This topic describes the service-linked roles for Quanmiao and how to delete them.
Background information
In some scenarios, Quanmiao uses service-linked roles (SLRs) to access other Alibaba Cloud services, such as Object Storage Service (OSS) and Intelligent Media Services (IMS). An SLR is a Resource Access Management (RAM) role that grants access permissions to other Alibaba Cloud services. For more information about service-linked roles, see Service-linked roles.
Related service-linked roles
The following SLRs are related to Quanmiao:
Role name | Role description |
AliyunServiceRoleForAIMiaoBiAccessingOss | The service-linked role for Quanmiao to call OSS. Quanmiao uses this role to access your services and resources in OSS. |
AliyunServiceRoleForAiMiaoBiAccessingIMS | The service-linked role for Quanmiao to call IMS. Quanmiao uses this role to access your services and resources in IMS. |
AliyunServiceRoleForAIMiaoBiAccessingOss
Scenarios
Quanmiao uses the automatically created service-linked role AliyunServiceRoleForAIMiaoBiAccessingOss to access OSS resources for features that require storage, such as the Material Library.
Role and permission details
Role name: AliyunServiceRoleForAIMiaoBiAccessingOss
Access policy: AliyunServiceRolePolicyForAIMiaoBiAccessingOss
Permission details:
{
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"oss:ListBuckets"
],
"Resource": "acs:oss:*:*:*"
},
{
"Effect": "Allow",
"Action": [
"oss:PutObject",
"oss:ListParts",
"oss:GetObject",
"oss:AbortMultipartUpload",
"oss:DeleteObject"
],
"Resource": "acs:oss:*:*:*/aimiaobi/*"
},
{
"Action": "ram:DeleteServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": "oss-access-aimiaobi.sfm.aliyuncs.com"
}
}
}
]
}Delete the service-linked role
If you use features such as the Quanmiao Material Library and later decide to delete the AliyunServiceRoleForAIMiaoBiAccessingOss service-linked role for reasons such as security, you must understand the impact. After you delete this role, Quanmiao can no longer add or access files and data stored in OSS for features such as the Material Library under your Alibaba Cloud account.
For more information about how to delete a service-linked role, see Service-linked roles.
AliyunServiceRoleForAiMiaoBiAccessingIMS
Scenarios
Multimodal features, such as Quanmiao dataset management, depend on IMS. When Quanmiao accesses IMS resources, it obtains the required access permissions using the automatically created service-linked role AliyunServiceRoleForAiMiaoBiAccessingIMS.
Role and permission details
Role name: AliyunServiceRoleForAiMiaoBiAccessingIMS
Access policy: AliyunServiceRolePolicyForAiMiaoBiAccessingIMS
Permission details:
{
"Version": "1",
"Statement": [
{
"Action": [
"ice:CreateSearchLib",
"ice:QuerySearchLib",
"ice:DropSearchLib",
"ice:ListSearchLib",
"ice:CreateSearchIndex",
"ice:QuerySearchIndex",
"ice:AlterSearchIndex",
"ice:DropSearchIndex",
"ice:InsertMediaToSearchLib",
"ice:DeleteMediaFromSearchLib",
"ice:UpdateMediaToSearchLib",
"ice:QueryMediaIndexJob",
"ice:SearchIndexJobRerun",
"ice:SearchMedia",
"ice:SearchMediaByMultimodal",
"ice:GetVideoList",
"ice:SearchMediaByFace",
"ice:SearchMediaClipByFace",
"ice:SearchMediaByAILabel",
"ice:SearchMediaByHybrid"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": "ram:DeleteServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": "ims.quanmiao.aliyuncs.com"
}
}
}
]
}Delete the service-linked role
If you use Quanmiao dataset management and later decide to delete the AliyunServiceRoleForAiMiaoBiAccessingIMS service-linked role for reasons such as security, you must understand the impact. After you delete this role, Quanmiao can no longer add or access multimodal index data in datasets that are stored under your Alibaba Cloud account.
For more information about how to delete a service-linked role, see Service-linked roles.
FAQ
Q: Why can't my RAM user automatically create a Quanmiao service-linked role?
A: Specific permissions are required to automatically create or delete service-linked roles. If a RAM user cannot automatically create the role, you can grant the required permissions by adding the following access policy to the user.
Replace Your-Alibaba-Cloud-Account-ID with the ID of your Alibaba Cloud account.
{
"Statement": [
{
"Action": [
"ram:CreateServiceLinkedRole"
],
"Resource": "acs:ram:*:Your-Alibaba-Cloud-Account-ID:role/*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": [
"oss-access-aimiaobi.sfm.aliyuncs.com"
]
}
}
}
],
"Version": "1"
}