Service-linked roles for Security Center

A service-linked role (SLR) is a RAM role whose trusted entity is an Alibaba Cloud service. Security Center uses SLRs to access other cloud services and resources.

SLRs are usually created automatically when you perform a related operation. If automatic creation fails, or if Security Center does not support automatic creation for an SLR, you must create the SLR manually.

RAM assigns an immutable system policy to each SLR. View policy details from the.

Scenarios

Security Center provides the following SLRs.

Service-linked role	Service identifier	Scenarios
AliyunServiceRoleForSas	sas.aliyuncs.com	Accesses Container Registry and ApsaraDB RDS to detect security risks in container assets. Accesses VPC and ECS resources for the cloud honeypot feature to detect attacks and trace attack sources. Accesses ECS resources for brute-force attack protection. Accesses Simple Log Service for log query and analysis. Accesses ECS instances, ECS snapshots, and ECS images. The agentless detection feature shares snapshots or images with the Security Center service account for security scanning. Accesses Cloud Backup and ECS for anti-ransomware protection and data backup. Accesses Resource Directory for management and delegated administrator accounts. Enables the multi-account security management feature to centrally manage security risks across member accounts. Accesses OSS resources for malicious file detection to scan files for viruses. Accesses Key Management Service (KMS) resources to decrypt and scan OSS files encrypted with SSE-KMS.
AliyunServiceRoleForSasCloudSiem	cloudsiem.sas.aliyuncs.com	Accesses VPC and Cloud Firewall resources for threat analysis and response to collect and deliver logs, handle events, and analyze threats. This provides capabilities such as centralized alert management and threat source analysis.
AliyunServiceRoleForSasCspm	cspm.sas.aliyuncs.com	Accesses ActionTrail resources for Cloud Security Posture Management (CSPM) configuration checks.
AliyunServiceRoleForSasRd	rd.sas.aliyuncs.com	In multi-account scenarios, allows a delegated administrator account to access member account consoles in a resource directory. Enables centralized security configuration and real-time risk monitoring across member accounts.
AliyunServiceRoleForAntiRansomwareMssp	antiransomware.mssp.aliyuncs.com	After you purchase the managed anti-ransomware service, allows experts to access Security Center and other cloud resources to monitor anti-ransomware backup jobs.
AliyunServiceRoleForSasSecurityLake	security-lake.sas.aliyuncs.com	Accesses OSS and Data Lake Formation (DLF) resources for the threat analysis cold data feature to manage log data and run interactive queries.
AliyunServiceRoleForSasSecllm	secllm.sas.aliyuncs.com	Allows the Security Center intelligent assistant to query security scores, vulnerability lists, and other data for asset-specific insights.
AliyunServiceRoleForSasAgentless	agentless.sas.aliyuncs.com	Scans encrypted ECS disks for the agentless detection feature to detect vulnerabilities, malicious files, and baseline issues.

Create a service-linked role

AliyunServiceRoleForSas

The system automatically creates this SLR when you first use one of the following features and grant permissions.

Module	Features
Risk governance	Malicious file detection Log analysis
Container security	Container assets Container image scan Container image signing Threat detection for Kubernetes
Host security	Cloud honeypot Brute-force attacks protection Agentless detection Anti-ransomware Virus scan Adaptive threat detection
Other configurations	Task Hub Multi-account security management

AliyunServiceRoleForSasCloudSiem

Created automatically when you first use threat analysis and response and grant permissions.Grant the threat analysis and response feature the permissions to access Alibaba Cloud resources.

AliyunServiceRoleForSasCspm

Created automatically when you first use Cloud Security Posture Management and grant permissions.

Note

Since November 21, 2022 (UTC+8), the CSPM access policy migrated from AliyunServiceRoleForSas to AliyunServiceRoleForSasCspm. To migrate, go to the Cloud Security Posture Management page. In the Role Policy Migration Reminder dialog box, click OK, then click Authorize Now to authorize.

AliyunServiceRoleForSasRd

Created automatically under a member account when a management or delegated administrator account uses multi-account security management to add the member to the monitored list.

AliyunServiceRoleForAntiRansomwareMssp

Created automatically when you first use the anti-ransomware service or purchase the managed anti-ransomware service.

AliyunServiceRoleForSasSecllm

Created automatically when you first use the Security Center intelligent assistant and grant permissions.

AliyunServiceRoleForSasAgentless

Created automatically when you first use the agentless detection feature and grant permissions.

View a service-linked role

After creating an SLR, view its details on the Roles page of the RAM console:

Basic information

The Basic Information section shows the role name, creation time, ARN, and description.
Access policy

On the Permissions tab, click the policy name to view the policy document.

Note
SLR access policies are only visible from the role details page, not from the Policies page.
Trust policy

The Trust Policy tab shows which Alibaba Cloud service can assume the role. Check the Service field.

View a RAM role.

Delete a service-linked role

AliyunServiceRoleForSas follows the principle of least privilege. It contains only the system policy AliyunServiceRolePolicyForSas, which grants the permissions that Security Center requires for its security features. The trust policy of this role allows only the sas.aliyuncs.com service to assume it. No other service or identity can assume this role, so retaining the role does not introduce security risks.

Important

Deleting an SLR disables all features that depend on it.

If you no longer use Security Center for an extended period or before you log off from your Alibaba Cloud account, you may need to manually delete the SLR. To delete an SLR, go to the RAM console. Delete a RAM role.

References

Service-linked roles.