E-HPC服务关联角色

使用E-HPC时,必须创建服务关联角色AliyunServiceRoleForEHPC并授权AliyunServiceRolePolicyForEHPC。本文介绍如何创建、查看和删除AliyunServiceRoleForEHPC。

功能概述

服务关联角色SLR(Service-linked role)是一种可信实体为阿里云服务的RAM角色,旨在解决跨云服务的授权访问问题。更多信息,请参见服务关联角色

使用E-HPC时,系统提供的服务关联角色及其包含的系统权限策略如下:

  • 服务关联角色:AliyunServiceRoleForEHPC

  • 系统权限策略:AliyunServiceRolePolicyForEHPC

应用场景

AliyunServiceRoleForEHPC用于授权E-HPC访问关联云资源。通过AliyunServiceRoleForEHPC,E-HPC可以获得云服务器ECS、专有网络VPC、文件存储NAS的访问权限。

RAM用户使用服务关联角色需要的权限

如果使用RAM用户创建或删除服务关联角色,必须使用阿里云账号为该RAM用户授权。

  • 方式一:授予AliyunEHPCFullAccess权限策略,该权限策略包含了创建和删除AliyunServiceRoleForEHPC的权限。

  • 方式二:在自定义权限策略的Action语句中为RAM用户添加以下权限:

    • 创建服务关联角色:ram:CreateServiceLinkedRole

    • 删除服务关联角色:ram:DeleteServiceLinkedRole

关于授权的详细操作,请参见创建和删除服务关联角色所需的权限

创建服务关联角色

在您使用E-HPC时,系统会检查当前账号是否已有AliyunServiceRoleForEHPC,如果不存在则会弹出提示,在您确认提示信息后系统会自动创建AliyunServiceRoleForEHPC。

重要

AliyunServiceRoleForEHPC创建成功后,E-HPC可以通过角色扮演的方式跨服务访问对应云资源,可能会因创建ECS实例、NAS文件系统等资源而产生资费,请您知悉。

AliyunServiceRoleForEHPC包含系统权限策略AliyunServiceRolePolicyForEHPC,您无法添加、修改或删除权限。

展开查看AliyunServiceRolePolicyForEHPC权限内容

{
  "Version": "1",
  "Statement": [
    {
      "Action": [
        "ecs:RunInstances",
        "ecs:DescribeInstances",
        "ecs:DescribeInstanceTypes",
        "ecs:DescribeKeyPairs",
        "ecs:DescribeSecurityGroups",
        "ecs:DescribePrice",
        "ecs:DescribeZones",
        "ecs:DescribeAvailableResource",
        "ecs:DescribeCloudAssistantStatus",
        "ecs:CreateSecurityGroup",
        "ecs:DescribeImages",
        "ecs:AttachKeyPair",
        "ecs:ModifyInstanceAttribute",
        "ecs:StartInstance",
        "ecs:StopInstance",
        "ecs:DeleteInstance",
        "ecs:CreateInstance",
        "ecs:ReplaceSystemDisk",
        "ecs:RebootInstance",
        "ecs:AuthorizeSecurityGroup",
        "ecs:RevokeSecurityGroup",
        "ecs:CreateHpcCluster",
        "ecs:ModifyHpcClusterAttribute",
        "ecs:DeleteHpcCluster",
        "ecs:DescribeHpcClusters",
        "ecs:DeleteSecurityGroup",
        "ecs:DescribeDisks",
        "ecs:ReInitDisk",
        "ecs:CreateCommand",
        "ecs:InvokeCommand",
        "ecs:StopInvocation",
        "ecs:DeleteCommand",
        "ecs:DescribeCommands",
        "ecs:ModifyCommand",
        "ecs:DescribeInvocations",
        "ecs:DescribeInvocationResults",
        "ecs:CreateNetworkInterface",
        "ecs:DescribeNetworkInterfaces",
        "ecs:CreateNetworkInterfacePermission",
        "ecs:DescribeNetworkInterfacePermissions",
        "ecs:AttachNetworkInterface",
        "ecs:DeleteNetworkInterface",
        "ecs:DeleteNetworkInterfacePermission",
        "ecs:DescribeResourceAllocation",
        "ecs:TagResources",
        "ecs:DescribeManagedInstances",
        "eci:BatchCreateContainerGroups",
        "eci:CreateContainerGroup"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "vpc:DescribeVpcs",
        "vpc:DescribeVSwitches",
        "vpc:AllocateEipAddress",
        "vpc:DescribeEipAddresses",
        "vpc:AssociateEipAddress",
        "vpc:DescribeVSwitches",
        "vpc:ReleaseEipAddress",
        "vpc:CreateVpc",
        "vpc:CreateVSwitch"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "nas:DescribeFileSystems",
        "nas:DescribeMountTargets",
        "nas:CreateFileSystem",
        "nas:CreateMountTarget",
        "nas:CreateAccessGroup",
        "nas:CreateAccessRule",
        "nas:DeleteAccessGroup",
        "nas:DeleteAccessRule",
        "nas:DescribeAccessGroups",
        "nas:DescribeAccessRules",
        "nas:ModifyFileSystem",
        "nas:UpdateFileSystemInfo",
        "nas:CPFSCreateFileSystem",
        "nas:CPFSDescribeFileSystems",
        "nas:CPFSModifyFileSystem",
        "nas:CreateLDAPConfig",
        "nas:DeleteLDAPConfig",
        "nas:DescribeLDAPConfig"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "ecd:CreateRAMDirectory",
        "ecd:CreateADConnectorDirectory",
        "ecd:DescribeDirectories",
        "ecd:DeleteDirectories",
        "ecd:CreateBundle",
        "ecd:DescribeBundles",
        "ecd:DeleteBundles",
        "ecd:ListDirectoryUsers",
        "ecd:ModifyEntitlement",
        "ecd:CreatePolicyGroup",
        "ecd:DescribePolicyGroups",
        "ecd:ModifyPolicyGroup",
        "ecd:DeletePolicyGroups",
        "ecd:CreateDesktops",
        "ecd:DescribeDesktops",
        "ecd:RebootDesktops",
        "ecd:DeleteDesktops",
        "ecd:DescribeDesktopTypes",
        "ecd:StartDesktops",
        "ecd:StopDesktops",
        "ecd:CreateImage",
        "ecd:DescribeImages",
        "ecd:DeleteImages",
        "ecd:DescribeRegions",
        "ecd:DescribeZones",
        "ecd:GetConnectionTicket"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "ess:CreateScalingGroup",
        "ess:ModifyScalingGroup",
        "ess:EnableScalingGroup",
        "ess:DisableScalingGroup",
        "ess:DeleteScalingGroup",
        "ess:SetGroupDeletionProtection",
        "ess:DescribeScalingGroups",
        "ess:DescribeScalingInstances",
        "ess:DescribeScalingActivities",
        "ess:DescribeScalingConfiguration",
        "ess:DescribeScalingRules",
        "ess:CreateScalingConfiguration",
        "ess:ModifyScalingConfiguration",
        "ess:DeleteScalingConfiguration",
        "ess:CreateScalingRule",
        "ess:ModifyScalingRule",
        "ess:DeleteScalingRule",
        "ess:ExecuteScalingRule",
        "ess:AttachInstances",
        "ess:DetachInstances",
        "ess:RemoveInstances",
        "ess:CreateScheduledTask",
        "ess:DeleteScheduledtask",
        "ess:ModifyScheduledTask",
        "ess:DescribeLimitation",
        "ess:CreateLifecycleHook",
        "ess:CompleteLifecycleAction",
        "ess:DeleteLifecycleHook",
        "ess:TagResources",
        "ess:ScaleWithAdjustment"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "cms:CreateDynamicTagGroup",
        "cms:DescribeMonitorGroups",
        "cms:DeleteDynamicTagGroup",
        "cms:DeleteMonitorGroup",
        "cms:DescribeContactGroupList",
        "cms:DescribeDynamicTagRuleList"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": "acm:DescribePrice",
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": "ram:PassRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "acs:Service": "ecs.aliyuncs.com"
        }
      }
    },
    {
      "Action": "ram:CreateServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": [
            "ess.aliyuncs.com",
            "gws.aliyuncs.com",
            "eci.aliyuncs.com"
          ]
        }
      }
    },
    {
      "Action": "ram:DeleteServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "ehpc.aliyuncs.com"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "eci:RestartContainerGroup",
        "eci:DeleteContainerGroup"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "eci:tag/product": [
            "E-HPC"
          ]
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "pvtz:AddZone",
        "pvtz:DescribeZoneInfo",
        "pvtz:BindZoneVpc",
        "pvtz:DescribeZoneVpcTree",
        "pvtz:DescribeZones",
        "pvtz:AddZoneRecord",
        "pvtz:DeleteZoneRecord",
        "pvtz:DescribeZoneRecords",
        "pvtz:UpdateZoneRecord",
        "pvtz:CheckZoneName",
        "pvtz:DeleteZone",
        "eci:DescribeContainerGroupEvents",
        "eci:DescribeContainerGroupMetric",
        "eci:DescribeContainerGroupStatus",
        "eci:DescribeContainerGroups",
        "eci:DescribeContainerLog",
        "eci:DescribeInstanceOpsRecords",
        "eci:DescribeMultiContainerGroupMetric",
        "eci:DescribeVirtualNodes",
        "eci:ExportContainerGroupTemplate",
        "eci:ListUsage"
      ],
      "Resource": "*"
    }
  ]
}

查看服务关联角色

当服务关联角色创建成功后,您可以在RAM控制台的角色页面,通过搜索AliyunServiceRoleForEHPC查看角色详情。

  • 基本信息

    在角色详情页面的基本信息区域,查看角色基本信息,包括角色名称、创建时间、角色ARN和备注等。

  • 权限策略

    在角色详情页面的权限管理页签,单击权限策略名称,查看权限策略内容以及该角色可授权访问哪些云资源。

  • 信任策略

    在角色详情页的信任策略页签,查看信任策略内容。信任策略是描述RAM角色可信实体的策略,可信实体是指可以扮演RAM角色的实体用户身份。服务关联角色的可信实体为云服务,您可以通过信任策略中的Service字段查看。

关于如何查看服务关联角色的详细操作,请参见查看RAM角色

删除服务关联角色

重要

删除服务关联角色后,依赖该角色的对应功能将无法正常使用,请谨慎删除。

当您长时间不使用E-HPC时,您可以在RAM控制台手动删除服务关联角色。具体操作,请参见删除RAM角色

删除AliyunServiceRoleForEHPC前,您需要满足以下条件:

  • 确定不再需要使用该服务关联角色,例如不需要创建集群和管理集群相关的云资源。

  • 已删除依赖该服务关联角色的E-HPC集群。具体操作,请参见释放集群