Manage the service-linked role

Background information

A service-linked role is a RAM role associated with an Alibaba Cloud service. When a service needs to access other services to implement a feature, it must be authorized. Service-linked roles simplify this authorization and help avoid misconfigurations. For more information, see Service-linked roles.

Create the AliyunServiceRoleForECR service-linked role

When you associate a transit router (TR) with an ECR, the system automatically creates the AliyunServiceRoleForECR service-linked role and attaches a policy that allows the TR to create resources required by the ECR. The policy contains the following content:

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "cen:CreateTransitRouterEcrAttachment",
                "cen:DeleteTransitRouterEcrAttachment",
                "cen:DescribeGrantRulesToResource"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": "ram:DeleteServiceLinkedRole",
            "Resource": "*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": "ecr.aliyuncs.com"
                }
            }
        }
    ]
}

View the service-linked role

After the service-linked role is created, you can find it by searching for AliyunServiceRoleForECR on the Roles page in the RAM console.

• Basic Information

  In the Basic Information section of the role details page, view the role's basic information, such as its name, creation time, ARN, and description.

• Policies

  On the Permissions tab of the role details page, click the policy name to view the policy content and the cloud resources that the role can access.

• Trust Policy

  The Trust Policy Management tab displays the trust policy, which defines the trusted entities that can assume the RAM role. For a service-linked role, the trusted entity is a cloud service, specified in the Service field of the policy.

For more information, see View the information about a RAM role.

Delete the AliyunServiceRoleForECR service-linked role

The system does not automatically delete the AliyunServiceRoleForECR service-linked role. To delete it, you must first delete the ECR for which the role was created. For more information, see the following topics:

• Delete an ECR

• Delete a service-linked role

References

To associate a TR with your ECR, see Associate with a TR.