AliyunCISDefaultRolePolicy

{
  "Version": "1",
  "Statement": [
    {
      "Action": [
        "ecs:DescribeInstances",
        "ecs:DescribeInstanceStatus",
        "ecs:DescribeInstanceTypes",
        "ecs:DescribeInstanceTypeFamilies",
        "ecs:DescribeInstanceAttribute",
        "ecs:DescribeDiagnosticReports",
        "ecs:DescribeDiagnosticReportAttributes",
        "ecs:DescribeDiagnosticMetricSets",
        "ecs:DescribeDiagnosticMetrics",
        "ecs:DescribeSecurityGroupAttribute",
        "ecs:DescribeSecurityGroups",
        "ecs:DescribeSecurityGroupReferences",
        "ecs:DescribeBandwidthLimitation",
        "ecs:DescribeCloudAssistantStatus",
        "ecs:DescribeCommands",
        "ecs:DescribeInvocationResults",
        "ecs:CreateCommand",
        "ecs:InvokeCommand",
        "ecs:StopInvocation",
        "ecs:CreateDiagnosticReport",
        "ecs:DescribeNetworkInterfaces",
        "ecs:DescribeDisks",
        "ecs:DescribeDeploymentSets",
        "ecs:DescribeCapacityReservations",
        "ecs:RunCommand"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "vpc:DescribeVpcs",
        "vpc:DescribeVpcAttribute",
        "vpc:DescribeVSwitches",
        "vpc:DescribeVSwitchAttributes",
        "vpc:DescribeRouteTableList",
        "vpc:DescribeRouteEntryList",
        "vpc:DescribeNatGateways",
        "vpc:DescribeRouteTables",
        "vpc:DescribeSnatTableEntries",
        "vpc:DescribeNetworkAcls",
        "vpc:DescribeNetworkAclAttributes",
        "vpc:DescribeEipAddresses"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "sls:GetLogStore"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "oss:GetBucketInfo"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "slb:DescribeLoadBalancers",
        "slb:DescribeLoadBalancerAttribute",
        "slb:DescribeVServerGroups",
        "slb:DescribeVServerGroupAttribute",
        "slb:DescribeLoadBalancerTCPListenerAttribute",
        "slb:DescribeLoadBalancerUDPListenerAttribute",
        "slb:DescribeAccessControlLists",
        "slb:DescribeAccessControlListAttribute",
        "slb:DescribeLoadBalancerListeners",
        "slb:DescribeHealthStatus"
      ],
      "Resource": [
        "*"
      ],
      "Effect": "Allow"
    },
    {
      "Action": [
        "grace:GetFile",
        "grace:AnalyzeFile",
        "grace:UploadFileByOSS",
        "grace:UploadFileByURL"
      ],
      "Resource": "acs:grace:*:*:*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "ram:GetRole",
        "ram:ListPoliciesForRole"
      ],
      "Resource": [
        "acs:ram:*:*:role/kubernetesworkerrole*",
        "acs:ram:*:*:role/aliyuncsmanagedautoscalerrole",
        "acs:ram:*:*:role/aliyunooslifecyclehook4csrole"
      ],
      "Effect": "Allow"
    },
    {
      "Action": [
        "cms:DescribeMetricData",
        "cms:DescribeMetricLast",
        "cms:DescribeMetricMetaList",
        "cms:DescribeMetricTop",
        "cms:QueryMetricMeta",
        "cms:QueryMetricTop",
        "cms:ListMetricMeta",
        "cms:ListMetricMetaProject",
        "cms:QueryMetricData",
        "cms:QueryMetricLast",
        "cms:DescribeMetricList",
        "cms:QueryMetricList",
        "cms:MetricMeta",
        "cms:DescribeAlertLogList",
        "cms:DescribeSystemEventAttribute",
        "cms:GetMetricStreamMeta"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "eflo:DescribeNode",
        "eflo:RunCommand",
        "eflo:DescribeInvocations"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "eci:DescribeContainerGroups",
        "eci:RunCommand",
        "eci:DescribeCommandResult",
        "eci:ListUsage"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "ess:DescribeScalingGroups",
        "ess:DescribeScalingInstances",
        "ess:DescribeScalingActivities",
        "ess:DescribeScalingConfigurations",
        "ess:DescribeScalingRules",
        "ess:DescribeScheduledTasks",
        "ess:DescribeLifecycleHooks",
        "ess:DescribeNotificationConfigurations",
        "ess:DescribeNotificationTypes",
        "ess:DescribeRegions",
        "ess:DescribeDiagnoseReports",
        "ess:CreateDiagnoseReport",
        "ess:DescribeElasticStrength",
        "ess:DescribeScalingGroupDetail",
        "ess:DescribePatternTypes"
      ],
      "Resource": [
        "*"
      ],
      "Effect": "Allow"
    },
    {
      "Action": [
        "cs:DescribeClusterDetail",
        "cs:DescribeClusterResources",
        "cs:DescribeTasks",
        "cs:DescribeTaskInfo",
        "cs:DescribeClusterNodePools",
        "cs:DescribeNodePoolVuls",
        "cs:DescribeKubernetesVersionMetadata",
        "cs:DescribeClusterNodes",
        "cs:ListClusterAddonInstances",
        "cs:DescribeAddon",
        "cs:DescribeClusterNodePoolDetail",
        "cs:DescribeClusterAddonsUpgradeStatus"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "quotas:ListProducts",
        "quotas:ListProductQuotas",
        "quotas:ListProductQuotas",
        "quotas:ListProductQuotaDimensions",
        "quotas:GetProductQuota",
        "quotas:GetProductQuotaDimension"
      ],
      "Resource": "acs:quotas:*:*:*",
      "Effect": "Allow"
    },
    {
      "Action": "ram:CreateServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "selfservice.ecs.aliyuncs.com"
        }
      }
    }
  ]
}