AliyunServiceRolePolicyForPaiRec_访问控制(RAM)-阿里云帮助中心

AliyunServiceRolePolicyForPaiRec 是专用于服务关联角色的授权策略，会在创建服务关联角色 AliyunServiceRoleForPaiRec 时自动授权，以允许服务关联角色代您访问其他云服务。本策略由对应的阿里云服务按需更新，请勿将本策略授权给服务关联角色之外的 RAM 身份使用。
策略详情

类型：系统策略
创建时间：2025-10-09 17:51:48
更新时间：2025-10-09 17:51:48
当前版本：v1
策略内容

{
  "Version": "1",
  "Statement": [
    {
      "Action": "ram:DeleteServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "pairec.pai.aliyuncs.com"
        }
      }
    },
    {
      "Action": [
        "ram:GetRole"
      ],
      "Resource": "acs:ram:*:*:role/aliyunserviceroleforpairec",
      "Effect": "Allow"
    },
    {
      "Action": [
        "ram:ListPoliciesForUser",
        "ram:ListUsers"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Effect": "Allow",
      "Action": [
        "cr:ListNamespace",
        "cr:ListRepository",
        "cr:GetAuthorizationToken",
        "cr:ListInstanceEndpoint",
        "cr:PullRepository",
        "cr:PushRepository",
        "cr:GetInstance",
        "cr:GetInstanceVpcEndpoint",
        "cr:ListInstance",
        "cr:ListInstanceDomain",
        "cr:ListRepoTag",
        "cr:GetRepoTagLayers",
        "cr:GetRepoTagManifest",
        "cr:GetRepoTag",
        "cr:ListRepositoryTag"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "eas:ListServiceInstances",
        "eas:ListServices",
        "eas:CreateService",
        "eas:StartService",
        "eas:StopService",
        "eas:CommitService",
        "eas:UpdateServiceVersion",
        "eas:DescribeService",
        "eas:UpdateService",
        "eas:DescribeServiceLog",
        "eas:ListResources",
        "eas:DescribeResource"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "log:CreateConfig",
        "log:GetConfig",
        "log:UpdateConfig",
        "log:DeleteConfig",
        "log:CreateMachineGroup",
        "log:GetMachineGroup",
        "log:DeleteMachineGroup",
        "log:ApplyConfigToGroup",
        "log:ListProject",
        "log:ListLogStores"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "dhs:ListTopic",
        "dhs:CreateTopic",
        "dhs:GetTopic",
        "dhs:ListProject",
        "dhs:GetProject",
        "dhs:CreateSubscription",
        "dhs:ListSubscription"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "oss:GetObject",
        "oss:PutObject",
        "oss:DeleteObject",
        "oss:ListParts",
        "oss:AbortMultipartUpload",
        "oss:ListObjects",
        "oss:ListBuckets",
        "oss:PutBucketCors",
        "oss:GetBucketCors",
        "oss:DeleteBucketCors"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "oss:BucketTag/pairec": "1"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "dataworks:ListProjects",
        "dataworks:GetProject",
        "dataworks:ListBusiness",
        "dataworks:ListFolders",
        "dataworks:ListFiles",
        "dataworks:DeployFile",
        "dataworks:SubmitFile",
        "dataworks:CreateFile",
        "dataworks:UpdateFile",
        "dataworks:CreateImportMigration",
        "dataworks:StartMigration",
        "dataworks:GetRole",
        "dataworks:CreateProjectMember",
        "dataworks:AddProjectMemberToRole",
        "dataworks:ListNodes",
        "dataworks:RunCycleDagNodes",
        "dataworks:ListInstances",
        "dataworks:GetInstanceLog",
        "dataworks:GetDag",
        "dataworks:GetNodeChildren",
        "dataworks:GetNodeParents",
        "dataworks:UpdateNodeRunMode",
        "dataworks:GetNode",
        "dataworks:ListDataSources",
        "dataworks:ListPartitions",
        "dataworks:ListTables"
      ],
      "Resource": "*"
    },
    {
      "Action": [
        "hologram:ListInstances",
        "hologram:GetInstance",
        "hologram:GetInstanceMetrics"
      ],
      "Effect": "Allow",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "odps:ActOnBehalfOfAUser",
        "odps:ActOnBehalfOfAnotherUser"
      ],
      "Resource": "acs:odps:*:*:users/*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "odps:ListProjects",
        "odps:ListTables",
        "odps:Describe",
        "odps:GetTableInfo",
        "odps:ListUsers"
      ],
      "Resource": "*"
    },
    {
      "Action": "ram:CreateServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "eas.pai.aliyuncs.com"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "featurestore:ListInstances",
        "featurestore:GetInstance",
        "featurestore:GetProject",
        "featurestore:ExportModelFeatureTrainingSetTable",
        "featurestore:ListProjects",
        "featurestore:ListProjectFeatureViews",
        "featurestore:GetProjectModelFeature",
        "featurestore:GetProjectFeatureView",
        "featurestore:GetProjectFeatureEntity",
        "featurestore:ListDatasources",
        "featurestore:GetDatasource",
        "featurestore:ListDatasourceTables",
        "featurestore:GetDatasourceTable",
        "featurestore:CreateFeatureEntity",
        "featurestore:ListFeatureEntities",
        "featurestore:GetFeatureEntity",
        "featurestore:DeleteFeatureEntity",
        "featurestore:PublishFeatureViewTable",
        "featurestore:ListFeatureViews",
        "featurestore:GetFeatureView",
        "featurestore:DeleteFeatureView",
        "featurestore:CreateFeatureView",
        "featurestore:UpdateLabelTable",
        "featurestore:ListLabelTables",
        "featurestore:GetLabelTable",
        "featurestore:DeleteLabelTable",
        "featurestore:CreateLabelTable",
        "featurestore:ListModelFeatures",
        "featurestore:GetModelFeature",
        "featurestore:DeleteModelFeature",
        "featurestore:CreateModelFeature",
        "featurestore:UpdateModelFeature",
        "featurestore:GetTask",
        "featurestore:ListTaskLogs",
        "featurestore:ListTasks"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "paidlc:CreateJob",
        "paidlc:GetJob",
        "paidlc:ListJobs"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "paidataset:GetDataset",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "paiworkspace:GetWorkspace",
        "paiworkspace:ListWorkspaces",
        "paiworkspace:GetPermission"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "pai:AssumeUser",
      "Resource": "acs:pai:*:*:users/*"
    },
    {
      "Effect": "Allow",
      "Resource": "*",
      "Action": [
        "ram:ListUserBasicInfos"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "stream:DescribeVvpInstances",
        "stream:DescribeVvpNamespaces",
        "stream:ListDeployments",
        "stream:CreateDeployment",
        "stream:UpdateDeployment",
        "stream:GetDeployment",
        "stream:DeleteDeployment",
        "stream:ListDeploymentTargets",
        "stream:CreateMember",
        "stream:GetMember",
        "stream:ListMembers",
        "stream:UpdateMember",
        "stream:GetFolder",
        "stream:CreateFolder",
        "stream:ListEngineVersionMetadata",
        "stream:ListDeploymentDrafts",
        "stream:CreateDeploymentDraft",
        "stream:UpdateDeploymentDraft",
        "stream:ListCustomConnectors",
        "stream:DeleteCustomConnector",
        "stream:RegisterCustomConnector",
        "stream:CreateUdfArtifact",
        "stream:GetUdfArtifacts",
        "stream:UpdateUdfArtifact",
        "stream:RegisterUdfFunction",
        "stream:GetDeployDeploymentDraftResult",
        "stream:DeployDeploymentDraftAsync",
        "stream:ListJobs",
        "stream:StopJob",
        "stream:StartJobWithParams",
        "stream:UpdateVariable",
        "stream:CreateVariable",
        "stream:ListVariables",
        "stream:GetDeploymentDraftLock"
      ],
      "Resource": "*"
    },
    {
      "Action": [
        "privatelink:ListVpcEndpoints",
        "privatelink:GetVpcEndpointAttribute",
        "privatelink:CreateVpcEndpoint",
        "privatelink:AddZoneToVpcEndpoint",
        "privatelink:ListVpcEndpointSecurityGroups"
      ],
      "Effect": "Allow",
      "Resource": "*"
    },
    {
      "Action": "ram:CreateServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "privatelink.aliyuncs.com"
        }
      }
    },
    {
      "Action": [
        "ecs:CreateSecurityGroup",
        "ecs:AuthorizeSecurityGroup",
        "ecs:AuthorizeSecurityGroupEgress"
      ],
      "Effect": "Allow",
      "Resource": "*"
    },
    {
      "Action": [
        "vpc:DescribeVSwitchAttributes",
        "vpc:DescribeVpcAttribute"
      ],
      "Effect": "Allow",
      "Resource": "*"
    }
  ]
}
策略详情

策略内容

相关文档
