AliyunServiceRolePolicyForAgenticPAI-访问控制(RAM)-阿里云帮助中心

AliyunServiceRolePolicyForAgenticPAI 是专用于服务关联角色的授权策略，会在创建服务关联角色 AliyunServiceRoleForAgenticPAI 时自动授权，以允许服务关联角色代您访问其他云服务。本策略由对应的阿里云服务按需更新，请勿将本策略授权给服务关联角色之外的 RAM 身份使用。
策略详情

类型：系统策略
创建时间：2026-07-30 11:20:01
更新时间：2026-08-24 12:06:51
当前版本：v2
策略内容

{
  "Version": "1",
  "Statement": [
    {
      "Action": [
        "ecs:DescribeRegions",
        "ecs:DescribeZones",
        "ecs:DescribeImages",
        "ecs:DescribeInstances",
        "ecs:DescribeDisks",
        "ecs:DescribeSecurityGroupAttribute",
        "ecs:DescribeSecurityGroups",
        "ecs:DescribeInstanceHistoryEvents",
        "ecs:DescribeInstancesFullStatus",
        "ecs:DescribeDisksFullStatus",
        "ecs:DescribeResourcesModification",
        "ecs:DescribeAvailableResource",
        "ecs:DescribeBandwidthLimitation",
        "ecs:DescribeNetworkInterfaces",
        "ecs:DescribeNetworkInterfacePermissions",
        "ecs:DescribeKeyPairs",
        "ecs:DescribeInstanceHistoryEvents",
        "ecs:DescribeTasks",
        "ecs:ListTagResources",
        "ecs:DescribeInvocations",
        "ecs:DescribeInvocationResults",
        "ecs:DescribeInstances",
        "ecs:DescribeInstanceAttribute",
        "ecs:DescribeNetworkInterfaceAttribute"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "vpc:DescribeVSwitches",
        "vpc:DescribeVpcs",
        "vpc:DescribeVSwitchAttributes",
        "vpc:DescribeVpcAttribute",
        "vpc:AssociateEipAddress",        
        "vpc:DescribeRouteTableList",
        "vpc:DescribeRouteEntryList",
        "vpc:GetNatGatewayAttribute",
        "vpc:DescribeForwardTableEntries",
        "vpc:DescribeEipAddresses",
        "vpc:GetIpv4GatewayAttribute",
        "vpc:ListIpv4Gateways"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "cs:GetClusterById",
        "cs:GetClusters",
        "cs:GetUserConfig",
        "cs:DescribeClusterLogsRequest",
        "cs:GetClusterLogs",
        "cs:DescribeClusterNodes"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "bss:DescribeAcccount",
        "bss:DescribeCoupons"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "ess:DescribeRegions"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "nas:DescribeFileSystems",
        "nas:DescribeMountTargets",
        "nas:DescribeProtocolMountTarget"
      ],
      "Effect": "Allow",
      "Resource": "*"
    },
    {
      "Action": [
        "slb:DescribeLoadBalancers",
        "slb:DescribeHealthStatus",
        "slb:DescribeLoadBalancerAttribute"
      ],
      "Effect": "Allow",
      "Resource": "*"
    },
    {
      "Action": [
        "arms:GetPrometheusApiToken",
        "arms:ListPromClusters",
        "arms:ListClusterFromGrafana",
        "arms:DescribeTraceLicenseKey"
      ],
      "Effect": "Allow",
      "Resource": "*"
    },
    {
      "Action": [
        "cr:ListNamespace",
        "cr:ListRepository",
        "cr:GetAuthorizationToken",
        "cr:ListInstanceEndpoint",
        "cr:PullRepository",
        "cr:GetInstance",
        "cr:GetInstanceVpcEndpoint",
        "cr:ListInstance",
        "cr:ListInstanceDomain",
        "cr:GetRepository",
        "cr:GetRepositoryLayers",
        "cr:ListRepositoryTag"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "datasetacc:DescribeInstance",
        "datasetacc:DescribeSlot",
        "datasetacc:DescribeEndpoint"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "pvtz:DescribeZones",
        "pvtz:DescribeZoneInfo",
        "pvtz:BindZoneVpc"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": "ram:CreateServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "systemeventoperator.oos.aliyuncs.com"
        }
      }
    },
    {
      "Action": [
        "oss:ListParts",
        "oss:ListObjects",
        "oss:ListBuckets",
        "oss:GetBucketCors",
        "oss:GetBucketInfo",
        "oss:GetBucketStat",
        "oss:ListBuckets"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "stream:ActOnBehalfOfAnotherUser",
        "stream:StartJobWithParams",
        "stream:ListDeployments",
        "stream:GetDeployment",
        "stream:GetJob"
      ],
      "Effect": "Allow",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "nlb:GetLoadBalancerAttribute",
        "nlb:GetListenerHealthStatus",
        "nlb:GetListenerAttribute",
        "nlb:ListListeners",
        "nlb:ListLoadBalancers",
        "nlb:ListServerGroups",
        "nlb:ListServerGroupServers",
        "nlb:GetJobStatus",
        "nlb:LoadBalancerJoinSecurityGroup",
        "nlb:LoadBalancerLeaveSecurityGroup",
        "nlb:ListAsynJobs",
        "nlb:StartListener"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "paiworkspace:GetPermission",
        "paiworkspace:GetWorkspace",
        "paiworkspace:GetMember",
        "paiworkspace:ListMembers",
        "paiworkspace:ListWorkspaceRoles",
        "paiworkspace:ListConfigs",
        "paidsw:GetInstance",
        "paidataset:GetDatasetVersion",
        "paidataset:GetDataset"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "paidlc:CreateJob",
        "paidlc:CreateJobTemplate",
        "paidlc:CreateRayHistoryServer",
        "paidlc:CreateSignal",
        "paidlc:CreateTensorboard",
        "paidlc:GetDashboard",
        "paidlc:GetJob",
        "paidlc:GetJobEvents",
        "paidlc:GetJobMetrics",
        "paidlc:GetJobPagedEvents",
        "paidlc:GetJobPagedLogs",
        "paidlc:GetJobSanityCheckResult",
        "paidlc:GetJobTemplate",
        "paidlc:GetMetrics",
        "paidlc:GetPodContextEvents",
        "paidlc:GetPodContextLogs",
        "paidlc:GetPodEvents",
        "paidlc:GetPodLogs",
        "paidlc:GetPodPagedEvents",
        "paidlc:GetPodPagedLogs",
        "paidlc:GetRayDashboard",
        "paidlc:GetRayHistoryServer",
        "paidlc:GetSignal",
        "paidlc:GetTensorboard",
        "paidlc:GetTensorboardSharedUrl",
        "paidlc:GetToken",
        "paidlc:GetWebTerminal",
        "paidlc:ListEcsSpecs",
        "paidlc:ListJobRetries",
        "paidlc:ListJobSanityCheckResults",
        "paidlc:ListJobTemplates",
        "paidlc:ListJobs",
        "paidlc:ListRayHistoryServers",
        "paidlc:ListSignals",
        "paidlc:ListTensorboards",
        "paidlc:SetJobTemplateDefaultVersion",
        "paidlc:StartRayHistoryServer",
        "paidlc:StartTensorboard",
        "paidlc:StopJob",
        "paidlc:StopRayHistoryServer",
        "paidlc:StopTensorboard",
        "paidlc:TagResources",
        "paidlc:UntagResources",
        "paidlc:UpdateJob",
        "paidlc:UpdateJobTemplate",
        "paidlc:UpdateTensorboard"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "paidsw:CreateDiagnosis",
        "paidsw:CreateIdleInstanceCuller",
        "paidsw:CreateInstanceShutdownTimer",
        "paidsw:CreateInstanceSnapshot",
        "paidsw:CreatePostPaidInstance",
        "paidsw:CreateSanityCheckTask",
        "paidsw:CreateTempFile",
        "paidsw:CreateTempFileTask",
        "paidsw:GetIdleInstanceCuller",
        "paidsw:GetInstance",
        "paidsw:GetInstanceEvents",
        "paidsw:GetInstanceMetrics",
        "paidsw:GetInstanceShutdownTimer",
        "paidsw:GetInstanceSnapshot",
        "paidsw:GetLifecycle",
        "paidsw:GetMetrics",
        "paidsw:GetResourceGroupStatistics",
        "paidsw:GetSanityCheckTask",
        "paidsw:GetTempFile",
        "paidsw:GetTempFileTask",
        "paidsw:GetToken",
        "paidsw:GetUserCommand",
        "paidsw:GetUserConfig",
        "paidsw:ListEcsSpecs",
        "paidsw:ListInstanceSnapshot",
        "paidsw:ListInstanceStatistics",
        "paidsw:ListInstances",
        "paidsw:ListSystemLogs",
        "paidsw:ListTempFiles",
        "paidsw:QueryAutoShutdownPolicies",
        "paidsw:StartInstance",
        "paidsw:StopInstance",
        "paidsw:UpdateInstanceLabels",
        "paidsw:UpdatePostPaidInstance",
        "paidsw:UpdateTempFile",
        "paidsw:UpdateTempFileTask"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "dlf:GetConfig",
        "dlf:ListDatabases",
        "dlf:GetDatabase",
        "dlf:AlterDatabase",
        "dlf:ListTables",
        "dlf:GetTable",
        "dlf:AlterTable",
        "dlf:GetTableToken"
      ],
      "Resource": "*"
    },
    {
      "Action": [
        "agenticpai:*"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": "ram:DeleteServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "agentic.pai.aliyuncs.com"
        }
      }
    }
  ]
}
策略详情

策略内容

相关文档
