This topic describes the scenarios that use Mobi service-linked roles and how to delete them.
Background information
Mobi requires access to other Alibaba Cloud services to perform certain functions. A Mobi service-linked role is a Resource Access Management (RAM) role that grants the required access permissions. For more information about service-linked roles, see Service-linked roles.
The current Mobi service-linked role is AliyunServiceRoleForMobilcdpRuntimeDNS. This role is primarily used for the automatic configuration of environments and domain names. More service-linked roles will be added for different scenarios in the future.
Scenarios for AliyunServiceRoleForMobilcdpRuntimeDNS
The automatic configuration feature for environments and domain names in Mobi requires access to resources in Alibaba Cloud DNS, Web Application Firewall (WAF), and Certificate Management Service. This feature uses a service-linked role to obtain the required access permissions.
Details of AliyunServiceRoleForMobilcdpRuntimeDNS
Role name: AliyunServiceRoleForMobilcdpRuntimeDNS
Access policy: AliyunServiceRolePolicyForMobilcdpRuntimeDNS
Permissions:
{
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"alidns:DescribeDomains",
"alidns:AddDomainRecord",
"alidns:DescribeSubDomainRecords",
"yundun-cert:UploadUserCertificate",
"yundun-waf:DescribeCertificates",
"yundun-waf:DescribeInstanceInfo",
"yundun-waf:CreateDomain",
"yundun-waf:CreateCertificateByCertificateId",
"yundun-waf:DescribeDomain",
"yundun-waf:DescribeCerts",
"yundun-waf:DescribeDomains",
"yundun-waf:ModifyDomain",
"yundun-waf:DescribeDomainDetail",
"yundun-waf:DescribeDomainNames",
"yundun-waf:DescribeInstance"
],
"Resource": "*"
},
{
"Action": "ram:DeleteServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": "runtime-dns.mobilcdp.aliyuncs.com"
}
}
}
]
}Delete AliyunServiceRoleForMobilcdpRuntimeDNS
If you use the automatic configuration feature for custom application domain names and want to delete the Mobi service-linked role AliyunServiceRoleForMobilcdpRuntimeDNS, you can delete it in the RAM console. Before you delete the role, make sure that you no longer require the automatic domain name configuration feature.
To delete AliyunServiceRoleForMobilcdpRuntimeDNS, follow these steps:
Log on to the RAM console as a RAM administrator.
In the navigation pane on the left, choose Identity Management > Roles.
On the Roles page, search for the role named AliyunServiceRoleForMobilcdpRuntimeDNS.
On the Roles page, find the target RAM role and click Delete Role in the Actions column.
In the Delete Role dialog box, enter the RAM role name, and then click Delete Role.