Create, view, and delete the service-linked roles that OpenSearch uses to access other Alibaba Cloud services.
Scenarios
A service-linked role is a RAM role whose trusted entity is an Alibaba Cloud service. OpenSearch assumes a service-linked role to access other cloud services or resources.
In most cases, the system automatically creates a service-linked role when you perform an operation. If automatic creation fails or is not supported, you must manually create the role.
RAM provides a system policy for each service-linked role. You cannot modify these policies. To view the content of a specific system policy, go to the details page of the corresponding service-linked role. For more information, see .
|
Service-linked role |
Service identifier |
Policy |
Use scenario |
|
AliyunServiceRoleForOpenSearch |
opensearch.aliyuncs.com |
AliyunServiceRolePolicyForOpenSearch |
When you use the data source feature of OpenSearch Industry Algorithm Edition or OpenSearch High-performance Search Edition, OpenSearch must be authorized to access the resources of ApsaraDB RDS, PolarDB, or PolarDB for Xscale (PolarDB-X). In this case, the AliyunServiceRoleForOpenSearch role can be used to grant the access permissions. |
|
AliyunServiceRoleForSearchEngine |
searchengine.aliyuncs.com |
AliyunServiceRolePolicyForSearchEngine |
When you use the data source feature of OpenSearch Vector Search Edition or OpenSearch Retrieval Engine Edition, OpenSearch must be authorized to access the resources of Object Storage Service (OSS) or Data Lake Formation (DLF). In this case, the AliyunServiceRoleForSearchEngine role can be used to grant the access permissions. |
Create a service-linked role
You can manually create a service-linked role in the RAM console or by calling an API operation. For more information, see Create a service-linked role and CreateServiceLinkedRole.
View the information about a service-linked role
After a service-linked role is created, you can go to the Roles page of the RAM console, search for AliyunServiceRoleForOpenSearch or AliyunServiceRoleForSearchEngine, and view the following information about the role:
-
Basic information
In the Basic Information section of the role details page, view basic information about the role, such as its name, creation time, Alibaba Cloud Resource Name (ARN), and description.
-
Permission policy
On the Permissions tab of the role details page, click a policy name to view its content and the cloud resources it can access.
NoteA service-linked role's policy can be viewed only on the role's details page, not on the Policies page in the RAM console.
-
Trust policy
On the Trust Policy Management tab of the role details page, view the trust policy. A trust policy defines the trusted entities that can assume a RAM role. For a service-linked role, the trusted entity is a cloud service, identified by the
Servicefield in the trust policy.
For more information, see View the information about a RAM role.
Delete a service-linked role
After a service-linked role is deleted, the features that depend on the role cannot be used. Proceed with caution.
To delete the AliyunServiceRoleForOpenSearch or AliyunServiceRoleForSearchEngine role, first release the associated OpenSearch application. For more information, see Delete a service-linked role.