Quick start: Configure STAROps permissions

Quick start: Full STAROps permissions

For quick validation or development and testing environments, you can first grant the RAM user full STAROps permissions and then complete the ram:PassRole configuration. This policy is only for quick validation and is not recommended as a long-term policy for production environments. In production environments, follow Best Practices for Custom STAROps Permission Policies to create separate policies for administration, conversation, read-only access, and Long-Term Missions.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "starops:*",
      "Resource": "*"
    }
  ]
}

Configuration objectives

After configuration, the RAM user can:

• View available system built-in digital employees.

• Start intelligent conversations.

• View their own conversation records and results.

• Verify data on the data source console as needed.

Configuration procedure

1. Log on to the RAM console by using the Alibaba Cloud account or as a RAM administrator.

2. Create or select a STAROps usage policy for the target RAM user. For quick validation, you can use the full STAROps permissions described above. For production environments, we recommend that you grant fine-grained permissions based on usage scenarios.

3. Grant the following types of permissions:

   • View digital employees: for example, GetDigitalEmployee and ListDigitalEmployees.

   • Start and view conversations: for example, CreateChat, CreateThread, GetThread, GetThreadData, and ListThreads.

   • View artifacts: for example, GetArtifact and ListArtifacts.

4. If you want the user to verify data on the console, grant the RAM user read-only permissions on the target data sources, such as SLS query permissions and CMS/ARMS read-only permissions.

5. Log on to STAROps as the RAM user and select a system built-in digital employee to start a conversation.

Considerations

• When you use system built-in digital employees, you typically do not need to configure a separate RAM role for each digital employee.

• When you use system built-in digital employees, you typically do not need to configure ram:PassRole for the RAM user.

• System built-in digital employees have limited capabilities and are not suitable for use as dedicated digital employees that require MCP, Alibaba Cloud CLI, or complex enterprise integration.

Configuration objectives

After configuration, the RAM user can:

• Create or update custom digital employees.

• Bind the service-linked role AliyunServiceRoleForSTAROps to a digital employee.

• Start conversations with the digital employee.

• Allow the digital employee to read logs, metrics, application monitoring data, and other data within the authorized scope.

Configuration procedure

1. Verify that the service-linked role is available in the account.

   • On the digital employee creation page, select Service Role for RAM Role Type.

   • Select AliyunServiceRoleForSTAROps for RAM Role ARN.

   • This role corresponds to the RAM role AliyunServiceRoleForSTAROps.

2. Grant digital employee operation permissions to the RAM user.

   • Create, view, update, and delete digital employees.

   • Start and view conversations.

   • Manage Skills, MCP, and tool configurations. Grant permissions based on responsibilities.

3. Grant ram:PassRole to the RAM user.

   • Set Resource to the service-linked role AliyunServiceRoleForSTAROps.

   • We recommend that you use the acs:Service condition to restrict the role to be passed only to STAROps-related services.

   {
     "Version": "1",
     "Statement": [
       {
         "Effect": "Allow",
         "Action": "ram:PassRole",
         "Resource": "acs:ram::*:role/aliyunserviceroleforstarops",
         "Condition": {
           "StringEquals": {
             "acs:Service": [
               "operation-platform.aliyuncs.com",
               "cloudmonitor.aliyuncs.com"
             ]
           }
         }
       }
     ]
   }

4. Create a digital employee and bind the service-linked role.

   • Go to the digital employee management page in the STAROps console.

   • Create a digital employee and specify the ID, display name, RAM role type, and RAM role ARN.

   • Configure default rules, Skills, MCP services, or tool policies as needed.

5. Start a conversation to verify the configuration.

   • Ask the digital employee to query the target workspace, logs, or cloud resources.

   • Use the RAM user to verify the results on the corresponding console.

Considerations

• ram:PassRole only controls whether the user can pass the service-linked role to STAROps. It does not determine what data the digital employee can access.

• The service-linked role AliyunServiceRoleForSTAROps primarily provides data read permissions for CloudMonitor 2.0 scenarios, which is suitable for queries, diagnostics, inspections, and report generation.

• This service-linked role does not include permissions to modify cloud service configurations or change resource states.

• If the digital employee needs to perform cloud service updates or resource changes, use a custom role instead and configure least-privilege permissions by cloud service, resource scope, and action.

• The trust policy of a role allows the STAROps service to assume the role. This does not mean that all RAM users can pass the role.

Configuration objectives

After configuration, the RAM user can:

• Create and manage Long-Term Missions.

• View mission status, mission details, and artifact reports.

• Allow Long-Term Missions to run continuously by using a specified digital employee.

Configuration procedure

1. Grant Mission operation permissions to the RAM user.

   • Create Long-Term Missions.

   • View the Long-Term Mission list and details.

   • Update or delete Long-Term Missions.

   • View mission details and execution status.

2. Grant artifact viewing permissions to the RAM user.

   • View reports, conversations, mission outputs, and other STAROps resources.

3. Verify that the selected digital employee has the required runtime permissions.

   • When using a system built-in digital employee, verify that the user's own permissions and the product capability boundaries meet the mission requirements.

   • When using a custom digital employee, verify that the bound RAM role has the required data and resource permissions.

   • When using a custom digital employee, verify that the RAM user has the ram:PassRole permission for the target RAM role.

4. Create a Long-Term Mission and run it once for verification.

Considerations

• Mission permissions only control whether the user can create and manage Long-Term Missions.

• Long-Term Missions are executed by the digital employee. The runtime permissions come from the selected digital employee.

• If a Long-Term Mission reports insufficient permissions, check the digital employee RAM role first instead of only checking the RAM user's Mission permissions.

Configuration objectives

After configuration, the RAM user can:

• View the digital employee list and details.

• View conversation records and conversation data.

• View the Long-Term Mission list, details, and execution status.

• View reports and artifacts.

After configuration, the RAM user cannot:

• Create, modify, or delete digital employees or Long-Term Missions.

• Start conversations.

• Pass RAM roles.

Configuration guidelines

• Grant read-only permissions for digital employees.

• Grant read-only permissions for conversations.

• Grant read-only permissions for Long-Term Missions.

• Grant read-only permissions for reports and artifacts.

• Do not grant Create, Update, or Delete actions.

• Do not grant ram:PassRole.