:ModifySecurityGroupAttribute",
        "ecs:ModifySecurityGroupEgressRule",
        "ecs:ModifySecurityGroupPolicy",
        "ecs:ModifySecurityGroupRule",
        "ecs:RevokeSecurityGroup",
        "ecs:RevokeSecurityGroupEgress",
        "ecs:UnassignIpv6Addresses",
        "ecs:UnassignPrivateIpAddresses"
      ],
      "Resource": [
        "*"
      ],
      "Effect": "Allow"
    },
    {
      "Action": [
        "pvtz:AddZone",
        "pvtz:AddZoneRecord",
        "pvtz:DeleteZone",
        "pvtz:DeleteZoneRecord",
        "pvtz:DescribeZoneRecords",
        "pvtz:UpdateZoneRecord"
      ],
      "Resource": [
        "*"
      ],
      "Effect": "Allow"
    },
    {
      "Action": [
        "vpc:DescribeVSwitches"
      ],
      "Resource": [
        "*"
      ],
      "Effect": "Allow"
    },
    {
      "Action": [
        "privatelink:CreateVpcEndpoint",
        "privatelink:ListVpcEndpoints",
        "privatelink:UpdateVpcEndpointAttribute",
        "privatelink:GetVpcEndpointAttribute",
        "privatelink:ListVpcEndpointSecurityGroups",
        "privatelink:AttachSecurityGroupToVpcEndpoint",
        "privatelink:DetachSecurityGroupFromVpcEndpoint",
        "privatelink:AddZoneToVpcEndpoint",
        "privatelink:RemoveZoneFromVpcEndpoint",
        "privatelink:ListVpcEndpointZones",
        "privatelink:DeleteVpcEndpoint"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": "ram:CreateServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "privatelink.aliyuncs.com"
        }
      }
    },
    {
      "Action": "ram:DeleteServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "elasticsearch.aliyuncs.com"
        }
      }
    }
  ]
}

Service name: elasticsearch.aliyuncs.com

Permission required to create the role: ram:CreateServiceLinkedRole

AliyunServiceRoleForElasticsearchCollector

When you create or manage a Beats shipper, Elasticsearch automatically creates this SLR if it does not exist. Elasticsearch then assumes the role to enable Beats data collection from ECS instances or ACK clusters.

Role name: AliyunServiceRoleForElasticsearchCollector
Policy name: AliyunServiceRolePolicyForElasticsearchCollector

Policy document:

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "oos:CancelExecution",
                "oos:DeleteExecutions",
                "oos:GenerateExecutionPolicy",
                "oos:GetExecutionTemplate",
                "oos:ListExecutionLogs",
                "oos:ListExecutions",
                "oos:ListTaskExecutions",
                "oos:NotifyExecution",
                "oos:StartExecution",
                "oos:ListTagResources",
                "oos:TagResources",
                "oos:UntagResources",
                "oos:CreateTemplate",
                "oos:DeleteTemplate",
                "oos:GetTemplate",
                "oos:ListExecutionRiskyTasks",
                "oos:ListTemplates",
                "oos:UpdateTemplate"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "ecs:DescribeInstances",
                "ecs:DescribeCloudAssistantStatus"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "cs:GetUserConfig",
                "cs:GetClusters",
                "cs:GetClusterById"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": "ram:DeleteServiceLinkedRole",
            "Resource": "*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": "collector.elasticsearch.aliyuncs.com"
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": "ram:PassRole",
            "Resource": "acs:ram:*:*:role/aliyunoosaccessingecs4esrole",
            "Condition": {
                "StringEquals": {
                    "acs:Service": "oos.aliyuncs.com"
                }
            }
        }
    ]
}

Service name: collector.elasticsearch.aliyuncs.com
Permission required to create the role: ram:CreateServiceLinkedRole

AliyunServiceRoleForElasticsearchOSS

When you create or restore a manual snapshot, Elasticsearch automatically creates this SLR if it does not exist. Elasticsearch then assumes the role to access your OSS bucket.

Role name: AliyunServiceRoleForElasticsearchOSS
Policy name: AliyunServiceRolePolicyForElasticsearchOSS
Policy document:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "oss:ListObjects",
        "oss:GetObject",
        "oss:GetObjectVersion",
        "oss:GetObjectVersionTagging",
        "oss:GetObjectMeta",
        "oss:DeleteObject",
        "oss:PutObject",
        "oss:GetBucketVersioning",
        "oss:GetBucketInfo",
        "oss:GetBucketAcl"
      ],
      "Resource": [
        "acs:oss:*:*:es-alicloud-*/*",
        "acs:oss:*:*:es-alicloud-*",
        "acs:oss:*:*:*/*es-alicloud*/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "oss:ListObjects",
        "oss:GetObject",
        "oss:GetObjectMeta",
        "oss:GetObjectVersion",
        "oss:GetObjectVersionTagging",
        "oss:DeleteObject",
        "oss:PutObject",
        "oss:GetBucketVersioning",
        "oss:GetBucketInfo",
        "oss:GetBucketAcl"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "oss:BucketTag/es-alicloud": [
            "es-alicloud"
          ]
        }
      }
    },
    {
      "Action": "ram:DeleteServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "oss.elasticsearch.aliyuncs.com"
        }
      }
    }
  ]
}

Service name: oss.elasticsearch.aliyuncs.com

Permission required to create the role: ram:CreateServiceLinkedRole

AliyunServiceRoleForElasticsearchOps

When you perform elastic scaling tasks, Elasticsearch automatically creates this SLR if it does not exist. Elasticsearch then assumes the role to call elastic scaling APIs and complete scheduled scaling tasks.

Role name: AliyunServiceRoleForElasticsearchOps
Policy name: AliyunServiceRolePolicyForElasticsearchOps

Policy document:

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "elasticsearch:ListInstance",
                "elasticsearch:DescribeInstance",
                "elasticsearch:UpdateInstance",
                "elasticsearch:UpdateInstanceSettings",
                "elasticsearch:RestartInstance",
                "elasticsearch:RollbackInstance",
                "elasticsearch:DowngradeInstance",
                "elasticsearch:CancelTask",
                "elasticsearch:DeactivateZones",
                "elasticsearch:ActivateZones",
                "elasticsearch:MigrateToOtherZone",
                "elasticsearch:ResumeElasticsearchTask",
                "elasticsearch:InterruptElasticsearchTask",
                "elasticsearch:UpdateAdvancedSetting",
                "elasticsearch:UpgradeInstanceEngineVersion",
                "elasticsearch:UpdateWhiteIps",
                "elasticsearch:UpdatePublicIps",
                "elasticsearch:ModifyWhiteIps",
                "elasticsearch:TriggerNetwork",
                "elasticsearch:UpdateTemplate",
                "elasticsearch:DescribeLogstash",
                "elasticsearch:UpdateLogstash",
                "elasticsearch:RestartLogstash",
                "elasticsearch:UpdateLogstashSettings",
                "elasticsearch:InterruptLogstashTask",
                "elasticsearch:ResumeLogstashTask",
                "elasticsearch:DowngradeLogstash"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": "ram:DeleteServiceLinkedRole",
            "Resource": "*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": "ops.elasticsearch.aliyuncs.com"
                }
            }
        }
    ]
}

Service name: ops.elasticsearch.aliyuncs.com
Permission required to create the role: ram:CreateServiceLinkedRole

ES Serverless service-linked roles

AliyunServiceRoleForESServerless

When you enable private access for an ES Serverless application or its Kibana console, ES Serverless automatically creates this SLR if it does not exist. The service then assumes the role to call PrivateLink APIs and create VPC endpoints for private access.

Role name: AliyunServiceRoleForESServerless
Policy name: AliyunServiceRolePolicyForESServerless
Policy contents:

{
	"Version": "1",
	"Statement": [{
			"Action": [
				"privatelink:CreateVpcEndpoint",
				"privatelink:DeleteVpcEndpoint",
				"privatelink:ListVpcEndpoints",
				"privatelink:OpenPrivateLinkService",
				"privatelink:CheckProductOpen",
				"privatelink:UpdateVpcEndpointAttribute",
				"privatelink:GetVpcEndpointAttribute",
				"privatelink:AddZoneToVpcEndpoint",
				"privatelink:RemoveZoneFromVpcEndpoint",
				"privatelink:ListVpcEndpointSecurityGroups",
				"privatelink:AttachSecurityGroupToVpcEndpoint",
				"privatelink:DetachSecurityGroupFromVpcEndpoint",
				"privatelink:ListVpcEndpointZones",
				"vpc:DescribeVpcs",
				"vpc:DescribeVpcAttribute",
				"vpc:DescribeVSwitches",
				"vpc:DescribeVSwitchAttributes"
			],
			"Resource": "*",
			"Effect": "Allow"
		},
		{
			"Action": "ram:DeleteServiceLinkedRole",
			"Resource": "*",
			"Effect": "Allow",
			"Condition": {
				"StringEquals": {
					"ram:ServiceName": "es-serverless.aliyuncs.com"
				}
			}
		},
		{
			"Action": "ram:CreateServiceLinkedRole",
			"Resource": "*",
			"Effect": "Allow",
			"Condition": {
				"StringEquals": {
					"ram:ServiceName": "privatelink.aliyuncs.com"
				}
			}
		}
	]
}

Service name: es-serverless.aliyuncs.com
Permission required to create the role: ram:CreateServiceLinkedRole

Delete a service-linked role

Before you delete an SLR, delete all tasks or devices that depend on the role. Delete an SLR.

FAQ

Q: Why am I unable to use my RAM user to create an Elasticsearch service-linked role?

A: Only Alibaba Cloud accounts and RAM users with the CreateServiceLinkedRole permission can create or delete SLRs. Attach the following policy to your RAM user (Grant permissions to RAM users):

{
    "Version": "1",
    "Statement": [
        {
            "Action": "elasticsearch:InitializeOperationRole",
            "Resource": "acs:ram:*:133071096032****:role/*",
            "Effect": "Allow"
        },
        {
            "Action": "ram:CreateServiceLinkedRole",
            "Resource": "acs:ram:*:133071096032****:role/*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": [
                        "XXX.aliyuncs.com"
                    ]
                }
            }
        }
    ]
}

Replace 133071096032**** in the Resource element with your Alibaba Cloud account ID.

To find your account ID, move the pointer over your profile picture in the upper-right corner of the console and view your Account ID.
Replace XXX.aliyuncs.com in ram:ServiceName with the service name of the target SLR:
- AliyunServiceRoleForElasticsearch: elasticsearch.aliyuncs.com
- AliyunServiceRoleForElasticsearchCollector: collector.elasticsearch.aliyuncs.com
- AliyunServiceRoleForElasticsearchOSS: oss.elasticsearch.aliyuncs.com
- AliyunServiceRoleForElasticsearchOps (elastic scaling): ops.elasticsearch.aliyuncs.com

Q: Why can't my RAM user create the ES Serverless service-linked role AliyunServiceRoleForESServerless?

A: Only an Alibaba Cloud account or a RAM user with the ram:CreateServiceLinkedRole permission can automatically create or delete a service-linked role. If a RAM user cannot create the role, your Alibaba Cloud account must grant the required permission by attaching the following policy to the RAM user. For detailed instructions, see Grant permissions to RAM users.

{
    "Statement": [
        {
            "Action": [
                "ram:CreateServiceLinkedRole"
            ],
            "Resource": "acs:ram:*:133071096032****:role/*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": [
                        "XXX.aliyuncs.com"
                    ]
                }
            }
        }
    ],
    "Version": "1"
}

In the Resource element, replace 133071096032**** with your account ID.

To find your account ID, move the pointer over your profile picture in the upper-right corner of the console and view your Account ID.
In the ram:ServiceName condition, replace XXX.aliyuncs.com with the service name for the AliyunServiceRoleForESServerless role, which is es-serverless.aliyuncs.com.