服務(wù)關(guān)聯(lián)角色
本文介紹云消息隊(duì)列 RabbitMQ 版服務(wù)關(guān)聯(lián)角色的背景信息，權(quán)限策略、注意事項(xiàng)和常見問題。
背景信息
服務(wù)關(guān)聯(lián)角色是某個(gè)云服務(wù)在某些情況下，為了完成自身的某個(gè)功能，需要獲取其他云服務(wù)的訪問權(quán)限而提供的RAM角色。您在該云服務(wù)的控制臺(tái)首次使用該功能時(shí)，系統(tǒng)會(huì)提示您完成服務(wù)關(guān)聯(lián)角色的自動(dòng)創(chuàng)建。更多服務(wù)關(guān)聯(lián)角色相關(guān)信息，請(qǐng)參見服務(wù)關(guān)聯(lián)角色。
云消息隊(duì)列 RabbitMQ 版提供以下服務(wù)關(guān)聯(lián)角色：
服務(wù)關(guān)聯(lián)角色 | ServiceName | 內(nèi)容 |
AliyunServiceRoleForAmqpMonitoring | monitoring.amqp.aliyuncs.com | 云消息隊(duì)列 RabbitMQ 版通過扮演該RAM角色，獲取云監(jiān)控和阿里云應(yīng)用實(shí)時(shí)監(jiān)控服務(wù)ARMS的權(quán)限，以實(shí)現(xiàn)自身的監(jiān)控報(bào)警和Dashboard功能。您在云消息隊(duì)列 RabbitMQ 版控制臺(tái)首次使用監(jiān)控報(bào)警和Dashboard時(shí)，系統(tǒng)會(huì)提示您完成AliyunServiceRoleForAmqpMonitoring的自動(dòng)創(chuàng)建。更多信息，請(qǐng)參見監(jiān)控指標(biāo)和Dashboard。 |
AliyunServiceRoleForAmqpLogDelivery | logdelivery.amqp.aliyuncs.com | 云消息隊(duì)列 RabbitMQ 版通過扮演該RAM角色，獲取日志服務(wù)的訪問權(quán)限，以實(shí)現(xiàn)自身的消息日志功能。您在云消息隊(duì)列 RabbitMQ 版控制臺(tái)首次使用消息日志時(shí)，系統(tǒng)會(huì)提示您完成AliyunServiceRoleForAmqpLogDelivery的自動(dòng)創(chuàng)建。更多信息，請(qǐng)參見配置消息日志。 |
AliyunServiceRoleForAmqpNetwork | network.amqp.aliyuncs.com | 允許云消息隊(duì)列 RabbitMQ 版使用此角色訪問您的私網(wǎng)連接（PrivateLink）服務(wù)完成專有網(wǎng)絡(luò)VPC相關(guān)功能。您在云消息隊(duì)列 RabbitMQ 版控制臺(tái)首次使用私網(wǎng)連接接入點(diǎn)時(shí)，系統(tǒng)會(huì)提示您完成創(chuàng)建。 |
AliyunServiceRoleForAmqpEncrypt | encrypt.amqp.aliyuncs.com | 允許云消息隊(duì)列 RabbitMQ 版使用此角色訪問您的KMS服務(wù)完成存儲(chǔ)加密相關(guān)功能。您在云消息隊(duì)列 RabbitMQ 版控制臺(tái)購(gòu)買獨(dú)享加密實(shí)例時(shí)，系統(tǒng)會(huì)提示您完成創(chuàng)建。如果您為RAM用戶，也可以在OpenAPI使用CreateServiceLinkedRole接口創(chuàng)建。 |
權(quán)限策略
AliyunServiceRoleForAmqpMonitoring的權(quán)限策略如下：
{ "Version": "1", "Statement": [ { "Action": [ "cms:DescribeMetricRuleList", "cms:DescribeMetricList", "cms:DescribeMetricData" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "arms:OpenVCluster", "arms:ListDashboards", "arms:CheckServiceStatus" ], "Resource": "*", "Effect": "Allow" }, { "Action": "ram:DeleteServiceLinkedRole", "Resource": "*", "Effect": "Allow", "Condition": { "StringEquals": { "ram:ServiceName": "monitoring.amqp.aliyuncs.com" } } } ] }AliyunServiceRoleForAmqpLogDelivery的權(quán)限策略如下：
{ "Version": "1", "Statement": [ { "Action": [ "log:ListProject", "log:ListLogStores", "log:PostLogStoreLogs" ], "Resource": "*", "Effect": "Allow" }, { "Action": "ram:DeleteServiceLinkedRole", "Resource": "*", "Effect": "Allow", "Condition": { "StringEquals": { "ram:ServiceName": "logdelivery.amqp.aliyuncs.com" } } } ] }AliyunServiceRoleForAmqpNetwork的權(quán)限策略如下：
{ "Version": "1", "Statement": [ { "Action": [ "privatelink:GetVpcEndpointServiceAttribute", "privatelink:ListVpcEndpointServices", "privatelink:DeleteVpcEndpoint", "privatelink:CreateVpcEndpoint", "privatelink:UpdateVpcEndpointAttribute", "privatelink:ListVpcEndpoints", "privatelink:GetVpcEndpointAttribute", "privatelink:ListVpcEndpointServicesByEndUser", "privatelink:AddZoneToVpcEndpoint", "privatelink:ListVpcEndpointZones", "privatelink:RemoveZoneFromVpcEndpoint", "privatelink:AttachSecurityGroupToVpcEndpoint", "privatelink:ListVpcEndpointSecurityGroups", "privatelink:DetachSecurityGroupFromVpcEndpoint", "privatelink:UpdateVpcEndpointZoneConnectionResourceAttribute" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "vpc:DescribeVpcAttribute", "vpc:DescribeVpcs", "vpc:ListVSwitchCidrReservations", "vpc:GetVSwitchCidrReservationUsage", "vpc:DescribeVSwitches", "vpc:DescribeVSwitchAttributes", "Ecs:CreateSecurityGroup", "Ecs:DeleteSecurityGroup", "Ecs:DescribeSecurityGroupAttribute", "Ecs:DescribeSecurityGroups" ], "Resource": "*", "Effect": "Allow" }, { "Action": "ram:DeleteServiceLinkedRole", "Resource": "*", "Effect": "Allow", "Condition": { "StringEquals": { "ram:ServiceName": "network.amqp.aliyuncs.com" } } }, { "Action": "ram:CreateServiceLinkedRole", "Resource": "*", "Effect": "Allow", "Condition": { "StringEquals": { "ram:ServiceName": "privatelink.aliyuncs.com" } } } ] }AliyunServiceRoleForAmqpEncrypt的權(quán)限策略如下：
{ "Version": "1", "Statement": [ { "Action": [ "kms:List*", "kms:DescribeKey", "kms:TagResource", "kms:UntagResource" ], "Resource": [ "acs:kms:*:*:*" ], "Effect": "Allow" }, { "Action": [ "kms:Encrypt", "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": [ "acs:kms:*:*:*" ], "Effect": "Allow", "Condition": { "StringEqualsIgnoreCase": { "kms:tag/acs:rabbitmq:instance-encryption": "true" } } }, { "Action": "ram:DeleteServiceLinkedRole", "Resource": "*", "Effect": "Allow", "Condition": { "StringEquals": { "ram:ServiceName": "encrypt.amqp.aliyuncs.com" } } } ] }
注意事項(xiàng)
如果您刪除了自動(dòng)創(chuàng)建的服務(wù)關(guān)聯(lián)角色，該服務(wù)關(guān)聯(lián)角色相關(guān)的功能由于權(quán)限不足將無法再被使用，請(qǐng)謹(jǐn)慎操作。如需重新創(chuàng)建該服務(wù)關(guān)聯(lián)角色并為其授權(quán)，請(qǐng)參見創(chuàng)建可信實(shí)體為阿里云服務(wù)的RAM角色和為RAM角色授權(quán)。
常見問題
為什么我的RAM用戶無法自動(dòng)創(chuàng)建云消息隊(duì)列 RabbitMQ 版服務(wù)關(guān)聯(lián)角色？
如果您的阿里云賬號(hào)已經(jīng)創(chuàng)建了服務(wù)關(guān)聯(lián)角色，您的RAM用戶就會(huì)繼承該阿里云賬號(hào)的服務(wù)關(guān)聯(lián)角色。如果沒有繼承，請(qǐng)登錄訪問控制控制臺(tái)為RAM用戶添加自定義權(quán)限策略，權(quán)限策略內(nèi)容如下：
{
"Statement": [
{
"Action": [
"ram:CreateServiceLinkedRole"
],
"Resource": "acs:ram:*:${accountid}:role/*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": [
"logdelivery.amqp.aliyuncs.com",
"monitoring.amqp.aliyuncs.com",
"network.amqp.aliyuncs.com",
"encrypt.amqp.aliyuncs.com"
]
}
}
}
],
"Version": "1"
}請(qǐng)將${accountid}替換為您的阿里云賬號(hào)ID。
如果您的RAM用戶被授予該權(quán)限策略后，仍然無法自動(dòng)創(chuàng)建服務(wù)關(guān)聯(lián)角色，請(qǐng)為該RAM用戶授予權(quán)限策略AliyunAMQPFullAccess。具體操作，請(qǐng)參見為RAM用戶授權(quán)。