Identity as a Service：IDaaS EIAM 服務關聯角色

背景資訊

IDaaS EIAM 服務關聯角色（AliyunServiceRoleForEiam）是在某些情況下，為了完成 IDaaS EIAM 自身的某個功能，需要擷取其他雲端服務的存取權限，而提供的RAM角色。更多關於服務關聯角色的資訊請參見服務關聯角色。

應用情境

• IDaaS EIAM 的專屬端點需要訪問您的 ECS、VPC 雲資源，允許 IDaaS 管理自身建立的輔助彈性網卡。基於該許可權，IDaaS 可以通過私網串連到 VPC 內的 AD、LDAP 或其它應用，無需開放公網連接埠。IDaaS 也可通過專屬端點 IP 訪問公網，從而滿足企業微信的可信 IP 要求。

• IDaaS EIAM 的憑據管理需要訪問您的 KMS 雲資源。基於該許可權，IDaaS 可將憑據安全地託管至憑據管家，實現憑據安全儲存和管理。

AliyunServiceRoleForEiam 介紹

角色名稱：AliyunServiceRoleForEiam

角色權限原則：AliyunServiceRolePolicyForEiam

許可權說明：

{
  "Version": "1",
  "Statement": [
    {
      "Action": [
        "ecs:CreateNetworkInterfacePermission",
        "ecs:DescribeNetworkInterfacePermissions",
        "ecs:DeleteNetworkInterfacePermission",
        "ecs:CreateNetworkInterface",
        "ecs:DeleteNetworkInterface",
        "ecs:DescribeNetworkInterfaces",
        "ecs:ModifyNetworkInterfaceAttribute",
        "ecs:DescribeNetworkInterfaceAttribute",
        "ecs:CreateSecurityGroup",
        "ecs:RevokeSecurityGroup",
        "ecs:DeleteSecurityGroup",
        "ecs:DescribeSecurityGroups",
        "ecs:DescribeSecurityGroupAttribute",
        "ecs:DescribeSecurityGroupReferences",
        "ecs:ModifySecurityGroupAttribute",
        "ecs:ModifySecurityGroupRule",
        "ecs:DetachNetworkInterface",
        "ecs:AttachNetworkInterface",
        "ecs:ModifySecurityGroupPolicy",
        "ecs:AuthorizeSecurityGroup",
        "ecs:DescribeInstances",
        "ecs:DescribeImages",
        "ecs:DescribeZones",
        "ecs:DescribeRegions",
        "ecs:DescribeTags"
      ],
      "Resource": "",
      "Effect": "Allow"
    },
    {
      "Action": [
        "vpc:DescribeVpcs",
        "vpc:DescribeVSwitches",
        "vpc:DescribeNatGateways",
        "vpc:DescribeSnatTableEntries"
      ],
      "Resource": "",
      "Effect": "Allow"
    },
    {
      "Effect": "Allow",
      "Action": [
        "kms:CreateSecret",
        "kms:DeleteSecret",
        "kms:DescribeSecret",
        "kms:PutSecretValue",
        "kms:UpdateSecret",
        "kms:UpdateSecretVersionStage",
        "kms:ListSecretVersionIds",
        "kms:GetSecretValue"
      ],
      "Resource": [
        "acs:kms:::secret/idaas-eiam!"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "kms:ListManagedQuotas",
        "kms:GenerateDataKey",
        "kms:Decrypt",
        "kms:TagResource",
        "kms:UntagResource"
      ],
      "Resource": [
        ""
      ]
    },
    {
      "Action": "ram:DeleteServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "eiam.aliyuncs.com"
        }
      }
    }
  ]
}

刪除服務關聯角色

如果您需要刪除 AliyunServiceRoleForEiam（服務關聯角色），需要先釋放所有 IDaaS EIAM 執行個體。

• 刪除 IDaaS EIAM 執行個體具體操作請參見釋放執行個體。

• 刪除服務關聯角色具體操作請參見刪除服務關聯角色。