AliyunDLFNextWorkFlowDefaultRolePolicy_访问控制(RAM)-阿里云帮助中心

AliyunDLFNextWorkFlowDefaultRolePolicy 是专用于服务角色的授权策略，通常会在创建对应的服务角色时同步完成授权，以允许服务角色代您访问其他云服务。本策略由对应的阿里云服务按需更新，请勿将本策略授权给服务角色之外的 RAM 身份使用。
策略详情

类型：系统策略
创建时间：2024-07-30 11:09:08
更新时间：2024-07-30 11:09:08
当前版本：v1
策略内容

{
  "Statement": [
    {
      "Action": [
        "oss:GetObject",
        "oss:ListObjects",
        "oss:PutObject",
        "oss:DeleteObject",
        "oss:ListBuckets",
        "oss:ListObjectVersions",
        "oss:DeleteObjectVersion",
        "oss:AbortMultipartUpload",
        "oss:ListMultipartUploads",
        "oss:RestoreObject",
        "oss:GetBucketInfo",
        "oss:PutBucketInventory",
        "oss:PutObjectTagging",
        "oss:PostDataLakeStorageFileOperation",
        "oss:ListBucketInventory",
        "oss:DeleteBucketInventory",
        "oss:GetBucketInventory",
        "oss:PutBucketLogging",
        "oss:GetBucketLogging",
        "oss:DeleteBucketLogging",
        "oss:PutBucketLifecycle",
        "oss:GetBucketLifecycle",
        "oss:PutBucket",
        "oss:PutBucketTagging",
        "oss:DescribeRegions"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "rds:ModifySecurityIps",
        "rds:DescribeDBInstances",
        "rds:DescribeDBInstanceAttribute",
        "rds:DescribeSecurityGroupConfiguration",
        "rds:ModifySecurityGroupConfiguration",
        "polardb:ModifyDBClusterAccessWhitelist",
        "polardb:DescribeDBClusterAccessWhitelist",
        "polardb:DescribeDBClusterEndpoints",
        "alikafka:UpdateInstance",
        "alikafka:GetInstanceList"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "emr:ListClusters",
        "emr:DescribeClusterBasicInfo",
        "emr:DescribeClusterV2"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "log:ListLogStores",
        "log:ListShards",
        "log:GetLogStoreHistogram",
        "log:PostLogStoreLogs",
        "log:GetCursorOrData"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "ots:DescribeTunnel",
        "ots:ListTunnel",
        "ots:CreateTunnel",
        "ots:DeleteTunnel",
        "ots:ConnectTunnel",
        "ots:Heartbeat",
        "ots:ShutdownTunnel",
        "ots:GetCheckpoint",
        "ots:ReadRecords",
        "ots:Checkpoint",
        "ots:ListTable",
        "ots:CreateTable",
        "ots:DescribeTable",
        "ots:UpdateTable",
        "ots:ConsumeTunnel",
        "ots:BatchGetRow",
        "ots:BatchWriteRow",
        "ots:GetRange",
        "ots:PutRow",
        "ots:DeleteRow",
        "ots:DeleteTunnel"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "ecs:CreateNetworkInterfacePermission",
        "ecs:DescribeNetworkInterfacePermissions",
        "ecs:DeleteNetworkInterfacePermission",
        "ecs:CreateNetworkInterface",
        "ecs:DeleteNetworkInterface",
        "ecs:DescribeNetworkInterfaces",
        "ecs:DescribeEniMonitorData",
        "ecs:DescribeSecurityGroups",
        "ecs:DescribeSecurityGroupAttribute",
        "ecs:RevokeSecurityGroup",
        "ecs:AuthorizeSecurityGroup",
        "ecs:DescribeInstances",
        "ecs:AttachNetworkInterface",
        "ecs:AuthorizeSecurityGroupEgress",
        "ecs:CreateSecurityGroup",
        "ecs:DeleteSecurityGroup",
        "ecs:DescribeSecurityGroupReferences",
        "ecs:DetachNetworkInterface",
        "ecs:JoinSecurityGroup",
        "ecs:LeaveSecurityGroup",
        "ecs:ModifyNetworkInterfaceAttribute",
        "ecs:ModifySecurityGroupAttribute",
        "ecs:ModifySecurityGroupPolicy",
        "ecs:ModifySecurityGroupRule",
        "ecs:RevokeSecurityGroupEgress"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "vpc:DescribeVSwitches",
        "vpc:DescribeVSwitchAttributes",
        "vpc:DescribeVpcs",
        "vpc:DescribeVpcAttribute",
        "vpc:DescribeRouteTableList",
        "vpc:DescribeRouteTables",
        "vpc:DescribeRouteEntryList",
        "vpc:DescribeRouterInterfaceAttribute",
        "vpc:DescribeRouterInterfaces",
        "vpc:DescribeVRouters",
        "vpc:ModifyBypassToaAttribute"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "dts:CreateSubscriptionInstance",
        "dts:ConfigureSubscriptionInstance",
        "dts:StartSubscriptionInstance",
        "dts:DescribeSubscriptionInstances",
        "dts:DescribeSubscriptionInstanceStatus",
        "dts:CreateConsumerGroup",
        "dts:ModifySubscriptionObject",
        "dts:DeleteSubscriptionInstance"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "dlf:ListCatalogs",
        "dlf:ListDatabases",
        "dlf:ListFunctions",
        "dlf:ListTables",
        "dlf:ListTableNames",
        "dlf:CreateDatabase",
        "dlf:GetDatabase",
        "dlf:DeleteDatabase",
        "dlf:GetTable",
        "dlf:GetFunction",
        "dlf:CreateTable",
        "dlf:UpdateTable",
        "dlf:DeleteTable",
        "dlf:ListPartitions",
        "dlf:ListPartitionNames",
        "dlf:GetPartition",
        "dlf:CreatePartition",
        "dlf:BatchCreatePartitions",
        "dlf:UpdateTableColumnStatistics",
        "dlf:GetTableColumnStatistics",
        "dlf:DeleteTableColumnStatistics",
        "dlf:UpdatePartitionColumnStatistics",
        "dlf:GetPartitionColumnStatistics",
        "dlf:DeletePartitionColumnStatistics",
        "dlf:UpdateDatabase",
        "dlf:BatchCreateTables",
        "dlf:BatchDeleteTables",
        "dlf:BatchUpdateTables",
        "dlf:BatchGetTables",
        "dlf:BatchUpdatePartitions",
        "dlf:BatchDeletePartitions",
        "dlf:BatchGetPartitions",
        "dlf:DeletePartition",
        "dlf:CreateFunction",
        "dlf:DeleteFunction",
        "dlf:UpdateFunction",
        "dlf:ListPartitionsByFilter",
        "dlf:DeltaGetPermissions",
        "dlf:GetPermissions",
        "dlf:GetServiceInfo",
        "dlf:GetRoles",
        "dlf:GetCatalog",
        "dlf:GetCatalogSettings",
        "dlf:UpdateCatalogSettings",
        "dlf:CreateLock",
        "dlf:UnLock",
        "dlf:AbortLock",
        "dlf:RefreshLock",
        "dlf:GetLock",
        "dlf:ListTableVersions",
        "dlf:CheckPermissions",
        "dlf:GetAsyncTaskStatus",
        "dlf:CreateCatalog"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "ram:ListUserBasicInfos",
        "ram:ListUsersForGroup",
        "ram:ListGroups",
        "ram:ListRoles"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "dlf-dss:CreateDatabase",
        "dlf-dss:CreateFunction",
        "dlf-dss:CreateTable",
        "dlf-dss:DropDatabase",
        "dlf-dss:DropFunction",
        "dlf-dss:DropTable",
        "dlf-dss:DescribeCatalog",
        "dlf-dss:DescribeDatabase",
        "dlf-dss:DescribeFunction",
        "dlf-dss:DescribeTable",
        "dlf-dss:AlterDatabase",
        "dlf-dss:AlterFunction",
        "dlf-dss:AlterTable",
        "dlf-dss:ListCatalogs",
        "dlf-dss:ListDatabases",
        "dlf-dss:ListTables",
        "dlf-dss:ListFunctions",
        "dlf-dss:CheckPermissions"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "privatelink:OpenPrivateLinkService",
        "privatelink:CheckProductOpen",
        "privatelink:ListVpcEndpointServices",
        "privatelink:CreateVpcEndpoint",
        "privatelink:ListVpcEndpoints",
        "privatelink:UpdateVpcEndpointAttribute",
        "privatelink:GetVpcEndpointAttribute",
        "privatelink:ListVpcEndpointSecurityGroups",
        "privatelink:AttachSecurityGroupToVpcEndpoint",
        "privatelink:DetachSecurityGroupFromVpcEndpoint",
        "privatelink:AddZoneToVpcEndpoint",
        "privatelink:RemoveZoneFromVpcEndpoint",
        "privatelink:ListVpcEndpointZones",
        "privatelink:DeleteVpcEndpoint"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": "ram:CreateServiceLinkedRole",
      "Resource": "acs:ram:*:*:role/*",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "privatelink.aliyuncs.com"
        }
      },
      "Effect": "Allow"
    },
    {
      "Action": "ram:CreateServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "privatelink.aliyuncs.com"
        }
      }
    }
  ],
  "Version": "1"
}
策略详情

策略内容

相关文档
