This topic describes the AliyunServiceRoleForXtrace service-linked role for Managed Service for OpenTelemetry and how to delete this role.
Background information
The AliyunServiceRoleForXtrace service-linked role is a Resource Access Management (RAM) role that Managed Service for OpenTelemetry assumes to access other Alibaba Cloud services to implement a Managed Service for OpenTelemetry feature in specific scenarios. For more information, see Service-linked roles.
Scenarios
If the monitoring feature of Managed Service for OpenTelemetry needs to access the resources of Container Service for Kubernetes (ACK), Log Service, Elastic Compute Service (ECS), and Virtual Private Cloud (VPC), Managed Service for OpenTelemetry can assume the AliyunServiceRoleForXtrace role that is automatically created to obtain access permissions.
Permissions
Delete the AliyunServiceRoleForXtrace role
To ensure security, you can delete the AliyunServiceRoleForXtrace role after you enable the monitoring feature of Managed Service for OpenTelemetry. After you delete the role, the data of the current account cannot be stored and displayed. Proceed with caution when you delete the service-linked role.
To delete the AliyunServiceRoleForXtrace role, perform the following steps:
If application data exists in the current account, you must delete all applications before you can delete the AliyunServiceRoleForXtrace role.
Log on to the RAM console. In the left-side navigation pane, choose .
On the Roles page, enter AliyunServiceRoleForXtrace in the search box. The RAM role named AliyunServiceRoleForXtrace is returned in the search result.
Click Delete Role in the Actions column.
In the Delete Role dialog box, enter the role name that you want to delete, and click Delete Role.
If one or more Managed Service for OpenTelemetry applications exist in the current account, you must delete the applications before you can delete the AliyunServiceRoleForXtrace role. Otherwise, an error message appears.
If all applications in the current account are deleted, you can delete the AliyunServiceRoleForXtrace role.
FAQ
Why is the system unable to automatically create the AliyunServiceRoleForXtrace service-linked role and assign the role to my RAM user?
To enable the system to automatically create or delete the AliyunServiceRoleForXtrace role, you must obtain the specified permissions. If the system does not automatically create the AliyunServiceRoleForXtrace role and assign the role to your RAM user, attach the following policy to your RAM user:
{
"Statement": [
{
"Action": [
"ram:CreateServiceLinkedRole"
],
"Resource": "acs:ram:*:ID of your Alibaba Cloud account:role/*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": [
"xtrace.aliyuncs.com"
]
}
}
}
],
"Version": "1"
}