Service-linked role

Background

The AliyunServiceRoleForSelectDB role is a RAM role that ApsaraDB for SelectDB assumes to access other cloud services on your behalf. For more information about service-linked roles, see Service-linked roles.

Use cases

AliyunServiceRoleForSelectDB grants access to the following services:

• Access ECS: ApsaraDB for SelectDB instances use ECS to obtain and manage compute resources.

• Access VPC: ApsaraDB for SelectDB uses VPC to provide and manage its network environment.

• Access SLB: ApsaraDB for SelectDB uses SLB to provide load balancing.

• Access ARMS: ApsaraDB for SelectDB uses ARMS to provide monitoring and alerting.

AliyunServiceRoleForSelectDB

• Role name: AliyunServiceRoleForSelectDB

• Policy: AliyunServiceRolePolicyForSelectDB

• Permissions:

  {
    "Statement": [
      {
        "Action": [
          "log:GetProject",
          "log:ListProject",
          "log:GetCursor",
          "log:GetCursorTime",
          "log:GetLogs",
          "log:GetHistograms",
          "log:GetContextLogs",
          "log:PullLogs",
          "log:GetLogStoreLogs",
          "log:GetLogStoreHistogram",
          "log:GetLogStore",
          "log:ListLogStores",
          "log:GetCursorOrData",
          "log:ListShards",
          "log:GetConfig",
          "log:ListConfig",
          "log:GetShipperStatus",
          "log:GetCheckPoint",
          "log:HeartBeat",
          "log:UpdateCheckPoint",
          "log:PostLogStoreLogs",
          "log:CreateConsumerGroup",
          "log:UpdateConsumerGroup",
          "log:DeleteConsumerGroup",
          "log:ListConsumerGroup",
          "log:ConsumerGroupUpdateCheckPoint",
          "log:ConsumerGroupHeartBeat",
          "log:GetConsumerGroupCheckPoint",
          "log:CreateExport",
          "log:GetExport",
          "log:ListExport",
          "log:UpdateExport",
          "log:DeleteExport",
          "log:CreateJob",
          "log:GetJob",
          "log:ListJobs",
          "log:UpdateJob",
          "log:DeleteJob",
          "ecs:AttachNetworkInterface",
          "ecs:AuthorizeSecurityGroup",
          "ecs:CreateNetworkInterface",
          "ecs:CreateNetworkInterfacePermission",
          "ecs:CreateRouteEntry",
          "ecs:CreateSecurityGroup",
          "ecs:DeleteNetworkInterface",
          "ecs:DeleteNetworkInterfacePermission",
          "ecs:DeleteRouteEntry",
          "ecs:DeleteSecurityGroup",
          "ecs:DescribeInstanceAttribute",
          "ecs:DescribeInstanceStatus",
          "ecs:DescribeInstanceTypeFamilies",
          "ecs:DescribeInstanceTypes",
          "ecs:DescribeInstances",
          "ecs:DescribeInstancesFullStatus",
          "ecs:DescribeNetworkInterfaceAttribute",
          "ecs:DescribeNetworkInterfaces",
          "ecs:DescribeRegions",
          "ecs:DescribeSecurityGroupAttribute",
          "ecs:DescribeSecurityGroups",
          "ecs:DescribeZones",
          "ecs:DetachNetworkInterface",
          "ecs:ListTagResources",
          "ecs:ModifyNetworkInterfaceAttribute",
          "ecs:RevokeSecurityGroup",
          "ecs:TagResources",
          "ecs:UntagResources",
          "vpc:CreateRouteEntry",
          "vpc:DeleteRouteEntry",
          "vpc:DescribeRegions",
          "vpc:DescribeVSwitchAttributes",
          "vpc:DescribeVSwitches",
          "vpc:DescribeVpcAttribute",
          "vpc:DescribeVpcs",
          "vpc:DescribeZones",
          "vpc:ListTagResources",
          "vpc:ModifyBypassToaAttribute",
          "vpc:TagResources",
          "vpc:UntagResources",
          "selectdb:DescribeSecurityIPList",
          "selectdb:ModifySecurityIPList"
        ],
        "Resource": "*",
        "Effect": "Allow"
      },
      {
        "Action": "ram:DeleteServiceLinkedRole",
        "Resource": "*",
        "Effect": "Allow",
        "Condition": {
          "StringEquals": {
            "ram:ServiceName": "selectdb.aliyuncs.com"
          }
        }
      },
      {
        "Action": [
          "kms:Listkeys",
          "kms:Listaliases",
          "kms:ListResourceTags",
          "kms:DescribeKey",
          "kms:UntagResource",
          "kms:TagResource",
          "kms:DescribeAccountKmsStatus"
        ],
        "Resource": "*",
        "Effect": "Allow"
      },
      {
        "Action": [
          "kms:Encrypt",
          "kms:Decrypt",
          "kms:GenerateDataKey"
        ],
        "Resource": "*",
        "Effect": "Allow",
        "Condition": {
          "StringEqualsIgnoreCase": {
            "kms:tag/acs:selectdb:instance-encryption": "true"
          }
        }
      },
      {
        "Action": [
          "rds:ModifySecurityIps",
          "rds:DescribeDBInstanceNetInfo",
          "rds:DescribeDBInstanceIPArrayList"
        ],
        "Resource": "*",
        "Effect": "Allow"
      },
      {
        "Action": [
          "arms:CheckServiceStatus",
          "arms:OpenArmsService",
          "arms:GetPrometheusApiToken",
          "arms:OpenVCluster",
          "arms:ListDashboards"
        ],
        "Resource": "*",
        "Effect": "Allow"
      },
      {
        "Action": [
          "slb:AddBackendServers",
          "slb:AddTags",
          "slb:AddVServerGroupBackendServers",
          "slb:CreateLoadBalancer",
          "slb:CreateLoadBalancerForCloudService",
          "slb:CreateLoadBalancerHTTPListener",
          "slb:CreateLoadBalancerHTTPSListener",
          "slb:CreateLoadBalancerTCPListener",
          "slb:CreateLoadBalancerUDPListener",
          "slb:CreateVServerGroup",
          "slb:DeleteLoadBalancer",
          "slb:DeleteLoadBalancerListener",
          "slb:DeleteVServerGroup",
          "slb:DescribeTags",
          "slb:DescribeVServerGroups",
          "slb:DescribeLoadBalancers",
          "slb:DescribeVServerGroupAttribute",
          "slb:DescribeLoadBalancerAttribute",
          "slb:DescribeLoadBalancerHTTPSListenerAttribute",
          "slb:DescribeLoadBalancerHTTPListenerAttribute",
          "slb:DescribeLoadBalancerListeners",
          "slb:DescribeLoadBalancerTCPListenerAttribute",
          "slb:DescribeLoadBalancerUDPListenerAttribute",
          "slb:ModifyLoadBalancerInstanceSpec",
          "slb:ModifyLoadBalancerInternetSpec",
          "slb:ModifyVServerGroupBackendServers",
          "slb:RemoveBackendServers",
          "slb:RemoveTags",
          "slb:DescribeAccessControlLists",
          "slb:RemoveVServerGroupBackendServers",
          "slb:SetLoadBalancerHTTPListenerAttribute",
          "slb:SetLoadBalancerHTTPSListenerAttribute",
          "slb:SetLoadBalancerTCPListenerAttribute",
          "slb:SetLoadBalancerUDPListenerAttribute",
          "slb:SetLoadBalancerModificationProtection",
          "slb:SetLoadBalancerDeleteProtection",
          "slb:SetVServerGroupAttribute",
          "slb:ServiceManagedControl",
          "slb:StartLoadBalancerListener",
          "slb:StopLoadBalancerListener",
          "slb:DeleteAccessControlList",
          "slb:CreateAccessControlList",
          "slb:DescribeAccessControlListAttribute",
          "slb:AddAccessControlListEntry",
          "slb:RemoveAccessControlListEntry"
        ],
        "Resource": "*",
        "Effect": "Allow"
      },
      {
        "Action": [
          "pvtz:DescribeUserServiceStatus",
          "pvtz:DescribeZones"
        ],
        "Resource": "*",
        "Effect": "Allow"
      },
      {
        "Effect": "Allow",
        "Action": [
          "bssapi:QueryAvailableInstances"
        ],
        "Resource": "*"
      },
      {
        "Action": "bss:DescribeAcccount",
        "Resource": "*",
        "Effect": "Allow"
      },
      {
        "Effect": "Allow",
        "Action": [
          "bssapi:CreateInstance"
        ],
        "Resource": "*",
        "Condition": {
          "StringEquals": {
            "bssapi:ProductCode": "pvtz",
            "bssapi:ProductType": [
              "pvtzpost"
            ]
          }
        }
      },
      {
        "Action": "ram:CreateServiceLinkedRole",
        "Resource": "*",
        "Effect": "Allow",
        "Condition": {
          "StringEquals": {
            "ram:ServiceName": "eipaccess.slb.aliyuncs.com"
          }
        }
      }
    ],
    "Version": "1"
  }

Create the service-linked role

If you have not created the ApsaraDB for SelectDB service-linked role AliyunServiceRoleForSelectDB, the Activate ApsaraDB for SelectDB dialog box appears each time you open the ApsaraDB for SelectDB console. After clicking OK, the system automatically creates the role.

Delete the service-linked role

To delete the AliyunServiceRoleForSelectDB service-linked role, go to the RAM console. For instructions, see Delete a RAM role.