代运维权限说明

服务商在创建代运维服务时,需要设置权限策略。在用户创建代运维服务实例后,计算巢会为用户创建相应的权限策略,并授信给计算巢。计算巢会为服务商授予其发布服务的服务实例中所包含资源的相应权限,服务商即可针对这些资源进行相应的代运维操作。

资源限制

  1. 私有部署服务附加代运维的服务,权限只限定在用户部署的服务实例内的资源。

  2. 纯代运维的服务,权限只限定在用户指定的ECS实例或者计算巢服务实例内的资源。服务商可以在服务实例详情页面查看已授权的运维资源,如下图所示:

权限限制

代运维权限限定在代运维的系统权限策略(AliyunComputeNestPolicyForSupplierRole)里,还与服务中选择的权限策略相关,例如策略里已选择AliyunComputeNestPolicyForReadOnly,则只有策略里的只读api权限。

AliyunComputeNestPolicyForSupplierRole策略内容:

{
  "Version": "1",
  "Statement": [
    {
      "Action": [
        "ecs:StartInstance",
        "ecs:DescribeInstances",
        "ecs:RebootInstance",
        "ecs:StopInstance",
        "ecs:RunCommand",
        "ecs:DescribeInvocations",
        "ecs:DescribeInvocationResults",
        "ecs:StartTerminalSession",
        "ecs:DescribeTerminalSessions",
        "ecs:CloseTerminalSession",
        "ecs:DescribeInstanceHistoryEvents",
        "ecs:DescribeDiagnosticReports",
        "ecs:CreateDiagnosticReport",
        "ecs:DescribeSecurityGroups",
        "ecs:DescribeDisks",
        "ecs:DescribeImages",
        "cms:DescribeMetricData",
        "cms:DescribeMetricList",
        "cms:QueryMetricList",
        "cms:DescribeMetricRuleList",
        "cms:DescribeAlertHistoryList",
        "cms:DescribeAlertLogList",
        "cms:DescribeLogHistogram",
        "cms:DescribeLogCount",
        "cms:DescribeDynamicTagRuleList",
        "cms:DescribeMonitorGroups",
        "tag:ListTagResources",
        "vpc:DescribeVpcs",
        "vpc:DescribeVSwitches",
        "vpc:DescribeVSwitchAttributes",
        "vpc:DescribeVpcAttribute",
        "vpc:DescribeRouteEntryList",
        "vpc:DescribeRouteTableList",
        "vpc:DescribeRouteTables",
        "vpc:DescribeRouterInterfaces",
        "vpc:DescribeRouterInterfaceAttribute",
        "slb:DescribeLoadBalancers",
        "slb:DescribeLoadBalancerListeners",
        "slb:DescribeLoadBalancerAttribute",
        "slb:DescribeVServerGroups",
        "rds:DescribeDBInstances",
        "rds:DescribeDBInstanceAttribute",
        "rds:RestartDBInstance",
        "actiontrail:LookupEvents"
      ],
      "Resource": "*",
      "Effect": "Allow"
    }
  ]
}