Service-linked role for AWS Global Accelerator
AWS Global Accelerator uses an AWS Identity and Access Management (IAM) service-linked role. A service-linked role is a unique type of IAM role that is linked directly to Global Accelerator. The service-linked role is predefined by Global Accelerator and includes all the permissions that the service requires to call other AWS services on your behalf.
A service-linked role makes setting up Global Accelerator easier because you don’t have to manually add the necessary permissions. Global Accelerator defines the permissions of its service-linked role, and unless defined otherwise, only Global Accelerator can assume its role. The defined permissions include the trust policy and the permissions policy, and that permissions policy cannot be attached to any other IAM entity.
You can delete a service-linked role only after first deleting its related resources. This protects your Global Accelerator resources because you can't inadvertently remove permission to access the resources.
For information about other services that support service-linked roles, see AWS services that work with IAM and look for the services that have Yes in the Service-linked role column. Choose a Yes with a link to view the service-linked role documentation for that service.
Service-linked role permissions for Global Accelerator
AWS Global Accelerator uses a service-linked role named AWSServiceRoleForGlobalAccelerator. This role allows Global Accelerator to access resources in your account, such as load balancers and other endpoints, to help make sure, for example, that you can add only resources that are configured to work with Global Accelerator. The AWSServiceRoleForGlobalAccelerator role also allows Global Accelerator to create and manage resources necessary for client IP address preservation.
Global Accelerator automatically creates a role named AWSServiceRoleForGlobalAccelerator when the role is first required to support a Global Accelerator API operation. This role is required for using accelerators in Global Accelerator. The ARN for the AWSServiceRoleForGlobalAccelerator role looks like this:
arn:aws:iam::123456789012:role/aws-service-role/globalaccelerator.amazonaws.com/AWSServiceRoleForGlobalAccelerator
Service-linked role permissions
Global Accelerator uses the service-linked role named AWSServiceRoleForGlobalAccelerator to
access resources and configurations to check readiness. This service-linked role uses the managed policy
AWSGlobalAcceleratorSLRPolicy.
The AWSServiceRoleForGlobalAccelerator service-linked role trusts the following service to assume the role:
-
globalaccelerator.amazonaws.com
To view the permissions for this policy, see AWSGlobalAcceleratorSLRPolicy in the AWS Managed Policy Reference.
You must configure permissions to allow an IAM entity (such as a user, group, or role) to delete the Global Accelerator service-linked role. For more information, see Service-Linked Role Permissions in the IAM User Guide.
Creating the service-linked role for Global Accelerator
You don't manually create the service-linked role for Global Accelerator. The service creates the role for you automatically the first time that you create an accelerator. If you remove your Global Accelerator resources and delete the service-linked role, the service creates the role again automatically when you create a new accelerator.
Editing the Global Accelerator service-linked role
Global Accelerator does not allow you to edit the AWSServiceRoleForGlobalAccelerator service-linked role. After the service has created a service-linked role, you cannot change the name of the role because various entities might reference the role. However, you can edit the description of a role by using IAM. For more information, see Editing a Service-Linked Role in the IAM User Guide.
Deleting the Global Accelerator service-linked role
If you no longer need to use Global Accelerator, we recommend that you delete the service-linked role. That way you don’t have unused entities that are not actively monitored or maintained. However, you must clean up the Global Accelerator resources in your account before you can manually delete the roles.
After you have disabled and deleted your accelerators, then you can delete the service-linked role. For more information about deleting accelerators, see Creating a standard accelerator.
Note
If you have disabled and deleted your accelerators but Global Accelerator hasn't finished updating, service-linked role deletion might fail. If that happens, wait for a few minutes, and then try the service-linked role deletion steps again.
To manually delete the AWSServiceRoleForGlobalAccelerator service-linked role
Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/
. -
In the navigation pane of the IAM console, choose Roles. Then select the check box next to the role name that you want to delete, not the name or row itself.
-
For Role actions at the top of the page, choose Delete role.
-
In the confirmation dialog box, review the service last accessed data, which shows when each of the selected roles last accessed an AWS service. This helps you to confirm whether the role is currently active. If you want to proceed, choose Yes, Delete to submit the service-linked role for deletion.
-
Watch the IAM console notifications to monitor the progress of the service-linked role deletion. Because the IAM service-linked role deletion is asynchronous, after you submit the role for deletion, the deletion task can succeed or fail. For more information, see Deleting a service-linked role in the IAM User Guide.
Updates to the policy for the Global Accelerator service-linked role
For updates to AWSGlobalAcceleratorSLRPolicy, the AWS managed policy for the Global Accelerator service-linked role,
see the AWS managed policies updates table.
You can also subscribe to automatic RSS alerts on the AWS Global Accelerator Document history page.