Manage a service-linked role

Scenarios

When you use Network Quality Analyzer, the AliyunServiceRoleForIpaDataSync service-linked role is required. Alibaba Cloud automatically creates this role to allow Network Quality Analyzer to create related Simple Log Service (SLS) projects and Logstores, and to read and write network probing data. For more information, see Service-linked roles.

The AliyunServiceRoleForIpaDataSync role

• Role name: AliyunServiceRoleForIpaDataSync

• Role policy: AliyunServiceRolePolicyForIpaDataSync

• Permission description: Allows Network Quality Analyzer to create related SLS projects and Logstores, and to read and write network probing data.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "log:CreateProject",
                "log:ListProject",
                "log:GetProject"
            ],
            "Resource": "acs:log:*:*:project/*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "log:CreateDashboard",
                "log:UpdateDashboard"
            ],
            "Resource": "acs:log:*:*:project/*/dashboard/dashboard-*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "log:CreateSavedSearch",
                "log:UpdateSavedSearch"
            ],
            "Resource": "acs:log:*:*:project/*/savedsearch/savedsearch-*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "log:CreateLogStore",
                "log:GetLogStore",
                "log:UpdateLogStore",
                "log:GetIndex",
                "log:CreateIndex",
                "log:UpdateIndex",
                "log:ListShards",
                "log:GetCursorOrData",
                "log:GetConsumerGroupCheckPoint",
                "log:ConsumerGroupHeartBeat",
                "log:ConsumerGroupUpdateCheckPoint",
                "log:ListConsumerGroup",
                "log:CreateConsumerGroup",
                "log:UpdateConsumerGroup",
                "log:PostLogStoreLogs",
                "log:DeleteConsumerGroup"
            ],
            "Resource": [
                "acs:log:*:*:project/*/logstore/ipa-*",
                "acs:log:*:*:project/*/logstore/ipa-*/*"
            ]
        },
        {
            "Action": "ram:DeleteServiceLinkedRole",
            "Resource": "*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": "data-sync.ipa.aliyuncs.com"
                }
            }
        }
    ]
}

Delete the AliyunServiceRoleForIpaDataSync role

1. Before you delete the AliyunServiceRoleForIpaDataSync role, you must delete all associated endpoint applications. For more information, see Related operations.

2. Delete the AliyunServiceRoleForIpaDataSync role. For more information, see Delete a RAM role.

FAQ

• Question: Why isn't the AliyunServiceRoleForIpaDataSync role automatically created when a Resource Access Management (RAM) user uses Network Quality Analyzer?

• Possible cause: The RAM user does not have the required permissions.

• Solution: Add the following access policy to the RAM user. For more information, see Create a custom policy and Manage RAM user permissions.

  In the policy, replace Alibaba Cloud account ID with your Alibaba Cloud account ID. You can find your Alibaba Cloud account ID in the Account Center.

{
    "Statement": [
        {
            "Action": [
                "ram:CreateServiceLinkedRole"
            ],
            "Resource": "acs:ram:*:Alibaba Cloud account ID:role/*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": [
                        "data-sync.ipa.aliyuncs.com"
                    ]
                }
            }
        }
    ],
    "Version": "1"
}