Skip to main content

Quanmiao service-linked roles

This topic describes the service-linked roles for Quanmiao and how to delete them.

Background information

In some scenarios, Quanmiao uses service-linked roles (SLRs) to access other Alibaba Cloud services, such as Object Storage Service (OSS) and Intelligent Media Services (IMS). An SLR is a Resource Access Management (RAM) role that grants access permissions to other Alibaba Cloud services. For more information about service-linked roles, see Service-linked roles. The following SLRs are related to Quanmiao:

Role name

Role description

AliyunServiceRoleForAIMiaoBiAccessingOss

The service-linked role for Quanmiao to call OSS. Quanmiao uses this role to access your services and resources in OSS.

AliyunServiceRoleForAiMiaoBiAccessingIMS

The service-linked role for Quanmiao to call IMS. Quanmiao uses this role to access your services and resources in IMS.

AliyunServiceRoleForAIMiaoBiAccessingOss

Scenarios

Quanmiao uses the automatically created service-linked role AliyunServiceRoleForAIMiaoBiAccessingOss to access OSS resources for features that require storage, such as the Material Library.

Role and permission details

  • Role name: AliyunServiceRoleForAIMiaoBiAccessingOss
  • Access policy: AliyunServiceRolePolicyForAIMiaoBiAccessingOss
  • Permission details:
{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "oss:ListBuckets"
      ],
      "Resource": "acs:oss:*:*:*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "oss:PutObject",
        "oss:ListParts",
        "oss:GetObject",
        "oss:AbortMultipartUpload",
        "oss:DeleteObject"
      ],
      "Resource": "acs:oss:*:*:*/aimiaobi/*"
    },
    {
      "Action": "ram:DeleteServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "oss-access-aimiaobi.sfm.aliyuncs.com"
        }
      }
    }
  ]
}

Delete the service-linked role

If you use features such as the Quanmiao Material Library and later decide to delete the AliyunServiceRoleForAIMiaoBiAccessingOss service-linked role for reasons such as security, you must understand the impact. After you delete this role, Quanmiao can no longer add or access files and data stored in OSS for features such as the Material Library under your Alibaba Cloud account. For more information about how to delete a service-linked role, see Service-linked roles.

AliyunServiceRoleForAiMiaoBiAccessingIMS

Scenarios

Multimodal features, such as Quanmiao dataset management, depend on IMS. When Quanmiao accesses IMS resources, it obtains the required access permissions using the automatically created service-linked role AliyunServiceRoleForAiMiaoBiAccessingIMS.

Role and permission details

  • Role name: AliyunServiceRoleForAiMiaoBiAccessingIMS
  • Access policy: AliyunServiceRolePolicyForAiMiaoBiAccessingIMS
  • Permission details:
{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "ice:CreateSearchLib",
                "ice:QuerySearchLib",
                "ice:DropSearchLib",
                "ice:ListSearchLib",
                "ice:CreateSearchIndex",
                "ice:QuerySearchIndex",
                "ice:AlterSearchIndex",
                "ice:DropSearchIndex",
                "ice:InsertMediaToSearchLib",
                "ice:DeleteMediaFromSearchLib",
                "ice:UpdateMediaToSearchLib",
                "ice:QueryMediaIndexJob",
                "ice:SearchIndexJobRerun",
                "ice:SearchMedia",
                "ice:SearchMediaByMultimodal",
                "ice:GetVideoList",
                "ice:SearchMediaByFace",
                "ice:SearchMediaClipByFace",
                "ice:SearchMediaByAILabel",
                "ice:SearchMediaByHybrid"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": "ram:DeleteServiceLinkedRole",
            "Resource": "*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": "ims.quanmiao.aliyuncs.com"
                }
            }
        }
    ]
}

Delete the service-linked role

If you use Quanmiao dataset management and later decide to delete the AliyunServiceRoleForAiMiaoBiAccessingIMS service-linked role for reasons such as security, you must understand the impact. After you delete this role, Quanmiao can no longer add or access multimodal index data in datasets that are stored under your Alibaba Cloud account. For more information about how to delete a service-linked role, see Service-linked roles.

FAQ

Q: Why can't my RAM user automatically create a Quanmiao service-linked role? A: Specific permissions are required to automatically create or delete service-linked roles. If a RAM user cannot automatically create the role, you can grant the required permissions by adding the following access policy to the user. Replace Your-Alibaba-Cloud-Account-ID with the ID of your Alibaba Cloud account. 
{
    "Statement": [
        {
            "Action": [
                "ram:CreateServiceLinkedRole"
            ],
            "Resource": "acs:ram:*:Your-Alibaba-Cloud-Account-ID:role/*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": [
                        "oss-access-aimiaobi.sfm.aliyuncs.com"
                    ]
                }
            }
        }
    ],
    "Version": "1"
}
Agent Development
Agent Context
Agent Governance & Evolution
Store
Application Marketplace
Use Cases
Support