PolarDB-X服务关联角色

背景信息

PolarDB-X服务关联角色AliyunServiceRoleForPolarDBX是PolarDB-X在某些情况下，为了完成自身的某个功能，需要获取其他云服务的访问权限而提供的RAM角色。更多关于服务关联角色的信息请参见服务关联角色。

AliyunServiceRoleForPolarDBX应用场景

PolarDB-X的部分功能在需要访问其他云服务的资源时，需通过服务关联角色功能获取访问权限。

• SQL审计与分析功能需要访问日志服务云服务。

• AI功能（智能巡检、虚拟节点VNode）需要访问容器服务 Kubernetes 版、云服务器ECS、专有网络VPC、云原生数据库PolarDB分布式版、数据库自治服务DAS云服务。

• 一键迁移RDS MySQL至PolarDB-X功能需要访问数据传输服务DTS云服务。

AliyunServiceRoleForPolarDBX介绍

• 角色名称：AliyunServiceRolePolicyForPolarDBX

• 角色权限策略：AliyunServiceRolePolicyForPolarDBX

• 权限说明:

  {
    "Statement": [
      {
        "Action": [
          "polardbx:DescribeDBPerformance",
          "polardbx:DescribeBackupPolicy",
          "polardbx:DescribeBackupSetList",
          "polardbx:DescribeDBInstanceTopology",
          "polardbx:DescribeDBInstances",
          "polardbx:DescribeDBInstanceAttribute",
          "polardbx:DescribeDBInstanceSSL",
          "polardbx:DescribeDBInstanceTDE",
          "polardbx:DescribeSecurityIps",
          "polardbx:DescribeSqlLogConfig",
          "polardbx:DescribeTasks",
          "polardbx:Chat",
          "polardbx:DescribeCustomEndpointList",
          "polardbx:DescribeAccountList",
          "polardbx:DescribeDBInstanceHA",
          "polardbx:DescribeDBInstanceConfig",
          "polardbx:DescribeCharacterSet",
          "polardbx:DescribeStoragePoolInfo",
          "polardbx:DescribeDbList",
          "polardbx:DescribeShowStorageInfo",
          "polardbx:DescribeParameters",
          "polardbx:DescribeParameterTemplates",
          "polardbx:DescribeCdcInfo",
          "polardbx:DescribeColumnarInfo",
          "polardbx:DescribeColumnarVersionList",
          "polardbx:DescribeColumnarClassList",
          "polardbx:DescribeAvailableCrossRegions",
          "polardbx:DescribeEnabledCrossRegions",
          "polardbx:DescribeBinaryLogList"
        ],
        "Resource": "*",
        "Effect": "Allow"
      },
      {
        "Action": [
          "log:GetProject",
          "log:ListLogStores",
          "log:GetIndex",
          "log:CreateProject",
          "log:GetLogStore",
          "log:CreateLogStore",
          "log:CreateIndex",
          "log:CreateDashboard",
          "log:CreateSavedSearch",
          "log:UpdateDashboard",
          "log:UpdateSavedSearch",
          "log:UpdateIndex",
          "dts:CreateDtsInstance",
          "dts:ConfigureDtsJob",
          "dts:StartDtsJob",
          "dts:DescribePreCheckStatus",
          "dts:DescribeDtsJobDetail",
          "dts:DescribeDtsJobs",
          "dts:ModifyDtsJob",
          "dts:SuspendDtsJob",
          "dts:StopDtsJob",
          "dts:DeleteDtsJob",
          "dts:CheckDefaultRole",
          "dts:ReverseTwoWayDirection"
        ],
        "Resource": "*",
        "Effect": "Allow"
      },
      {
        "Action": [
          "log:PostLogStoreLogs"
        ],
        "Resource": "acs:log:*:*:project/*/logstore/polardbx-sqlaudit-log",
        "Effect": "Allow"
      },
      {
        "Effect": "Allow",
        "Action": [
          "kms:GenerateAndExportDataKey",
          "kms:GenerateDataKey",
          "kms:GenerateDataKeyWithoutPlaintext"
        ],
        "Resource": "*"
      },
      {
        "Action": [
          "vpc:DescribeVpcAttribute",
          "vpc:DescribeVSwitches",
          "vpc:DescribeVSwitchAttributes",
          "vpc:DescribeVSwitches",
          "vpc:DescribeVpcs",
          "vpc:*Eip*",
          "vpc:*HighDefinitionMonitor*",
          "vpc:*PublicIpAddressPool*",
          "vpc:*HighDefinitionMonitor*",
          "ecs:CreateNetworkInterface",
          "ecs:DeleteNetworkInterface",
          "ecs:DescribeNetworkInterfaces",
          "ecs:CreateNetworkInterfacePermission",
          "ecs:DescribeNetworkInterfacePermissions",
          "ecs:DeleteNetworkInterfacePermission",
          "ecs:DescribeImages",
          "ecs:ModifyImageSharePermission",
          "ecs:CreateSecurityGroup",
          "ecs:DeleteSecurityGroup",
          "ecs:DescribeSecurityGroupAttribute",
          "ecs:DescribeSecurityGroups",
          "ecs:ModifySecurityGroupAttribute",
          "ecs:AuthorizeSecurityGroup",
          "ecs:AuthorizeSecurityGroupEgress",
          "ecs:RevokeSecurityGroup",
          "ecs:RevokeSecurityGroupEgress",
          "cs:DescribeClustersForRegion",
          "cs:DescribeClustersV1",
          "cs:DescribeClusterDetail",
          "cs:GetClusters",
          "cs:DescribeClusterDetail"
        ],
        "Resource": "*",
        "Effect": "Allow"
      },
      {
        "Action": [
          "hdm:Chat",
          "hdm:GetDasAgentSSE"
        ],
        "Effect": "Allow",
        "Resource": [
          "*"
        ]
      },
      {
        "Action": [
          "hdm:Get*",
          "hdm:Describe*",
          "hdm:Query*",
          "hdm:Support*"
        ],
        "Effect": "Allow",
        "Resource": "acs:polardbx:*:*:*"
      }
    ]
  }

删除AliyunServiceRoleForPolarDBX

如果您需要删除PolarDB-X服务关联角色AliyunServiceRoleForPolarDBX。例如，您出于安全考虑需要删除该角色，则需要先明确删除后的影响：删除AliyunServiceRoleForPolarDBX后，依赖该角色的功能（SQL审计与分析、AI功能、一键迁移RDS MySQL至PolarDB-X功能）将不能正常工作。

删除服务关联角色的具体操作，请参见服务关联角色。