AliyunServiceRolePolicyForEMRStarRocks 是专用于服务关联角色的授权策略，会在创建服务关联角色 AliyunServiceRoleForEMRStarRocks 时自动授权，以允许服务关联角色代您访问其他云服务。本策略由对应的阿里云服务按需更新，请勿将本策略授权给服务关联角色之外的 RAM 身份使用。
策略详情
类型：系统策略
创建时间：2025-12-31 14:28:39
更新时间：2026-04-21 02:30:45
当前版本：v29
策略内容
{
"Version": "1",
"Statement": [
{
"Action": [
"ecs:AssociateEipAddress",
"ecs:AttachNetworkInterface",
"ecs:AuthorizeSecurityGroup",
"ecs:AuthorizeSecurityGroupEgress",
"ecs:CreateNetworkInterface",
"ecs:CreateNetworkInterfacePermission",
"ecs:CreateSecurityGroup",
"ecs:RunInstances",
"ecs:DescribeInstances",
"ecs:DescribeAvailableResource",
"ecs:DeleteNetworkInterface",
"ecs:DeleteNetworkInterfacePermission",
"ecs:DeleteSecurityGroup",
"ecs:DescribeNetworkInterfacePermissions",
"ecs:DescribeNetworkInterfaces",
"ecs:DescribeSecurityGroupAttribute",
"ecs:DescribeSecurityGroupReferences",
"ecs:DescribeSecurityGroups",
"ecs:DetachNetworkInterface",
"ecs:JoinSecurityGroup",
"ecs:LeaveSecurityGroup",
"ecs:ModifyNetworkInterfaceAttribute",
"ecs:ModifySecurityGroupAttribute",
"ecs:ModifySecurityGroupPolicy",
"ecs:ModifySecurityGroupPolicy",
"ecs:ModifySecurityGroupRule",
"ecs:RevokeSecurityGroup",
"ecs:RevokeSecurityGroupEgress",
"ecs:UnassociateEipAddress",
"ecs:TagResources",
"ecs:UntagResources"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"slb:AddBackendServers",
"slb:AddListenerWhiteListItem",
"slb:AddTags",
"slb:AddVServerGroupBackendServers",
"slb:CreateLoadBalancer",
"slb:CreateLoadBalancerHTTPListener",
"slb:CreateLoadBalancerHTTPSListener",
"slb:CreateLoadBalancerTCPListener",
"slb:CreateLoadBalancerUDPListener",
"slb:CreateRules",
"slb:CreateVServerGroup",
"slb:DeleteLoadBalancer",
"slb:DeleteLoadBalancerListener",
"slb:DeleteRules",
"slb:DeleteVServerGroup",
"slb:DescribeHealthStatus",
"slb:DescribeListenerAccessControlAttribute",
"slb:DescribeLoadBalancerAttribute",
"slb:DescribeLoadBalancerHTTPListenerAttribute",
"slb:DescribeLoadBalancerHTTPListenerAttributes",
"slb:DescribeLoadBalancerHTTPSListenerAttribute",
"slb:DescribeLoadBalancerTCPListenerAttribute",
"slb:DescribeLoadBalancerUDPListenerAttribute",
"slb:DescribeLoadBalancers",
"slb:DescribeRegions",
"slb:DescribeRules",
"slb:DescribeTags",
"slb:DescribeVServerGroupAttribute",
"slb:DescribeVServerGroups",
"slb:ModifyLoadBalancerInstanceSpec",
"slb:ModifyLoadBalancerInternetSpec",
"slb:ModifyLoadBalancerInstanceChargeType",
"slb:ModifyLoadBalancerPayType",
"slb:RemoveBackendServers",
"slb:RemoveListenerWhiteListItem",
"slb:RemoveVServerGroupBackendServers",
"slb:SetBackendServers",
"slb:SetListenerAccessControlStatus",
"slb:SetLoadBalancerHTTPListenerAttribute",
"slb:SetLoadBalancerHTTPSListenerAttribute",
"slb:SetLoadBalancerName",
"slb:SetLoadBalancerStatus",
"slb:SetLoadBalancerTCPListenerAttribute",
"slb:SetLoadBalancerUDPListenerAttribute",
"slb:SetRule",
"slb:SetServerCertificateName",
"slb:SetVServerGroupAttribute",
"slb:StartLoadBalancerListener",
"slb:StopLoadBalancerListener",
"slb:SetLoadBalancerDeleteProtection",
"slb:RemoveTags",
"slb:DescribeLoadBalancerListeners",
"slb:ModifyVServerGroupBackendServers",
"slb:SetLoadBalancerModificationProtection",
"slb:CreateLoadBalancerForCloudService",
"slb:DescribeAccessControlLists",
"slb:DescribeAccessControlListAttribute",
"slb:DeleteAccessControlList",
"slb:CreateAccessControlList",
"slb:AddAccessControlListEntry",
"slb:RemoveAccessControlListEntry"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"vpc:DescribeVpcAttribute",
"vpc:DescribeVpcs",
"vpc:DescribeVSwitchAttributes",
"vpc:DescribeVSwitches",
"vpc:DescribeRouteTableList",
"vpc:DescribeRouteTables",
"vpc:DescribeRouteEntryList",
"vpc:DescribeRouterInterfaceAttribute",
"vpc:DescribeRouterInterfaces",
"vpc:DescribeVRouters",
"vpc:ModifyBypassToaAttribute"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"arms:ListDashboards",
"arms:CreateContact",
"arms:DeleteContact",
"arms:SearchContact",
"arms:UpdateContact",
"arms:CreateContactGroup",
"arms:DeleteContactGroup",
"arms:SearchContactGroup",
"arms:UpdateContactGroup",
"arms:SearchAlertRules",
"arms:CreateAlertRules",
"arms:UpdateAlertRules",
"arms:DeleteAlertRules",
"arms:StartAlertRule",
"arms:StopAlertRule",
"arms:SearchAlarmHistories",
"arms:OpenArmsService",
"arms:CreateWehook",
"arms:UpdateWebhook",
"arms:CreateDispatchRule",
"arms:ListDispatchRule",
"arms:DeleteDispatchRule",
"arms:UpdateDispatchRule",
"arms:DescribeDispatchRule",
"arms:QueryPromInstallStatus",
"arms:UninstallPromCluster",
"arms:DeleteAlertRule",
"arms:GetAlertRules"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"bss:RefundQueryRemainAmount",
"bss:RefundBatchRemainRefund",
"bss:DescribeOrderDetail",
"bss:CancelOrder"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"quotas:GetProductQuota"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": "ram:DeleteServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": "starrocks.aliyuncs.com"
}
}
},
{
"Action": "ram:CreateServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": "eipaccess.slb.aliyuncs.com"
}
}
},
{
"Action": [
"oss:GetObject",
"oss:ListObjects",
"oss:PutObject",
"oss:DeleteObject",
"oss:ListBuckets",
"oss:AbortMultipartUpload",
"oss:ListMultipartUploads",
"oss:RestoreObject",
"oss:GetBucketInfo",
"oss:ListObjectVersions",
"oss:DeleteObjectVersion",
"oss:PostDataLakeStorageFileOperation"
],
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"oss:BucketTag/Product": "EMRServerlessStarRocks"
}
}
},
{
"Action": [
"emr:ListClusters",
"emr:GetCluster",
"emr:ListNodes",
"emr:ListApplications"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"dlf-auth:ActOnBehalfOfAnotherUser",
"dlf-dss:AlterCatalog",
"dlf-dss:AlterDatabase",
"dlf-dss:AlterFunction",
"dlf-dss:AlterTable",
"dlf-dss:BatchGrantPermissions",
"dlf-dss:BatchRevokePermissions",
"dlf-dss:CheckPermissions",
"dlf-dss:CreateCatalog",
"dlf-dss:CreateDatabase",
"dlf-dss:CreateFunction",
"dlf-dss:CreateRole",
"dlf-dss:CreateTable",
"dlf-dss:DeleteRole",
"dlf-dss:DescribeCatalog",
"dlf-dss:DescribeDatabase",
"dlf-dss:DescribeFunction",
"dlf-dss:DescribeTable",
"dlf-dss:DropCatalog",
"dlf-dss:DropDatabase",
"dlf-dss:DropFunction",
"dlf-dss:DropTable",
"dlf-dss:GetCatalog",
"dlf-dss:GetDatabase",
"dlf-dss:GetFunction",
"dlf-dss:GetRole",
"dlf-dss:GetTable",
"dlf-dss:GrantPermissions",
"dlf-dss:GrantRoleToPrincipals",
"dlf-dss:GrantRoleToUsers",
"dlf-dss:GrantRolesToPrincipal",
"dlf-dss:GrantRolesToUser",
"dlf-dss:ListCatalogs",
"dlf-dss:ListDatabases",
"dlf-dss:ListFunctionNames",
"dlf-dss:ListFunctions",
"dlf-dss:ListPermissions",
"dlf-dss:ListRoleUsers",
"dlf-dss:ListRoles",
"dlf-dss:ListTableNames",
"dlf-dss:ListTables",
"dlf-dss:ListUserRoles",
"dlf-dss:RevokePermissions",
"dlf-dss:RevokeRoleFromPrincipals",
"dlf-dss:RevokeRoleFromUsers",
"dlf-dss:RevokeRolesFromPrincipal",
"dlf-dss:RevokeRolesFromUser",
"dlf-dss:SelectTable",
"dlf-dss:UpdatePermissions",
"dlf-dss:UpdateRole",
"dlf-dss:UpdateRolePrincipals",
"dlf-dss:UpdateRoleUsers",
"dlf-dss:UpdateTable",
"dlf:*",
"dlf:AlterDatabase",
"dlf:AlterTable",
"dlf:CommitTable",
"dlf:CreateBranch",
"dlf:CreateView",
"dlf:DropBranch",
"dlf:DropDatabase",
"dlf:DropTable",
"dlf:DropView",
"dlf:ForwardBranch",
"dlf:GetConfig",
"dlf:GetTableSnapshot",
"dlf:GetTableToken",
"dlf:GetView",
"dlf:ListBranches",
"dlf:ListTableDetails",
"dlf:ListViewDetails",
"dlf:ListViews",
"dlf:MarkDonePartitions",
"dlf:RenameView",
"dlf:AbortLock",
"dlf:BatchCreatePartitions",
"dlf:BatchCreatePartitionsAction",
"dlf:BatchCreateTables",
"dlf:BatchDeletePartitions",
"dlf:BatchDeleteTableVersions",
"dlf:BatchDeleteTables",
"dlf:BatchGetPartitionColumnStatistics",
"dlf:BatchGetPartitions",
"dlf:BatchGetTables",
"dlf:BatchGrantPermissions",
"dlf:BatchRevokePermissions",
"dlf:BatchUpdatePartitions",
"dlf:BatchUpdateTables",
"dlf:CheckPermissions",
"dlf:CreateCatalog",
"dlf:CreateDatabase",
"dlf:CreateFunction",
"dlf:CreateLock",
"dlf:CreatePartition",
"dlf:CreateTable",
"dlf:DeleteCatalog",
"dlf:DeleteDatabase",
"dlf:DeleteFunction",
"dlf:DeletePartition",
"dlf:DeletePartitionColumnStatistics",
"dlf:DeleteTable",
"dlf:DeleteTableColumnStatistics",
"dlf:DeleteTableVersion",
"dlf:DeltaGetPermissions",
"dlf:GetAsyncTaskStatus",
"dlf:GetCatalog",
"dlf:GetCatalogAccessInfo",
"dlf:GetCatalogByInstanceId",
"dlf:GetCatalogSettings",
"dlf:GetDataToken",
"dlf:GetDataTokenByName",
"dlf:GetDatabase",
"dlf:GetFunction",
"dlf:GetLock",
"dlf:GetPartition",
"dlf:GetPartitionColumnStatistics",
"dlf:GetPermissions",
"dlf:GetRole",
"dlf:GetRoles",
"dlf:GetTable",
"dlf:GetTableColumnStatistics",
"dlf:GetTableVersion",
"dlf:GrantPermissions",
"dlf:ListCatalogs",
"dlf:ListDatabases",
"dlf:ListFunctionNames",
"dlf:ListFunctions",
"dlf:ListPartitionNames",
"dlf:ListPartitions",
"dlf:ListPartitionsByExpr",
"dlf:ListPartitionsByFilter",
"dlf:ListPermissions",
"dlf:ListRoles",
"dlf:ListTableNames",
"dlf:ListTableVersions",
"dlf:ListTables",
"dlf:RefreshLock",
"dlf:RenamePartition",
"dlf:RenameTable",
"dlf:RevokePermissions",
"dlf:Search",
"dlf:SearchAcrossCatalog",
"dlf:UnLock",
"dlf:UpdateCatalog",
"dlf:UpdateDatabase",
"dlf:UpdateFunction",
"dlf:UpdatePartitionColumnStatistics",
"dlf:UpdatePermissions",
"dlf:UpdateTable",
"dlf:UpdateTableColumnStatistics"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"ram:GetUser"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"kms:List*",
"kms:Describe*",
"kms:TagResource",
"kms:UntagResource",
"kms:Encrypt",
"kms:Decrypt",
"kms:GenerateDataKey"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"bssapi:SetRenewal",
"bssapi:DescribeInstanceBill"
],
"Resource": "*",
"Effect": "Allow"
}
]
}相关文档
该文章对您有帮助吗？