AliyunServiceRolePolicyForPaiEasManageCustomerClusters-访问控制(RAM)-阿里云帮助中心

AliyunServiceRolePolicyForPaiEasManageCustomerClusters 是专用于服务关联角色的授权策略，会在创建服务关联角色 AliyunServiceRoleForPaiEasManageCustomerClusters 时自动授权，以允许服务关联角色代您访问其他云服务。本策略由对应的阿里云服务按需更新，请勿将本策略授权给服务关联角色之外的 RAM 身份使用。
策略详情

类型：系统策略
创建时间：2025-12-09 13:53:23
更新时间：2025-12-09 13:53:23
当前版本：v1
策略内容

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "privatelink:OpenPrivateLinkService",
        "privatelink:CheckProductOpen",
        "privatelink:ListVpcEndpointServices",
        "privatelink:CreateVpcEndpoint",
        "privatelink:ListVpcEndpoints",
        "privatelink:UpdateVpcEndpointAttribute",
        "privatelink:GetVpcEndpointAttribute",
        "privatelink:ListVpcEndpointSecurityGroups",
        "privatelink:AttachSecurityGroupToVpcEndpoint",
        "privatelink:DetachSecurityGroupFromVpcEndpoint",
        "privatelink:AddZoneToVpcEndpoint",
        "privatelink:RemoveZoneFromVpcEndpoint",
        "privatelink:ListVpcEndpointZones",
        "privatelink:GetVpcEndpointServiceAttribute",
        "privatelink:DeleteVpcEndpoint"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "vpc:DescribeVpcs",
        "vpc:DescribeVpcAttribute",
        "vpc:DescribeVSwitches",
        "vpc:DescribeVSwitchAttributes"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "ecs:DescribeSecurityGroups",
        "ecs:CreateSecurityGroup",
        "ecs:DeleteSecurityGroup",
        "ecs:AuthorizeSecurityGroup",
        "ecs:AuthorizeSecurityGroupEgress",
        "ecs:RevokeSecurityGroup",
        "ecs:RevokeSecurityGroupEgress",
        "ecs:CreateNetworkInterface",
        "ecs:DeleteNetworkInterface",
        "ecs:DescribeNetworkInterfaces",
        "ecs:CreateNetworkInterfacePermission",
        "ecs:DescribeNetworkInterfacePermissions",
        "ecs:DeleteNetworkInterfacePermission",
        "ecs:AttachNetworkInterface",
        "ecs:DetachNetworkInterface"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "cs:DescribeClusterDetail",
        "cs:DescribeClusterUserKubeconfig"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "log:GetIndex",
        "log:GetConfig",
        "log:GetLogStore",
        "log:GetProject",
        "log:GetLogStoreLogs",
        "log:GetLogStoreHistogram",
        "log:GetMachineGroup",
        "log:ListLogStores",
        "log:ListSavedSearch",
        "log:ListProject",
        "log:ListDashboard",
        "log:CreateConfig",
        "log:CreateIndex",
        "log:CreateLogStore",
        "log:CreateMachineGroup",
        "log:CreateProject",
        "log:CreateTicket",
        "log:DeleteConfig",
        "log:DeleteIndex",
        "log:DeleteLogStore",
        "log:DeleteMachineGroup",
        "log:DeleteProject",
        "log:ApplyConfigToGroup",
        "log:GetProductDataCollection",
        "log:OpenProductDataCollection",
        "log:CloseProductDataCollection"
      ],
      "Resource": [
        "acs:log:*:*:project/*/logstore/alb_*",
        "acs:log:*:*:project/*/logstore/eas-*",
        "acs:log:*:*:ticket/*",
        "acs:log:*:*:project/eas-*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "pvtz:AddZone",
        "pvtz:BindZoneVpc",
        "pvtz:AddZoneRecord",
        "pvtz:DeleteZone",
        "pvtz:DescribeZoneInfo",
        "pvtz:DescribeZones"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "yundun-cert:GetUserCertificateDetail",
        "yundun-cert:DescribeSSLCertificateList",
        "yundun-cert:DescribeSSLCertificatePublicKeyDetail",
        "yundun-cert:CreateSSLCertificateWithName",
        "yundun-cert:DeleteSSLCertificate"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "asi:DescribeClusterDetail"
      ],
      "Resource": "*"
    },
    {
      "Action": "ram:DeleteServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "eas-customer-clusters.pai.aliyuncs.com"
        }
      }
    },
    {
      "Action": [
        "alb:EnableLoadBalancerIpv6Internet",
        "alb:DisableLoadBalancerIpv6Internet",
        "alb:CreateAcl",
        "alb:DeleteAcl",
        "alb:ListAcls",
        "alb:ListAclRelations",
        "alb:AddEntriesToAcl",
        "alb:AssociateAclsWithListener",
        "alb:ListAclEntries",
        "alb:RemoveEntriesFromAcl",
        "alb:DissociateAclsFromListener",
        "alb:TagResources",
        "alb:UnTagResources",
        "alb:ListServerGroups",
        "alb:ListServerGroupServers",
        "alb:AddServersToServerGroup",
        "alb:RemoveServersFromServerGroup",
        "alb:ReplaceServersInServerGroup",
        "alb:CreateLoadBalancer",
        "alb:DeleteLoadBalancer",
        "alb:UpdateLoadBalancerAttribute",
        "alb:UpdateLoadBalancerEdition",
        "alb:EnableLoadBalancerAccessLog",
        "alb:DisableLoadBalancerAccessLog",
        "alb:EnableDeletionProtection",
        "alb:DisableDeletionProtection",
        "alb:ListLoadBalancers",
        "alb:GetLoadBalancerAttribute",
        "alb:ListListeners",
        "alb:CreateListener",
        "alb:GetListenerAttribute",
        "alb:UpdateListenerAttribute",
        "alb:ListListenerCertificates",
        "alb:AssociateAdditionalCertificatesWithListener",
        "alb:DissociateAdditionalCertificatesFromListener",
        "alb:DeleteListener",
        "alb:CreateRule",
        "alb:DeleteRule",
        "alb:UpdateRuleAttribute",
        "alb:CreateRules",
        "alb:UpdateRulesAttribute",
        "alb:DeleteRules",
        "alb:ListRules",
        "alb:UpdateListenerLogConfig",
        "alb:CreateServerGroup",
        "alb:DeleteServerGroup",
        "alb:UpdateServerGroupAttribute",
        "alb:UpdateLoadBalancerAddressTypeConfig",
        "alb:AttachCommonBandwidthPackageToLoadBalancer",
        "alb:DetachCommonBandwidthPackageFromLoadBalancer",
        "alb:UpdateServerGroupServersAttribute",
        "alb:MoveResourceGroup",
        "alb:ListAScripts",
        "alb:CreateAScripts",
        "alb:UpdateAScripts",
        "alb:DeleteAScripts",
        "alb:LoadBalancerJoinSecurityGroup",
        "alb:LoadBalancerLeaveSecurityGroup",
        "alb:AssociateResources",
        "alb:DescribeZones",
        "alb:UpdateLoadBalancerZones"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": "ram:CreateServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": [
            "middlewarelens.log.aliyuncs.com",
            "ai-lens.log.aliyuncs.com",
            "securitylens.log.aliyuncs.com",
            "storagelens.log.aliyuncs.com",
            "privatelink.aliyuncs.com",
            "alb.aliyuncs.com",
            "audit.log.aliyuncs.com",
            "nlb.aliyuncs.com",
            "logdelivery.alb.aliyuncs.com"
          ]
        }
      }
    }
  ]
}
策略详情

策略内容

相关文档
