AliyunServiceRolePolicyForEMROnACS 是专用于服务关联角色的授权策略,会在创建服务关联角色 AliyunServiceRoleForEMROnACS 时自动授权,以允许服务关联角色代您访问其他云服务。本策略由对应的阿里云服务按需更新,请勿将本策略授权给服务关联角色之外的 RAM 身份使用。
策略详情
类型:系统策略
创建时间:2024-10-12 09:51:44
更新时间:2025-09-16 06:20:32
当前版本:v8
策略内容
{
"Version": "1",
"Statement": [
{
"Action": [
"cs:CreateCluster",
"cs:GetClusterById",
"cs:GetClusters",
"cs:DeleteCluster",
"cs:ModifyCluster",
"cs:DescribeClusterResources",
"cs:DescribeClusterInnerServiceKubeconfig",
"cs:RevokeClusterInnerServiceKubeconfig",
"cs:CreateClusterNodePool",
"cs:DeleteClusterNodepool",
"cs:DescribeClusterNodePoolDetail",
"cs:DescribeClusterNodePools",
"cs:ModifyClusterNodePool",
"cs:ScaleClusterNodePool",
"cs:AttachInstancesToNodePool",
"cs:RemoveNodePoolNodes",
"cs:SyncClusterNodePool",
"cs:DescribeClusterAttachScripts",
"cs:CreateAutoscalingConfig"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"pvtz:DescribeZones",
"pvtz:DescribeZoneRecords",
"pvtz:DescribeZoneInfo",
"pvtz:AddZone",
"pvtz:DescribeUserServiceStatus",
"pvtz:AddZoneRecord",
"pvtz:UpdateZoneRecord",
"pvtz:BindZoneVpc"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"vpc:DescribeVSwitches",
"vpc:DescribeVpcs",
"vpc:DescribeVSwitchAttributes",
"vpc:DescribeVpcAttribute",
"vpc:ListTagResources",
"vpc:TagResources",
"vpc:UnTagResources",
"vpc:CreateVpc",
"vpc:CreateDefaultVpc",
"vpc:DescribeVpcAttribute",
"vpc:DeleteVpc",
"vpc:CreateVSwitch",
"vpc:DescribeVSwitchAttributes",
"vpc:DeleteVSwitch"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"privatelink:CheckProductOpen",
"privatelink:ListVpcEndpoints",
"privatelink:ListVpcEndpointZones",
"privatelink:AddZoneToVpcEndpoint",
"privatelink:RemoveZoneFromVpcEndpoint",
"privatelink:GetVpcEndpointAttribute",
"privatelink:GetVpcEndpointServiceAttribute",
"privatelink:ListVpcEndpointServicesByEndUser",
"privatelink:ListVpcEndpointServices",
"privatelink:ListVpcEndpointServiceUsers",
"privatelink:AddUserToVpcEndpointService",
"privatelink:RemoveUserFromVpcEndpointService",
"privatelink:CreateVpcEndpointService",
"privatelink:DeleteVpcEndpointService",
"privatelink:CreateVpcEndpoint",
"privatelink:DeleteVpcEndpoint",
"privatelink:ListVpcEndpointServiceResources"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": "ram:DeleteServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": "emrkube.aliyuncs.com"
}
}
},
{
"Action": [
"ecs:AssociateEipAddress",
"ecs:AttachNetworkInterface",
"ecs:AuthorizeSecurityGroup",
"ecs:AuthorizeSecurityGroupEgress",
"ecs:CreateNetworkInterface",
"ecs:CreateNetworkInterfacePermission",
"ecs:CreateSecurityGroup",
"ecs:DeleteNetworkInterface",
"ecs:DeleteNetworkInterfacePermission",
"ecs:DeleteSecurityGroup",
"ecs:DescribeNetworkInterfacePermissions",
"ecs:DescribeNetworkInterfaces",
"ecs:DescribeSecurityGroupAttribute",
"ecs:DescribeSecurityGroupReferences",
"ecs:DescribeSecurityGroups",
"ecs:DetachNetworkInterface",
"ecs:JoinSecurityGroup",
"ecs:LeaveSecurityGroup",
"ecs:ModifyNetworkInterfaceAttribute",
"ecs:ModifySecurityGroupAttribute",
"ecs:ModifySecurityGroupPolicy",
"ecs:ModifySecurityGroupPolicy",
"ecs:ModifySecurityGroupRule",
"ecs:RevokeSecurityGroup",
"ecs:RevokeSecurityGroupEgress",
"ecs:UnassociateEipAddress",
"ecs:AssignIpv6Addresses",
"ecs:AssignPrivateIpAddresses",
"ecs:DescribeInstanceAttribute",
"ecs:DescribeInstances",
"ecs:ListTagResources",
"ecs:ModifySecurityGroupEgressRule",
"ecs:TagResources",
"ecs:UnassignIpv6Addresses",
"ecs:UnassignPrivateIpAddresses",
"ecs:UntagResources"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": "ram:CreateServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": "privatelink.aliyuncs.com"
}
}
}
]
}
相关文档
该文章对您有帮助吗?