AliyunCSAIAssistantRolePolicy 是专用于服务角色的授权策略，通常会在创建对应的服务角色时同步完成授权，以允许服务角色代您访问其他云服务。本策略由对应的阿里云服务按需更新，请勿将本策略授权给服务角色之外的 RAM 身份使用。
策略详情
类型：系统策略
创建时间：2024-08-16 09:43:29
更新时间：2026-09-21 09:34:17
当前版本：v15
策略内容
{
"Version": "1",
"Statement": [
{
"Action": [
"cs:DescribeClusterVuls",
"cs:DescribeKubernetesVersionMetadata",
"cs:DescribeClusterEndpoints",
"cs:DescribePolicyInstancesStatus",
"cs:GetClusterCheckResult",
"cs:GetCostCheckItem",
"cs:CheckControlPlaneLogEnable",
"cs:GetClusterAuditProject",
"cs:DescribeClusterDetail",
"cs:CreateClusterDiagnosis",
"cs:CreateClusterInspectConfig",
"cs:GetClusterDiagnosisResult",
"cs:RunClusterInspect",
"cs:RunClusterCheck",
"cs:ListClusterInspectReports",
"cs:GetClusterInspectReportDetail",
"cs:ListClusterChecks",
"cs:DescribeClusterNodes",
"cs:DescribeClusterNodePools",
"cs:DescribeClusterNodePoolDetail",
"cs:DescribeClusterTasks",
"cs:DescribeTaskInfo",
"cs:ListAddons",
"cs:ListClusterAddonInstances",
"cs:GetClusters",
"cs:DescribeClustersV1",
"cs:DescribeClustersForRegion",
"cs:DescribeClusterResources",
"cs:DescribeClusterLogs",
"cs:DescribeClusterEvents",
"cs:DescribeEventsForRegion",
"cs:DescribeUserQuota",
"cs:DescribeRegions",
"cs:DescribeTemplates",
"cs:DescribeTemplateAttribute",
"cs:DescribeUserClusterNamespaces",
"cs:GetClusterCheck",
"cs:ListAutoRepairPolicies",
"cs:DescribeAutoRepairPolicy",
"cs:DescribeAddon",
"cs:GetClusterAddonInstance",
"cs:ListClusterAddonInstanceResources",
"cs:ListOperationPlansForRegion",
"cs:GetClusterInspectConfig",
"cs:GetClusterDiagnosisCheckItems",
"cs:DescribeNodePoolVuls",
"cs:DescribePolicies",
"cs:DescribePolicyDetails",
"cs:DescribePolicyInstances",
"cs:DescribePolicyGovernanceInCluster",
"cs:CheckControlPlaneLogEnable",
"cs:ListTagResources",
"cs:DescribeResourcesDeleteProtection"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Effect": "Allow",
"Action": [
"ess:DescribeScalingGroups",
"ess:DescribeScalingGroupDetail",
"ess:DescribeScalingInstances",
"ess:DescribeScalingConfigurations",
"ess:DescribeEciScalingConfigurations",
"ess:DescribeEciScalingConfigurationDetail",
"ess:DescribeScalingRules",
"ess:DescribeScalingActivities",
"ess:DescribeScalingActivityDetail",
"ess:DescribeScalingActivityStatistics",
"ess:DescribeScheduledTasks",
"ess:DescribeAlarms",
"ess:DescribeAlertConfiguration",
"ess:DescribeNotificationConfigurations",
"ess:DescribeNotificationTypes",
"ess:DescribeLifecycleHooks",
"ess:DescribeLifecycleActions",
"ess:DescribeInstanceRefreshes",
"ess:DescribeInstanceCreateAndDeleteStatistics",
"ess:DescribeCandidateInstanceType",
"ess:DescribePatternTypes",
"ess:DescribeElasticStrength",
"ess:DescribeDiagnoseReports",
"ess:DescribeScalingGroupDiagnoseDetails",
"ess:DescribeLimitation",
"ess:DescribeRegions",
"ess:ListTagResources",
"ess:ListTagKeys",
"ess:ListTagValues",
"ess:QueryPredictiveMetric",
"ess:QueryHistoricalMetric",
"ess:QueryPredictiveValue",
"ess:QueryPredictiveTaskInfo"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"ecs:DescribeInvocationResults",
"ecs:DescribeCommands",
"ecs:DescribeInstanceAttribute",
"ecs:DescribeInstanceHealthStatus",
"ecs:DescribeInstanceHistoryEvents",
"ecs:DescribeInstanceMonitorData",
"ecs:DescribeInvocations",
"ecs:DescribePrice",
"ecs:DescribeResourceByTags",
"ecs:DescribeSecurityGroupAttribute",
"ecs:DescribeSecurityGroupReferences",
"ecs:DescribeSecurityGroups",
"ecs:DescribeTasks",
"ecs:DescribeTags",
"ecs:DescribeTagKeys",
"vpc:DescribeEipAddresses",
"vpc:DescribeEipMonitorData",
"vpc:DescribeRouteTables",
"vpc:DescribeVpcs",
"vpc:DescribeVSwitches",
"vpc:DescribeVRouters",
"vpc:DescribeVSwitchAttributes",
"ecs:DescribeDisks",
"ecs:DescribeDisksFullStatus",
"ecs:DescribeInstances",
"ecs:DescribeInstancesFullStatus",
"ecs:DescribeInstanceStatus",
"ecs:DescribeInstanceTypeResource",
"ecs:DescribeVolumes",
"ecs:CreateDiagnosticMetricSet",
"ecs:DescribeDiagnosticMetricSets",
"ecs:ModifyDiagnosticMetricSet",
"ecs:DeleteDiagnosticMetricSets",
"ecs:DescribeDiagnosticMetrics",
"ecs:CreateDiagnosticReport",
"ecs:DescribeDiagnosticReportAttributes",
"ecs:DescribeDiagnosticReports",
"ecs:RunCommand",
"ecs:DeleteDiagnosticReports"
],
"Resource": "*"
},
{
"Sid": "NetworkDiagnoseSkillCbnReadOnly",
"Effect": "Allow",
"Action": [
"cbn:DescribeCens",
"cbn:DescribeCenAttachedChildInstances",
"cbn:DescribeCenChildInstanceRouteEntries",
"cbn:DescribeCenRegionDomainRouteEntries",
"cbn:DescribeCenRouteMaps",
"cbn:ListTransitRouters",
"cbn:ListTransitRouterRouteTables",
"cbn:ListTransitRouterRouteEntries",
"cbn:ListTransitRouterRouteTableAssociations",
"cbn:ListTransitRouterRouteTablePropagations",
"cbn:ListTransitRouterVpcAttachments",
"cbn:DescribeTransitRouterVpcAttachment"
],
"Resource": "*"
},
{
"Sid": "NetworkDiagnoseSkillVpcPeerReadOnly",
"Effect": "Allow",
"Action": [
"vpcpeer:ListVpcPeerConnections"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"cms:QueryMetricList",
"cms:QueryMetricLast",
"cms:DescribeMetricList",
"cms:DescribeMetricMetaList",
"cms:DescribeProjectMeta",
"cms:ListPrometheusInstances",
"cms:GetPrometheusInstance",
"cms:ListPrometheusViews"
],
"Resource": "*"
},
{
"Action": [
"yundun-sas:DescribeSuspEvents",
"yundun-sas:DescribeVulDetails"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"cr:CreateClusterImageAnalysisTask",
"cr:GetClusterImageAnalysisTask"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"arms:GetPrometheusInstance",
"arms:GetCloudClusterAllUrl"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Effect": "Allow",
"Action": [
"log:ListProject",
"log:ListTagResources",
"log:ListLogStores",
"log:ListConsumerGroup",
"log:GetProject",
"log:GetAlert",
"log:GetIndex",
"log:GetLogStore",
"log:GetLogStoreLogs",
"log:ListShards"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"sysom:InvokeDiagnosis",
"sysom:GetDiagnosisResult",
"sysom:GetDiagnosisResult",
"sysom:ListDiagnosis",
"sysom:InitialSysom"
],
"Resource": "*"
},
{
"Action": "ram:CreateServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": [
"selfservice.ecs.aliyuncs.com",
"sysom.aliyuncs.com"
]
}
}
},
{
"Sid": "AcrInstanceAndImageReadOnly",
"Effect": "Allow",
"Action": [
"cr:ListInstance",
"cr:GetInstance",
"cr:GetInstanceCount",
"cr:GetInstanceEndpoint",
"cr:GetInstanceVpcEndpoint",
"cr:GetInstanceUsage",
"cr:ListInstanceEndpoint",
"cr:ListNamespace",
"cr:GetNamespace",
"cr:ListRepository",
"cr:GetRepository",
"cr:ListRepositoryTag",
"cr:GetAuthorizationToken"
],
"Resource": "*"
},
{
"Sid": "EcsDiagnoseSkillsDeepDiag",
"Effect": "Allow",
"Action": [
"ecs:DescribeCloudAssistantStatus",
"ecs:DescribeNetworkInterfaces"
],
"Resource": "*"
},
{
"Sid": "EcsDiagnoseSkillsCmsReadOnly",
"Effect": "Allow",
"Action": [
"cms:DescribeMetricLast"
],
"Resource": "*"
},
{
"Sid": "NetworkDiagnoseSkillVpcReadOnly",
"Effect": "Allow",
"Action": [
"vpc:DescribeRouteTableList",
"vpc:DescribeRouteEntryList",
"vpc:DescribeNetworkAcls",
"vpc:DescribeNatGateways",
"vpc:DescribeForwardTableEntries",
"vpc:DescribeSnatTableEntries",
"vpc:DescribeVpnGateways",
"vpc:DescribeVpnConnections",
"vpc:DescribeVirtualBorderRouters"
],
"Resource": "*"
},
{
"Sid": "AcrImageScanReadOnly_Optional",
"Effect": "Allow",
"Action": [
"cr:GetScan",
"cr:GetScanCount"
],
"Resource": "*"
},
{
"Sid": "ACRPullSkillsReadOnly",
"Effect": "Allow",
"Action": [
"cr:PullRepository"
],
"Resource": "*"
},
{
"Sid": "AppflowIM",
"Effect": "Allow",
"Action": [
"appflow:InvokeAction",
"appflow:CreateFlow",
"appflow:DeleteFlow",
"appflow:GetFlow",
"appflow:ListFlows",
"appflow:DisableFlow",
"appflow:EnableFlow",
"appflow:CreateUserAuthConfig",
"appflow:DeleteUserAuthConfig",
"appflow:GetUserAuthConfig",
"appflow:ListUserAuthConfigs"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"adcp:DescribeHubClusters",
"adcp:DescribeManagedClusters",
"adcp:DescribeUserPermissions",
"adcp:DescribeHubClusterKubeconfig",
"adcp:DescribeHubClusterLogs",
"adcp:DescribeHubClusterDetails",
"adcp:DescribeRegions"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"awf:DescribeComputeClusterNodePools",
"awf:DescribeComputeClusterNodePoolDetail",
"awf:DescribeComputeClusterMetadata",
"adcp:DescribeComputeClusterNodes",
"awf:DescribeComputeClusterNodes",
"awf:DescribeComputeClusterCapabilityDetail"
],
"Resource": "*"
},
{
"Sid": "EcsAgentBilling",
"Effect": "Allow",
"Action": [
"ecagent:OpenAgentService",
"ecagent:DescribeAgentService",
"ecagent:ModifyAgentServiceAttribute",
"ecagent:DescribeAgentCreditUsage"
],
"Resource": "*"
},
{
"Sid": "GetOwnRequestLogReadOnly",
"Effect": "Allow",
"Action": [
"openapiexplorer:GetOwnRequestLog",
"openapiexplorer:GetRequestLog",
"openapiexplorer:GetErrorCodeSolutions"
],
"Resource": "*"
}
]
}相关文档
该文章对您有帮助吗？