To enable specific features, Alibaba Cloud Model Studio requires a service-linked role (SLR) to access other Alibaba Cloud services, such as Function Compute and Content Moderation, or cloud resources. When you first enable a feature in Alibaba Cloud Model Studio, such as a Function Compute node, the system automatically creates the corresponding service-linked role for you. This topic describes the service-linked roles that are created by Alibaba Cloud Model Studio and explains how to delete them.
Service-linked Roles Created by Alibaba Cloud Model Studio
You can view all service-linked roles on the Role Management page of the Resource Access Management (RAM) console.
|
Service-linked Role Name |
Service-linked Role Description |
|
Model Studio workflow applications and flow orchestration use this service-linked role to access your resources in FC. |
|
|
Data Management uses this service-linked role to access your resources in OSS. |
|
|
Alibaba Cloud Model Studio secure bucket accesses your OSS resources through this service-linked role. |
|
|
Create and Use a Knowledge Base and Secure Bucket access your ADB-PG instance through this service-linked role. |
|
|
Data Management accesses OSS change messages in MNS queues through this service-linked role. |
|
|
Usage Monitoring and App Performance Analytics access your OpenTelemetry instances through this service-linked role. |
|
|
Alibaba Cloud Model Studio applications access your Content Moderation services or resources through this service-linked role. |
|
|
Model Monitoring uses this service-linked role to access your resources in SLS. |
|
|
Model Monitoring accesses your resources in CMS through this service-linked role. |
|
|
The Alibaba Cloud Model Studio platform accesses your OSS through this service-linked role. It uses these permissions to operate your OSS files, allowing the Alibaba Cloud Model Studio platform to manage OSS operations. |
|
|
The Alibaba Cloud Model Studio platform accesses your DTS through this service-linked role. It uses these permissions to create and manage DTS tasks, importing data from specified data sources into the Alibaba Cloud Model Studio platform. |
|
|
Model Fine-tuning and Data Management use this service-linked role to access your resources in CPFS and OSS. |
AliyunServiceRoleForSFMAccessFC
Scenarios
This service-linked role allows Alibaba Cloud Model Studio workflow application and flow orchestration to access your resources in FC.
Role and Permissions Description
Service-linked role name: AliyunServiceRoleForSFMAccessFC
System policy: AliyunServiceRolePolicyForSFMAccessFC
This system policy grants the following permissions:
{
"Action": [
"fc:ListFunctions",
"fc:InvokeFunction"
],
"Resource": "*",
"Effect": "Allow"
}Delete Service-linked Role
If you delete this service-linked role, workflow applications and flow orchestrations cannot create or call Function Compute nodes. Proceed with caution.
Before you delete the AliyunServiceRoleForSFMAccessFC service-linked role, you must delete the Function Compute nodes from all published workflow applications and flows and then republish the applications or flows.
For more information about how to delete a service-linked role, see Service-linked Role.
AliyunServiceRoleForSFMDataHubOSSImport
Scenarios
The OSS data import feature in Data Management of Model Studio uses this service-linked role to access your resources in OSS.
Role and Permissions Description
Service-linked role name: AliyunServiceRoleForSFMDataHubOSSImport
System policy: AliyunServiceRolePolicyForSFMDataHubOSSImport
This system policy grants the following permissions:
{
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"oss:ListBuckets",
"oss:GetBucketLocation",
"oss:GetBucketTagging"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"oss:DoMetaQuery",
"oss:GetBucketInfo",
"oss:GetBucketStat",
"oss:GetBucketTransferAcceleration",
"oss:GetCnameToken",
"oss:GetMetaQueryStatus",
"oss:GetObject",
"oss:GetObjectTagging",
"oss:DescribeRegions",
"oss:ListObjects",
"oss:ListObjectVersions"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"oss:BucketTag/bailian-datahub-access": [
"read"
]
}
}
},
{
"Action": "ram:DeleteServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": "datahub.sfm.aliyuncs.com"
}
}
}
]
}Delete Service-linked Role
If you delete this service-linked role, Data Management cannot access your OSS resources. Proceed with caution.
Before you delete the AliyunServiceRoleForSFMDataHubOSSImport service-linked role, ensure that no OSS data import tasks are running in Data Management.
For more information about how to delete a service-linked role, see Service-linked Role.
AliyunServiceRoleForAccessOSS
Scenarios
This service-linked role allows the Alibaba Cloud Model Studio secure bucket to access your OSS resources.
Role and Permissions Description
Service-linked role name: AliyunServiceRoleForAccessOSS
System policy: AliyunServiceRolePolicyForAccessOSS
This system policy grants the following permissions:
{
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"oss:ListBuckets",
"oss:GetBucketLocation",
"oss:GetBucketTagging"
],
"Resource": [
"*"
],
"Condition": {}
},
{
"Effect": "Allow",
"Action": [
"oss:DoMetaQuery",
"oss:GetBucketInfo",
"oss:GetBucketStat",
"oss:GetBucketTransferAcceleration",
"oss:GetCnameToken",
"oss:GetMetaQueryStatus",
"oss:GetObject",
"oss:GetObjectTagging",
"oss:DescribeRegions",
"oss:ListObjects",
"oss:ListObjectVersions",
"oss:PutObjectTagging",
"oss:DeleteObject",
"oss:DeleteObjectTagging",
"oss:PutObject"
],
"Resource": [
"*"
],
"Condition": {
"StringEquals": {
"oss:BucketTag/bailian-safe-workspace-oss-access": [
"ReadAndWrite"
]
}
}
},
{
"Action": "ram:DeleteServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": "ossaccess.sfm.aliyuncs.com"
}
}
}
]
}Delete Service-linked Role
If you delete this service-linked role, the secure bucket cannot access your OSS resources. Proceed with caution.
Before you delete the AliyunServiceRoleForAccessOSS service-linked role, ensure that you have disconnected all OSS connections in the secure bucket. For more information about how to disconnect a connection, see Disconnect a connection.
For more information about how to delete a service-linked role, see Service-linked Role.
AliyunServiceRoleForSFMAccessADB
Scenarios
This service-linked role allows the Alibaba Cloud Model Studio secure bucket to access your AnalyticDB for PostgreSQL (ADB-PG) database instances.
Role and Permissions Description
Service-linked role name: AliyunServiceRoleForSFMAccessADB
System policy: AliyunServiceRolePolicyForSFMAccessADB
Permissions for this system policy:
{
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"gpdb:DescribeDBInstanceAttribute",
"gpdb:DescribeDBInstances",
"gpdb:CreateVectorManagerAccount",
"gpdb:QueryCollectionData",
"gpdb:UpsertCollectionData",
"gpdb:DeleteVectorIndex",
"gpdb:CreateVectorIndex",
"gpdb:CreateNamespace",
"gpdb:ListNamespaces",
"gpdb:DescribeNamespace",
"gpdb:DeleteNamespace",
"gpdb:ListCollections",
"gpdb:GrantCollection",
"gpdb:DescribeCollection",
"gpdb:DeleteCollectionData",
"gpdb:DeleteCollection",
"gpdb:CreateCollection",
"gpdb:UpdateCollectionDataMetadata"
],
"Resource": "*"
},
{
"Action": "ram:DeleteServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": "adb-access.sfm.aliyuncs.com"
}
}
}
]
}Delete Service-linked Role
If you delete this service-linked role, the secure bucket cannot access your ADB-PG instances. Proceed with caution.
Before you delete the AliyunServiceRoleForSFMAccessADB service-linked role, ensure that you have disconnected all ADB-PG connections from the secure bucket. For more information about how to disconnect a connection, see Disconnect.
For more information about how to delete a service-linked role, see Service-linked Role.
AliyunServiceRoleForSFMAccessingMNS
Scenarios
This service-linked role allows Data Management in Alibaba Cloud Model Studio to access OSS change messages in MNS queues to automatically synchronize changes to your OSS data.
Role and Permissions Description
Service-linked role name: AliyunServiceRoleForSFMAccessingMNS
System policy: AliyunServiceRolePolicyForSFMAccessingMNS
This system policy grants the following permissions:
{
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"mns:GetQueueAttributes",
"mns:GetSubscriptionAttributes",
"mns:GetTopicAttributes",
"mns:ListEventNotifications",
"mns:GetAccountAttributes",
"mns:ListEvents",
"mns:ListProducts",
"mns:ListQueue",
"mns:ListSubscriptionByTopic",
"mns:ListTagResources",
"mns:ListTopic",
"mns:ReceiveMessage",
"mns:DeleteMessage"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"mns:CreateQueue",
"mns:DeleteQueue",
"mns:SetQueueAttributes"
],
"Resource": "acs:mns:*:*:/queues/bailian-oss-event*"
},
{
"Action": "ram:DeleteServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": "mns-access.sfm.aliyuncs.com"
}
}
}
]
}Delete Service-linked Role
This policy is defined and used by Alibaba Cloud Model Studio. Do not modify, delete, or grant it to any RAM identity other than a service-linked role.
AliyunServiceRoleForSFMTelemetry
Scenarios
This service-linked role allows Usage Monitoring and App Performance Analytics to access your OpenTelemetry instances.
Role and Permissions Description
Service-linked role name: AliyunServiceRoleForSFMTelemetry
System policy: AliyunServiceRolePolicyForSFMTelemetry
This system policy grants the following permissions:
{
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"log:Get*",
"log:List*",
"log:Query*"
],
"Resource": [
"acs:log:*:*:project/proj-xtrace-*",
"acs:log:*:*:project/proj-xtrace-*/logstore/logstore-tracing",
"acs:log:*:*:project/proj-xtrace-*/logstore/logstore-tracing/*"
]
},
{
"Effect": "Allow",
"Action": [
"arms:Describe*",
"arms:List*",
"arms:Get*",
"arms:Search*",
"arms:Check*",
"arms:Query*",
"arms:InitTraceResource"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"xtrace:Read*",
"xtrace:Get*",
"xtrace:Describe*",
"xtrace:Check*",
"xtrace:OpenXtraceService"
],
"Resource": "*"
},
{
"Action": "ram:DeleteServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": "telemetry.sfm.aliyuncs.com"
}
}
},
{
"Action": "ram:CreateServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": [
"arms.aliyuncs.com",
"xtrace.aliyuncs.com",
"cloudmonitor.aliyuncs.com"
]
}
}
}
]
}Delete Service-linked Role
This policy is defined and used by Alibaba Cloud Model Studio. Do not modify, delete, or grant it to any RAM identity other than a service-linked role.
AliyunServiceRoleForSFMAccessingCIP
Scenarios
The Model Studio application accesses your Content Moderation services or resources using this service-linked role.
Role and Permissions Description
Service-linked role name: AliyunServiceRoleForSFMAccessingCIP
System policy: AliyunServiceRolePolicyForSFMAccessingCIP
This system policy grants the following permissions:
{
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": "yundun-greenweb:ModerationForBaiLian",
"Resource": "acs:yundun-greenweb:*:*:*"
},
{
"Action": "ram:DeleteServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": "content-security.sfm.aliyuncs.com"
}
}
}
]
}Delete Service-linked Role
This policy is defined and used by Alibaba Cloud Model Studio. Do not modify, delete, or grant it to any RAM identity other than a service-linked role.
AliyunServiceRoleForSFMAccessSLS
Scenarios
This service-linked role allows Model Monitoring in Alibaba Cloud Model Studio to access your SLS resources.
Role and Permissions Description
Service-linked role name: AliyunServiceRoleForSFMAccessSLS
System policy: AliyunServiceRolePolicyForSFMAccessSLS
This system policy grants the following permissions:
{
"Version": "1",
"Statement": [
{
"Action": [
"log:GetProject",
"log:GetLogs",
"log:GetLogStoreLogs",
"log:GetProductDataCollection",
"log:OpenProductDataCollection",
"log:CloseProductDataCollection"
],
"Resource": [
"acs:log:*:*:project/aliyun-product-data-*",
"acs:log:*:*:project/aliyun-product-data-*/logstore/bailian-*",
"acs:log:*:*:project/aliyun-product-data-*/logstore/bailian-*/*"
],
"Effect": "Allow"
},
{
"Action": [
"log:GetSlsService",
"log:OpenSlsService",
"log:DescribeService",
"log:EnableService"
],
"Resource": [
"acs:log:*:*:service"
],
"Effect": "Allow"
},
{
"Action": "ram:CreateServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": [
"sls-access.sfm.aliyuncs.com",
"audit.log.aliyuncs.com",
"middlewarelens.log.aliyuncs.com",
"securitylens.log.aliyuncs.com",
"ai-lens.log.aliyuncs.com",
"storagelens.log.aliyuncs.com"
]
}
}
},
{
"Action": "ram:DeleteServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": "sls-access.sfm.aliyuncs.com"
}
}
}
]
}Delete Service-linked Role
This policy is defined and used by Alibaba Cloud Model Studio. Do not modify, delete, or grant it to any RAM identity other than a service-linked role.
AliyunServiceRoleForSFMAccessCMS
Scenarios
This service-linked role allows Model Monitoring in Alibaba Cloud Model Studio to access your CMS resources.
Role and Permissions Description
Service-linked role name: AliyunServiceRoleForSFMAccessCMS
System policy: AliyunServiceRolePolicyForSFMAccessCMS
This system policy grants the following permissions:
{
"Version": "1",
"Statement": [
{
"Action": "cms:GetCmsService",
"Resource": "acs:cms:*:*:cmsservice/*",
"Effect": "Allow"
},
{
"Action": "cms:GetPrometheusInstance",
"Resource": "acs:cms:*:*:prometheusinstance/*",
"Effect": "Allow"
},
{
"Action": [
"log:GetProject",
"log:GetLogs",
"log:GetLogStoreLogs",
"log:QueryPrometheusMetrics",
"log:QueryMetrics"
],
"Resource": [
"acs:log:*:*:project/aliyun-product-data-*",
"acs:log:*:*:project/aliyun-product-data-*/logstore/bailian-*",
"acs:log:*:*:project/aliyun-product-data-*/logstore/bailian-*/*"
],
"Effect": "Allow"
},
{
"Action": "ram:DeleteServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": "cms-access.sfm.aliyuncs.com"
}
}
}
]
}Delete Service-linked Role
This is a system policy for Alibaba Cloud Model Studio. Do not modify, delete, or grant this policy to any RAM identity other than the service-linked role.
AliyunServiceRoleForAccessCusOss
Scenarios
This service-linked role allows the Alibaba Cloud Model Studio platform to access your OSS resources. The permissions are used to manage your OSS files and operations.
Role and Permissions Description
Service-linked role name: AliyunServiceRoleForAccessCusOss
System policy: AliyunServiceRolePolicyForAccessCusOss
This system policy grants the following permissions:
{
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"oss:ListBuckets",
"oss:GetBucketLocation",
"oss:GetBucketTagging"
],
"Resource": [
"*"
],
"Condition": {}
},
{
"Effect": "Allow",
"Action": [
"oss:DoMetaQuery",
"oss:GetBucketInfo",
"oss:GetBucketStat",
"oss:GetBucketTransferAcceleration",
"oss:GetCnameToken",
"oss:GetMetaQueryStatus",
"oss:GetObject",
"oss:GetObjectTagging",
"oss:DescribeRegions",
"oss:ListObjects",
"oss:ListObjectVersions",
"oss:PutObjectTagging",
"oss:DeleteObject",
"oss:DeleteObjectTagging",
"oss:PutObject",
"oss:PutBucketCors"
],
"Resource": [
"*"
],
"Condition": {
"StringEquals": {
"oss:BucketTag/bailian-connector-access": [
"ReadAndWrite"
]
}
}
},
{
"Action": "ram:DeleteServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": "cus-oss-access.sfm.aliyuncs.com"
}
}
}
]
}Delete Service-linked Role
If you delete this service-linked role, Alibaba Cloud Model Studio cannot access your OSS resources. Proceed with caution.
Before you delete the AliyunServiceRoleForAccessCusOss service-linked role, ensure that you have disconnected all OSS connections in the Alibaba Cloud Model Studio platform. For more information about how to disconnect a connection, see Disconnect.
For more information about how to delete a service-linked role, see Service-linked Role.
AliyunServiceRoleForSFMConnectorAccessDTS
Scenarios
This service-linked role allows the Alibaba Cloud Model Studio platform to access DTS. The permissions are used to create and manage DTS tasks to import data from specified data sources into the Alibaba Cloud Model Studio platform.
Role and Permissions Description
Service-linked role name: AliyunServiceRoleForSFMConnectorAccessDTS
System policy: AliyunServiceRolePolicyForSFMConnectorAccessDTS
This system policy grants the following permissions:
{
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"dts:DescribeDtsJobDetail",
"dts:StartDtsJob",
"dts:StopDtsJob",
"dts:DeleteDtsJob",
"dts:SuspendDtsJob"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"acs:ResourceTag/bailian-connector-access": [
"ReadAndWrite"
]
}
}
},
{
"Effect": "Allow",
"Action": [
"dts:CreateDtsInstance",
"dts:ConfigureDtsJob",
"dts:DescribeSchemaList",
"dts:DescribeStruct",
"dts:DescribeColumns",
"dts:RunEndpointLinkTest",
"dts:TagResources"
],
"Resource": "*"
},
{
"Action": "ram:DeleteServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": "dts-access.sfm.aliyuncs.com"
}
}
}
]
}Delete Service-linked Role
If you delete this service-linked role, Alibaba Cloud Model Studio cannot access your DTS. Proceed with caution.
Before you delete the AliyunServiceRoleForSFMConnectorAccessDTS service-linked role, ensure that you have disconnected all DTS connections in the secure bucket.
For more information about how to delete a service-linked role, see Service-linked roles.
AliyunServiceRoleForSFMFineTuning
Scenarios
This service-linked role is used by model fine-tuning and Data Management in Alibaba Cloud Model Studio to access your resources in CPFS and OSS.
Role and Permissions Description
Service-linked role name: AliyunServiceRoleForSFMFineTuning
System policy: AliyunServiceRolePolicyForSFMFineTuning
This system policy grants the following permissions:
{
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"nas:ClientMount",
"nas:DescribeCpfsAccessPoints",
"nas:DescribeFileSystems"
],
"Resource": "*"
},
{
"Action": "ram:DeleteServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": "fine-tuning.sfm.aliyuncs.com"
}
}
},
{
"Effect": "Allow",
"Action": [
"oss:ListBuckets",
"oss:GetBucketLocation",
"oss:GetBucketTagging"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"oss:DoMetaQuery",
"oss:GetBucketInfo",
"oss:GetBucketStat",
"oss:GetBucketTransferAcceleration",
"oss:GetCnameToken",
"oss:GetMetaQueryStatus",
"oss:GetObject",
"oss:GetObjectTagging",
"oss:DescribeRegions",
"oss:ListObjects",
"oss:ListObjectVersions",
"oss:DoMetaQuery",
"oss:GetMetaQueryStatus"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"oss:BucketTag/bailian-finetune-access": [
"read"
]
}
}
}
]
}Delete Service-linked Role
If you delete this service-linked role, model fine-tuning and Data Management in Alibaba Cloud Model Studio cannot access your CPFS and OSS resources. Proceed with caution.
Before you delete the AliyunServiceRoleForSFMFineTuning service-linked role, ensure that no training jobs are running for model fine-tuning and no import or publish tasks are running in Data Management.
For more information about how to delete a service-linked role, see Service-linked Role.