AliyunCSManagedKubernetesRolePolicy_访问控制(RAM)-阿里云帮助中心

AliyunCSManagedKubernetesRolePolicy 是专用于服务角色的授权策略，通常会在创建对应的服务角色时同步完成授权，以允许服务角色代您访问其他云服务。本策略由对应的阿里云服务按需更新，请勿将本策略授权给服务角色之外的 RAM 身份使用。
策略详情

类型：系统策略
创建时间：2024-10-18 11:11:48
更新时间：2025-05-09 09:25:49
当前版本：v33
策略内容

{
	"Version": "1",
	"Statement": [{
			"Action": [
				"ecs:Describe*",
				"ecs:CreateRouteEntry",
				"ecs:DeleteRouteEntry",
				"ecs:CreateNetworkInterface",
				"ecs:DeleteNetworkInterface",
				"ecs:CreateNetworkInterfacePermission",
				"ecs:DeleteNetworkInterfacePermission",
				"ecs:ModifyInstanceAttribute",
				"ecs:AttachKeyPair",
				"ecs:StopInstance",
				"ecs:StartInstance",
				"ecs:ModifyNetworkInterfaceAttribute",
				"ecs:ReplaceSystemDisk"
			],
			"Resource": [
				"*"
			],
			"Effect": "Allow"
		},
		{
			"Action": [
				"slb:Describe*",
				"slb:CreateLoadBalancer",
				"slb:DeleteLoadBalancer",
				"slb:ModifyLoadBalancerInternetSpec",
				"slb:RemoveBackendServers",
				"slb:AddBackendServers",
				"slb:RemoveTags",
				"slb:AddTags",
				"slb:TagResources",
				"slb:UnTagResources",
				"slb:ListTagResources",
				"slb:StopLoadBalancerListener",
				"slb:StartLoadBalancerListener",
				"slb:SetLoadBalancerHTTPListenerAttribute",
				"slb:SetLoadBalancerHTTPSListenerAttribute",
				"slb:SetLoadBalancerTCPListenerAttribute",
				"slb:SetLoadBalancerUDPListenerAttribute",
				"slb:CreateLoadBalancerHTTPSListener",
				"slb:CreateLoadBalancerHTTPListener",
				"slb:CreateLoadBalancerTCPListener",
				"slb:CreateLoadBalancerUDPListener",
				"slb:DeleteLoadBalancerListener",
				"slb:CreateVServerGroup",
				"slb:DescribeVServerGroups",
				"slb:DeleteVServerGroup",
				"slb:SetVServerGroupAttribute",
				"slb:DescribeVServerGroupAttribute",
				"slb:ModifyVServerGroupBackendServers",
				"slb:AddVServerGroupBackendServers",
				"slb:ModifyLoadBalancerInstanceSpec",
				"slb:ModifyLoadBalancerInternetSpec",
				"slb:SetLoadBalancerModificationProtection",
				"slb:SetLoadBalancerDeleteProtection",
				"slb:SetLoadBalancerName",
				"slb:ModifyLoadBalancerInstanceChargeType",
				"slb:RemoveVServerGroupBackendServers"
			],
			"Resource": [
				"*"
			],
			"Effect": "Allow"
		},
		{
			"Action": [
				"vpc:Describe*",
				"vpc:DeleteRouteEntry",
				"vpc:CreateRouteEntry",
				"vpc:CreateRouteEntries",
				"vpc:DeleteRouteEntries"
			],
			"Resource": [
				"*"
			],
			"Effect": "Allow"
		},
		{
			"Action": [
				"xtrace:GetToken"
			],
			"Resource": [
				"*"
			],
			"Effect": "Allow"
		},
		{
			"Action": [
				"arms:CheckCommercialStatus"
			],
			"Resource": [
				"*"
			],
			"Effect": "Allow"
		},
		{
			"Action": [
				"log:CreateProject",
				"log:GetProject",
				"log:GetProductDataCollection",
				"log:OpenProductDataCollection",
				"log:CloseProductDataCollection",
				"log:GetLogStoreHistogram",
				"log:AnalyzeProductLog",
				"log:CreateIndex",
				"log:UpdateIndex",
				"log:DeleteIndex",
				"log:CreateLogStore",
				"log:UpdateLogStore",
				"log:DeleteLogStore",
				"log:CreateDashboard",
				"log:UpdateDashboard",
				"log:DeleteDashboard",
				"log:SetGeneralDataAccessConfig"
			],
			"Resource": [
				"acs:log:*:*:project/*/logstore/alb_*",
				"acs:log:*:*:project/*/savedsearch/*",
				"acs:log:*:*:project/*/dashboard/*",
				"acs:alb:*:*:loadbalancer/*",
				"acs:log:*:*:resource/sls.general_data_access.alb.global_conf.standard_channel/record"
			],
			"Effect": "Allow"
		},
		{
			"Action": [
				"alb:EnableLoadBalancerIpv6Internet",
				"alb:DisableLoadBalancerIpv6Internet",
				"alb:CreateAcl",
				"alb:DeleteAcl",
				"alb:ListAcls",
				"alb:ListAclRelations",
				"alb:AddEntriesToAcl",
				"alb:AssociateAclsWithListener",
				"alb:ListAclEntries",
				"alb:RemoveEntriesFromAcl",
				"alb:DissociateAclsFromListener",
				"alb:TagResources",
				"alb:UnTagResources",
				"alb:ListServerGroups",
				"alb:ListServerGroupServers",
				"alb:AddServersToServerGroup",
				"alb:RemoveServersFromServerGroup",
				"alb:ReplaceServersInServerGroup",
				"alb:CreateLoadBalancer",
				"alb:DeleteLoadBalancer",
				"alb:UpdateLoadBalancerAttribute",
				"alb:UpdateLoadBalancerEdition",
				"alb:EnableLoadBalancerAccessLog",
				"alb:DisableLoadBalancerAccessLog",
				"alb:EnableDeletionProtection",
				"alb:DisableDeletionProtection",
				"alb:ListLoadBalancers",
				"alb:GetLoadBalancerAttribute",
				"alb:ListListeners",
				"alb:CreateListener",
				"alb:GetListenerAttribute",
				"alb:UpdateListenerAttribute",
				"alb:ListListenerCertificates",
				"alb:AssociateAdditionalCertificatesWithListener",
				"alb:DissociateAdditionalCertificatesFromListener",
				"alb:DeleteListener",
				"alb:CreateRule",
				"alb:DeleteRule",
				"alb:UpdateRuleAttribute",
				"alb:CreateRules",
				"alb:UpdateRulesAttribute",
				"alb:DeleteRules",
				"alb:ListRules",
				"alb:UpdateListenerLogConfig",
				"alb:CreateServerGroup",
				"alb:DeleteServerGroup",
				"alb:UpdateServerGroupAttribute",
				"alb:UpdateLoadBalancerAddressTypeConfig",
				"alb:AttachCommonBandwidthPackageToLoadBalancer",
				"alb:DetachCommonBandwidthPackageFromLoadBalancer",
				"alb:UpdateServerGroupServersAttribute",
				"alb:MoveResourceGroup",
				"alb:ListAScripts",
				"alb:CreateAScripts",
				"alb:UpdateAScripts",
				"alb:DeleteAScripts",
				"alb:LoadBalancerJoinSecurityGroup",
				"alb:LoadBalancerLeaveSecurityGroup",
				"alb:DescribeZones"
			],
			"Resource": "*",
			"Effect": "Allow"
		},
		{
			"Action": [
				"nlb:TagResources",
				"nlb:UnTagResources",
				"nlb:ListTagResources",
				"nlb:CreateLoadBalancer",
				"nlb:DeleteLoadBalancer",
				"nlb:GetLoadBalancerAttribute",
				"nlb:ListLoadBalancers",
				"nlb:UpdateLoadBalancerAttribute",
				"nlb:UpdateLoadBalancerAddressTypeConfig",
				"nlb:UpdateLoadBalancerZones",
				"nlb:CreateListener",
				"nlb:DeleteListener",
				"nlb:ListListeners",
				"nlb:UpdateListenerAttribute",
				"nlb:StopListener",
				"nlb:StartListener",
				"nlb:GetListenerAttribute",
				"nlb:GetListenerHealthStatus",
				"nlb:CreateServerGroup",
				"nlb:DeleteServerGroup",
				"nlb:UpdateServerGroupAttribute",
				"nlb:AddServersToServerGroup",
				"nlb:RemoveServersFromServerGroup",
				"nlb:UpdateServerGroupServersAttribute",
				"nlb:ListServerGroups",
				"nlb:ListServerGroupServers",
				"nlb:LoadBalancerLeaveSecurityGroup",
				"nlb:LoadBalancerJoinSecurityGroup",
				"nlb:DisableLoadBalancerIpv6Internet",
				"nlb:EnableLoadBalancerIpv6Internet",
				"nlb:UpdateLoadBalancerProtection",
				"nlb:AttachCommonBandwidthPackageToLoadBalancer",
				"nlb:DetachCommonBandwidthPackageFromLoadBalancer",
				"nlb:GetJobStatus"
			],
			"Resource": "*",
			"Effect": "Allow"
		},
		{
			"Action": [
				"cms:DescribeMetricData",
				"cms:DescribeMetricLast",
				"cms:DescribeMetricMetaList",
				"cms:DescribeMetricTop",
				"cms:QueryMetricData",
				"cms:QueryMetricLast",
				"cms:DescribeMetricList",
				"cms:QueryMetricList",
				"cms:MetricMeta"
			],
			"Resource": "*",
			"Effect": "Allow"
		},
		{
			"Action": "ram:CreateServiceLinkedRole",
			"Resource": "*",
			"Effect": "Allow",
			"Condition": {
				"StringEquals": {
					"ram:ServiceName": [
						"alb.aliyuncs.com",
						"audit.log.aliyuncs.com",
						"nlb.aliyuncs.com",
						"logdelivery.alb.aliyuncs.com"
					]
				}
			}
		},
		{
			"Action": [
				"yundun-cert:CreateSSLCertificateWithName",
				"yundun-cert:DeleteSSLCertificate",
				"yundun-cert:DescribeSSLCertificateList",
				"yundun-cert:DescribeSSLCertificatePublicKeyDetail"
			],
			"Resource": "*",
			"Effect": "Allow"
		},
		{
			"Action": [
				"cr:Get*",
				"cr:List*",
				"cr:PullRepository"
			],
			"Resource": "*",
			"Effect": "Allow"
		},
		{
			"Action": [
				"pvtz:BindZoneVpc",
				"pvtz:AddZone",
				"pvtz:AddUserVpcAuthorization",
				"pvtz:DeleteZone",
				"pvtz:AddZoneRecord",
				"pvtz:DeleteZoneRecord",
				"pvtz:DeleteZoneRecordsByRR",
				"pvtz:DescribeZoneRecordsByRR",
				"pvtz:UpdateZoneRecord",
				"pvtz:DescribeZoneRecords",
				"pvtz:DescribeZones",
				"pvtz:DescribeZoneInfo"
			],
			"Resource": "*",
			"Effect": "Allow"
		},
		{
			"Action": "ram:CreateServiceLinkedRole",
			"Resource": "*",
			"Effect": "Allow",
			"Condition": {
				"StringEquals": {
					"ram:ServiceName": "eipaccess.slb.aliyuncs.com"
				}
			}
		},
		{
			"Action": "ram:CreateServiceLinkedRole",
			"Resource": "*",
			"Effect": "Allow",
			"Condition": {
				"StringEquals": {
					"ram:ServiceName": "middlewarelens.log.aliyuncs.com"
				}
			}
		}
	]
}
策略详情

策略内容

相关文档
