Common scenarios for the service-linked role associated with Lingjun connection instances (AliyunServiceRoleForEfloVcc) and how to delete the role-Intelligent Computing LINGJUN(LINGJUN)-阿里云帮助中心

Lingjun connections access other Alibaba Cloud services, such as VPCs, leased lines, and elastic network interfaces (ENIs), through the service-linked role AliyunServiceRoleForEfloVcc. This topic describes common scenarios for this role and how to delete it.

Background information

AliyunServiceRoleForEfloVcc is a RAM role that grants Lingjun connections access to other Alibaba Cloud services. For more information about service-linked roles, see Service-linked roles .

Permission description

Role name: AliyunServiceRoleForEfloVcc

Role access policy:

{
  "Version": "1",
  "Statement": [
    {
      "Action": [
        "ecs:CreateNetworkInterface",
        "ecs:AttachNetworkInterface",
        "ecs:DetachNetworkInterface",
        "ecs:DeleteNetworkInterface",
        "ecs:DescribeNetworkInterfaces",
        "ecs:CreateSecurityGroup",
        "ecs:DeleteSecurityGroup",
        "ecs:AuthorizeSecurityGroup",
        "ecs:AuthorizeSecurityGroupEgress",
        "ecs:RevokeSecurityGroup",
        "ecs:RevokeSecurityGroupEgress",
        "ecs:DescribeSecurityGroups",
        "ecs:DescribeSecurityGroupAttribute",
        "ecs:ModifyInstanceAttribute"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "vpc:DescribeVpcs",
        "vpc:DescribeVSwitches",
        "vpc:ConfirmPhysicalConnection",
        "vpc:CreateVirtualBorderRouter",
        "vpc:DeleteVirtualBorderRouter",
        "vpc:DescribeVirtualBorderRouters",
        "vpc:CreateBgpGroup",
        "vpc:DeleteBgpGroup",
        "vpc:DescribeBgpGroups",
        "vpc:CreateBgpPeer",
        "vpc:DeleteBgpPeer",
        "vpc:DescribeBgpPeers",
        "cen:AttachCenChildInstance",
        "cen:DetachCenChildInstance",
        "vpc:DescribeRouteEntryList",
        "vpc:AddBgpNetwork",
        "vpc:DeleteBgpNetwork",
        "vpc:DescribeBgpNetworks",
        "vpc:TerminatePhysicalConnection",
        "vpc:RecoverPhysicalConnection",
        "vpc:DeletePhysicalConnection",
        "vpc:OpenPhysicalConnectionService",
        "vpc:GetPhysicalConnectionServiceStatus",
        "vpc:DescribePhysicalConnections",
        "vpc:CreatePhysicalConnectionOccupancyOrder",
        "vpc:UpdateVirtualPhysicalConnection",
        "vpc:CreateRouterInterface",
        "vpc:DeleteRouterInterface",
        "vpc:DeactivateRouterInterface",
        "vpc:DescribeRouterInterfaces",
        "vpc:DescribeRouteTableList",
        "vpc:CreateRouteEntries",
        "vpc:DeleteRouteEntries",
        "vpc:CreateRouteEntry",
        "vpc:DeleteRouteEntry",
        "vpc:DescribeGrantRulesToCen",
        "vpc:GrantInstanceToCen",
        "vpc:RevokeInstanceFromCen",
        "vpc:CreatePhysicalConnectionNew",
        "vpc:ModifyVirtualBorderRouterAttribute",
        "vpc:AssociatePhysicalConnectionToVirtualBorderRouter",
        "vpc:UnassociatePhysicalConnectionFromVirtualBorderRouter",
        "bssapi:SetRenewal",
        "vpc:CancelPhysicalConnection"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "cen:CreateTransitRouterRouteEntry",
        "cen:ListTransitRouterRouteEntries",
        "cen:DeleteTransitRouterRouteEntry",
        "cen:ResolveAndRouteServiceInCen",
        "cen:DescribeRouteServicesInCen",
        "cen:DeleteRouteServiceInCen",
        "cen:CreateTransitRouterVbrAttachment",
        "cen:DeleteTransitRouterVbrAttachment",
        "cen:ListTransitRouterVbrAttachments",
        "cen:ListTransitRouterVpcAttachments",
        "cen:DisableTransitRouterRouteTablePropagation",
        "cen:EnableTransitRouterRouteTablePropagation",
        "cen:ListTransitRouterRouteTablePropagations",
        "cen:AssociateTransitRouterAttachmentWithRouteTable",
        "cen:DissociateTransitRouterAttachmentFromRouteTable",
        "cen:ListTransitRouterRouteTableAssociations",
        "cen:ListTransitRouterRouteTables",
        "cen:ListTransitRouters",
        "cen:ListTransitRouterAvailableResource",
        "cen:ResolveAndRouteServiceInCen",
        "cen:DescribeRouteServicesInCen",
        "cen:DeleteRouteServiceInCen",
        "cen:DescribeCenAttachedChildInstances",
        "cen:DescribeCenAttachedChildInstanceAttribute",
        "cen:DescribeCens"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "ros:ListStacks",
        "ros:GetStack",
        "ros:ListStackEvents",
        "ros:ListStackResources",
        "ros:GetStackResource",
        "ros:CreateStack",
        "ros:DeleteStack",
        "ros:PreviewStack"
      ],
      "Resource": [
        "*"
      ],
      "Effect": "Allow"
    },
    {
      "Action": "ram:DeleteServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "vcc.eflo.aliyuncs.com"
        }
      }
    }
  ]
}

Create the service-linked role AliyunServiceRoleForEfloVcc

When you create a cluster for the first time and reach the network configuration step, click Authorize Service Role to create the service-linked role (AliyunServiceRoleForEfloVcc).

Delete the service-linked role AliyunServiceRoleForEfloVcc

Before you delete the service-linked role AliyunServiceRoleForEfloVcc, release all Lingjun connection instances that depend on it.

Lingjun connection instances can be automatically released when the Alibaba Cloud service instance expires.
For more information, see Delete a service-linked role.