Help Center/ Identity and Access Management_Identity and Access Management (New Edition)/ User Guide/ Identity/ Trust Agencies/ Service-linked Agency
Updated on 2025-11-07 GMT+08:00
View PDF
Share

Service-linked Agency

A service-linked agency is directly related to the service logic. Service-linked agencies are automatically created and granted permissions to free you from creating cloud service trust agencies and authorization configurations.

Both service-linked agencies and cloud service trust agencies are used by services to perform operations on your behalf. However, they have different characteristics. An administrator can create, modify, and delete cloud service trust agencies in IAM. However, an administrator can only view but cannot edit the permissions of service-linked agencies. Service-linked agencies are displayed in your account and are owned by the services. Note that service-linked agencies also consume agency or trust agency quotas of your account.

Permissions of a Service-linked Agency

The permissions of a service-linked agency are predefined by the service and are the minimum set of permissions required to use the service on your behalf. Administrators can view but not modify service-linked agency permissions. This avoids misoperations and prevents service interruption or failures due to insufficient permissions.

Creating a Service-linked Agency

You need to configure permissions for IAM principals to allow them to create service-linked agencies. Then, when an IAM principal operates cloud service resources, the service-linked agency is automatically created by the cloud service.

  • Allowing IAM principals to create any service-linked agencies
    Attach the following policy to the desired IAM principal: 
    {
  "Version": "5.0",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "iam:agencies:createServiceLinkedAgencyV5"
      ]
    }
  ]
}
  • Allowing IAM principals to create specific service-linked agencies
    Attach the following policy to the desired IAM principal: 
    {
  "Version": "5.0",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "iam:agencies:createServiceLinkedAgencyV5"
      ],
      "Resource": [
        "iam:*:*:agency:service-linked-agency/service.{service_name}/*"
      ]
    }
  ]
}

Deleting a Service-linked Agency

Service-linked agencies can only be deleted by services. IAM administrators only have permission to view them in IAM. This prevents accidental deletion and service failure.

Parent topic: Trust Agencies