Service-linked role of Function Compute

When this role is required

• VPC networking: Connect functions to VPCs, vSwitches, or elastic network interfaces (ENIs) for secure private network communication.

• Container image deployment: Pull images from Container Registry to create image-based functions.

• Event-driven messaging: Monitor and consume events from ApsaraMQ, Simple Message Queue (formerly MNS), EventBridge, and Function Flow to trigger function execution.

• Log management: Collect function execution logs to Simple Log Service for search, analysis, visualization, and troubleshooting.

Policy content

AliyunServiceRolePolicyForFC grants access to VPC, ECS, Simple Log Service, and Container Registry — enabling VPC connectivity, image pulls, resource reclamation, and log export.

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "vpc:DescribeVSwitchAttributes",
                "vpc:DescribeVpcAttribute"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "ecs:CreateNetworkInterface",
                "ecs:DeleteNetworkInterface",
                "ecs:DescribeNetworkInterfaces",
                "ecs:CreateNetworkInterfacePermission",
                "ecs:DeleteNetworkInterfacePermission",
                "ecs:DescribeNetworkInterfacePermissions"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "cr:PullRepository",
                "cr:GetArtifactTag",
                "cr:GetAuthorizationToken",
                "cr:GetRepository",
                "cr:GetRepositoryTag",
                "cr:GetRepoTagManifest",
                "cr:GetRepositoryManifest",
                "cr:GetInstanceVpcEndpoint",
                "cr:GetInstance",
                "cr:GetNamespace",
                "cr:GetArtifactBuildRule",
                "cr:CreateArtifactBuildTask"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "fc:InvokeFunction",
                "eventbridge:PutEvents",
                "mq:PUB",
                "mq:OnsInstanceBaseInfo",
                "mns:SendMessage",
                "mns:PublishMessage",
                "fnf:ReportTaskSucceeded",
                "fnf:ReportTaskFailed"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "log:CreateProject",
                "log:CreateLogStore",
                "log:GetProject",
                "log:GetLogStore",
                "log:DeleteProject",
                "log:DeleteLogStore",
                "log:GetLogStoreLogs"
            ],
            "Resource": [
                "acs:log:*:*:project/aliyun-fc-*",
                "acs:log:*:*:project/*/logstore/function-log*"
            ],
            "Effect": "Allow"
        },
        {
            "Action": [
                "log:PostLogStoreLogs"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "ram:GetRole"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Effect": "Allow",
            "Action": "ram:DeleteServiceLinkedRole",
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": "fc.aliyuncs.com"
                }
            }
        }
    ]
}

Create the service-linked role

When you log on to the Function Compute 3.0 console, the system prompts you to create AliyunServiceRoleForFC if it does not exist. After you confirm, the role is created with AliyunServiceRolePolicyForFC attached.

Verify that the role was created:

• Check the Roles page in the RAM console.

• Call the ListRoles API operation.

• Log on to the Function Compute 3.0 console again — a successful logon confirms the role exists.

Delete the service-linked role

To delete the service-linked role in the RAM console:

1. Log in to the RAM console as a RAM administrator.

2. In the left-side navigation pane, choose Identities > Roles.

3. On the Roles page, find the RAM role that you want to delete and click Delete Role in the Actions column.

4. In the Delete Role dialog box, enter the name of the role and click Delete Role.

   RAM checks whether any cloud resources still use the role. If dependencies exist, deletion fails. Remove the dependent resources shown in the error message, then retry.

RAM user permissions

To let a RAM user create or delete this role, grant ram:CreateServiceLinkedRole and ram:DeleteServiceLinkedRole from your Alibaba Cloud account, or attach the AliyunRAMFullAccess policy.

Sample custom policy:

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ram:CreateServiceLinkedRole",
                "ram:DeleteServiceLinkedRole"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": "fc.aliyuncs.com"
                }
            }
        }
    ]
}