Docs

Message Queue for RabbitMQ

Access control

Cross-service access authorization

Before using the message queue for RabbitMQ for the first time, you need to perform cross-service authorization to allow the message queue for RabbitMQ to access other service resources under the current account, such as VPC. This article introduces the steps for cross-service access authorization.

Notes

Cross-service access authorization is only required before creating the RabbitMQ instance for the first time. After authorization, RabbitMQ can continuously access resources in other services until the service-linked role is deleted.

The permissions of the service-linked role are generated by the system and can not be changed. If you need to revoke authorization, delete the role.

It is recommended to complete cross-service access authorization through the VolcanoEngine main account. Otherwise, when an IAM user creates the first RabbitMQ instance, cross-service authorization will fail because they lack permission to create a service-linked role. If your actual business scenario requires an IAM user to perform cross-service access authorization, you can grant the IAMFullAccess system policy to the IAM user. For detailed information, refer to the permission strategy.

Background information

The message queue for RabbitMQ instance requires binding to resources such as VPC and subnets. When creating a RabbitMQ instance, the RabbitMQ service needs access to private networks and other services to obtain information like VPC lists and subnet lists. Before creating a RabbitMQ instance for the first time, you need to authorize the RabbitMQ service by allowing it to act as the ServiceRoleForRabbitMQ role. This role includes a predefined set of permission policies that allow the RabbitMQ service to access other service resources under your account.

Operation steps

Select the region where you want to create the instance from the top menu bar.

On the Instances page, click Create Instance in the upper left page corner.

On the pop-up Cross-service access request page, confirm the associated role and trust relationship, then click Authorize.

After successful authorization, you can view the created ServiceRoleForRabbitMQ service-linked role in the IAM role list.

Next steps

After completing authorization, the page returns to the Instances page. You can click Create Instance again to create the first RabbitMQ instance.

Last updated: 2025.10.13 11:45:50