AliyunServiceRolePolicyForPolarDB

AliyunServiceRolePolicyForPolarDB 是专用于服务关联角色的授权策略，会在创建服务关联角色 AliyunServiceRoleForPolarDB 时自动授权，以允许服务关联角色代您访问其他云服务。本策略由对应的阿里云服务按需更新，请勿将本策略授权给服务关联角色之外的 RAM 身份使用。

策略详情

• 类型：系统策略

• 创建时间：2020-03-15 21:25:17

• 更新时间：2026-03-24 02:40:40

• 当前版本：v21

策略内容

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "pvtz:DescribeUserServiceStatus",
                "pvtz:DescribeZones",
                "pvtz:DescribeZoneInfo",
                "pvtz:DescribeZoneRecords",
                "pvtz:CheckZoneName",
                "pvtz:AddZone",
                "pvtz:BindZoneVpc",
                "pvtz:DeleteZone",
                "pvtz:AddZoneRecord",
                "pvtz:UpdateZoneRecord",
                "pvtz:DeleteZoneRecord",
                "dts:CreateDtsInstance",
                "dts:ConfigureDtsJob",
                "dts:StartDtsJob",
                "dts:DescribePreCheckStatus",
                "dts:DescribeDtsJobDetail",
                "dts:DescribeDtsJobs",
                "dts:ModifyDtsJob",
                "dts:SuspendDtsJob",
                "dts:StopDtsJob",
                "dts:DeleteDtsJob",
                "dts:CheckDefaultRole",
                "dts:ReverseTwoWayDirection",
                "dts:ModifyDtsJobEndpoint",
                "privatelink:ListVpcEndpointServicesByEndUser",
                "privatelink:CreateVpcEndpoint",
                "privatelink:ListVpcEndpoints",
                "privatelink:UpdateVpcEndpointAttribute",
                "privatelink:GetVpcEndpointAttribute",
                "privatelink:ListVpcEndpointSecurityGroups",
                "privatelink:AttachSecurityGroupToVpcEndpoint",
                "privatelink:DetachSecurityGroupFromVpcEndpoint",
                "privatelink:AddZoneToVpcEndpoint",
                "privatelink:RemoveZoneFromVpcEndpoint",
                "privatelink:ListVpcEndpointZones",
                "privatelink:DeleteVpcEndpoint",
                "ecs:CreateNetworkInterface",
                "ecs:DeleteNetworkInterface",
                "ecs:DeleteNetworkInterfacePermission",
                "ecs:AttachNetworkInterface",
                "ecs:DetachNetworkInterface",
                "ecs:DescribeNetworkInterfaceAttribute",
                "ecs:DescribeNetworkInterfaces",
                "ecs:ModifyNetworkInterfaceAttribute",
                "ecs:CreateNetworkInterfacePermission",
                "ecs:DescribeNetworkInterfacePermissions",
                "ecs:CreateSecurityGroup",
                "ecs:DeleteSecurityGroup",
                "ecs:DescribeSecurityGroupAttribute",
                "ecs:DescribeSecurityGroups",
                "ecs:ModifySecurityGroupAttribute",
                "ecs:AuthorizeSecurityGroup",
                "ecs:AuthorizeSecurityGroupEgress",
                "ecs:RevokeSecurityGroup",
                "ecs:RevokeSecurityGroupEgress",
                "vpc:DescribeVSwitches",
                "vpc:DescribeVpcs",
                "vpc:AssociateEipAddress",
                "vpc:UnassociateEipAddress",
                "vpc:DescribeEipAddresses",
                "vpc:AllocateEipAddress",
                "vpc:ReleaseEipAddress",
                "vpc:AllocateEipAddressPro",
                "vpc:AddCommonBandwidthPackageIp",
                "vpc:RemoveCommonBandwidthPackageIp",
                "vpc:TagResources",
                "dms:AddInstance",
                "dms:ListInstances",
                "dms:GetInstance",
                "cs:DescribeClusterDetail",
                "cs:DescribeClusterUserKubeconfig"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "kms:List*",
                "kms:DescribeKey",
                "kms:TagResource",
                "kms:UntagResource",
                "kms:DescribeAccountKmsStatus"
            ],
            "Resource": [
                "acs:kms:*:*:*"
            ],
            "Effect": "Allow"
        },
        {
            "Effect": "Allow",
            "Action": [
                "cms:GetCmsService",
                "cms:OpenCmsService",
                "cms:ListPrometheusVirtualInstances",
                "cms:CreatePrometheusVirtualInstance",
                "cms:ListPrometheusDashboards"
            ],
            "Resource": "*"
        },
        {
            "Action": [
                "arms:OpenArmsService"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "log:EnableService"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "kms:Encrypt",
                "kms:Decrypt",
                "kms:GenerateDataKey"
            ],
            "Resource": [
                "acs:kms:*:*:*"
            ],
            "Effect": "Allow",
            "Condition": {
                "StringEqualsIgnoreCase": {
                    "kms:tag/acs:rds:instance-encryption": "true"
                }
            }
        },
        {
            "Action": "ram:DeleteServiceLinkedRole",
            "Resource": "*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": "polardb.aliyuncs.com"
                }
            }
        },
        {
            "Action": "ram:CreateServiceLinkedRole",
            "Resource": "*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": "privatelink.aliyuncs.com"
                }
            }
        }
    ]
}

相关文档

• 权限策略基本元素

• 服务关联角色