This topic describes the service-linked role AliyunServiceRoleForVpn of VPN Gateway. When you create a VPN gateway or an IPsec-VPN connection associated with a transit router for the first time, the system automatically creates the service-linked role AliyunServiceRoleForVpn. This service-linked role allows a VPN gateway to access other cloud resources such as elastic network interfaces (ENIs) and security groups. This helps you create a VPN gateway or an IPsec-VPN connection.
Background information
An Alibaba Cloud service may need to access other services to implement a feature. In this case, the service must be authorized to access those services. For example, Cloud Config needs access to services like Elastic Compute Service (ECS) and ApsaraDB RDS to read your cloud resource information, such as resource lists and log data. To meet these requirements, Alibaba Cloud provides service-linked roles.
A service-linked role is a RAM role that is predefined by and linked to an Alibaba Cloud service, which simplifies cross-service authorization. In most cases, the linked service automatically creates or deletes the role when you use a specific feature. A service-linked role simplifies the process to authorize a service to access other services and reduces the risk of misconfiguration.
The policy that is attached to a service-linked role is predefined by the linked service. You cannot modify or delete the policy, nor can you attach policies to or detach policies from a service-linked role.
For more information, see Service-linked roles.
Create the service-linked role AliyunServiceRoleForVpn
When you create a VPN gateway or an IPsec-VPN connection associated with a transit router for the first time, the system automatically creates the service-linked role AliyunServiceRoleForVpn. This service-linked role helps you create a VPN gateway or an IPsec-VPN connection. If the service-linked role AliyunServiceRoleForVpn already exists, the system does not create it again.
For more information about how to create a VPN gateway, see VPN gateways.
For more information about how to create an IPsec-VPN connection, see the Modify an IPsec-VPN connection or Create a VPN connection.
A policy named AliyunServiceRolePolicyForVpn is attached to the service-linked role AliyunServiceRoleForVpn. This policy allows a VPN gateway to perform a series of operations. The policy contains the following permissions:
{
"Version": "1",
"Statement": [
{
"Action": [
"vpc:DescribeVSwitchAttributes",
"vpc:TagResources",
"vpc:DescribeRouteTableList"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"ecs:CreateNetworkInterface",
"ecs:CreateSecurityGroup",
"ecs:AuthorizeSecurityGroup",
"ecs:RevokeSecurityGroup",
"ecs:DeleteSecurityGroup",
"ecs:JoinSecurityGroup",
"ecs:LeaveSecurityGroup",
"ecs:DescribeSecurityGroups",
"ecs:AttachNetworkInterface",
"ecs:DetachNetworkInterface",
"ecs:DeleteNetworkInterface",
"ecs:DescribeNetworkInterfaces",
"ecs:CreateNetworkInterfacePermission",
"ecs:DescribeNetworkInterfacePermissions",
"ecs:DeleteNetworkInterfacePermission",
"ecs:CreateSecurityGroupPermission",
"ecs:AuthorizeSecurityGroupPermission",
"ecs:RevokeSecurityGroupPermission",
"ecs:JoinSecurityGroupPermission",
"ecs:DeleteSecurityGroupPermission",
"ecs:LeaveSecurityGroupPermission",
"ecs:DescribeSecurityGroupPermissions",
"ecs:AttachNetworkInterfacePermissions",
"ecs:DetachNetworkInterfacePermissions",
"ecs:AssignPrivateIpAddresses",
"ecs:UnassignPrivateIpAddresses",
"ecs:DescribeNetworkInterfaceAttribute"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": "ram:DeleteServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": "vpn.aliyuncs.com"
}
}
}
]
}Delete the service-linked role AliyunServiceRoleForVpn
You can delete the service-linked role AliyunServiceRoleForVpn only if no VPN gateway or IPsec-VPN connection exists within your Alibaba Cloud account. For more information, see the following sections of related topics:
VPN gateways section of the "Create and manage a VPN gateway" topic
Delete an IPsec-VPN connection section of the "Create and manage IPsec-VPN connections in single-tunnel mode" topic
Delete a service-linked role section of the "Service-linked roles" topic
FAQ
Why am I unable to create the service-linked role AliyunServiceRoleForVpn by using a Resource Access Management (RAM) user?
By default, an Alibaba Cloud account is authorized to create the service-linked role AliyunServiceRoleForVpn. If a RAM user wants to create the service-linked role, you must first use the Alibaba Cloud account to grant the required permissions to the RAM user.
You must create a custom policy and attach it to the RAM user. Then, the RAM user can create the service-linked role AliyunServiceRoleForVpn. The following code provides an example. For more information, see Create custom policies and Grant permissions to a RAM role.
{
"Statement": [
{
"Action": "ram:CreateServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": "vpn.aliyuncs.com"
}
}
}
],
"Version": "1"
}