The Microservices Engine (MSE) service-linked role AliyunServiceRoleForMSE is a predefined RAM role that is designed to implement specific features. When you use MSE to implement specific features, you need to access or manage the resources of other Alibaba Cloud services of your account. This ensures that the capabilities in the microservices architecture can work as expected. Other Alibaba Cloud services include Virtual Private Cloud (VPC), Server Load Balancer (SLB), and Container Service for Kubernetes (ACK). After you create and assign the service-linked role to MSE, you can use the role to obtain and manage permissions on these services. This prevents manual allocation of complex and error-prone policies, simplifies the permission management process, and enhances security. This topic describes the MSE service-linked role AliyunServiceRoleForMSE and how to delete the role.
Scenarios
If you want MSE to access the resources of other Alibaba Cloud services, you can use the MSE service-linked role AliyunServiceRoleForMSE that is automatically created to obtain access permissions on these services. The services include Elastic Compute Service (ECS), VPC, Application Real-Time Monitoring Service (ARMS), SLB, ACK, Enterprise Distributed Application Service (EDAS), and Alibaba Cloud Service Mesh (ASM).
Permission description
AliyunServiceRoleForMSE has the following permissions:
Delete AliyunServiceRoleForMSE
When you use MSE, if you delete the MSE service-linked role AliyunServiceRoleForMSE, you cannot perform service testing or stress testing.
Log on to the Resource Access Management (RAM) console by using your Alibaba Cloud account. In the left-side navigation pane, choose Identities > Roles.
On the Roles page, enter AliyunServiceRoleForMSE in the search box and click the search icon to search for the role.
Click Delete Role in the Actions column of the role.
In the Delete Role message, enter the role name, and click Delete Role.
FAQ
Why is the MSE service-linked role AliyunServiceRoleForMSE not automatically created for my RAM user?
The AliyunServiceRoleForMSE role can be automatically created or deleted only if you have specific permissions. If the system does not automatically create the AliyunServiceRoleForMSE role for your RAM user, attach the following policy to your RAM user:
{
"Statement": [
{
"Action": [
"ram:CreateServiceLinkedRole"
],
"Resource": "acs:ram:*:Alibaba Cloud account ID:role/*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": [
"mse.aliyuncs.com"
]
}
}
}
],
"Version": "1"
}Replace Alibaba Cloud account ID with the ID of your Alibaba Cloud account.