AliyunServiceRolePolicyForRdcStandard 是专用于服务关联角色的授权策略，会在创建服务关联角色 AliyunServiceRoleForRdcStandard 时自动授权，以允许服务关联角色代您访问其他云服务。本策略由对应的阿里云服务按需更新，请勿将本策略授权给服务关联角色之外的 RAM 身份使用。
策略详情
类型：系统策略
创建时间：2025-06-24 10:06:27
更新时间：2026-07-17 21:27:18
当前版本：v23
策略内容
{
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": "cs:DescribeUserPermission",
"Resource": "*"
},
{
"Action": [
"edas:ChangeDeployGroup",
"edas:ListApplication",
"edas:ListComponents",
"edas:ListDeployGroup",
"edas:QueryApplicationStatus",
"edas:GetSecureToken",
"edas:DeployApplication",
"edas:InsertApplication",
"edas:ListHistoryDeployVersion",
"edas:ResetApplication",
"edas:RollbackApplication",
"edas:StartApplication",
"edas:GetK8sApplication",
"edas:UpdateContainer",
"edas:UpdateK8sApplicationConfig",
"edas:CreateNamespace",
"edas:ReadNamespace",
"edas:DeleteNamespace",
"edas:ManageNamespace",
"edas:CreateCluster",
"edas:ReadCluster",
"edas:ReadApplication",
"edas:ManageApplication",
"edas:ConfigApplication",
"edas:ListUserDefineRegion",
"edas:AbortChangeOrder",
"edas:GetApplication",
"edas:DeployK8sApplication",
"edas:GetChangeOrderInfo",
"edas:ContinuePipeline"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"fc:CreateService",
"fc:ListServices",
"fc:GetService",
"fc:UpdateService",
"fc:DeleteService",
"fc:CreateFunction",
"fc:ListFunctions",
"fc:GetFunction",
"fc:UpdateFunction",
"fc:DeleteFunction",
"fc:InvokeFunction",
"fc:CreateTrigger",
"fc:ListTriggers",
"fc:GetTrigger",
"fc:UpdateTrigger",
"fc:DeleteTrigger",
"fc:PublishServiceVersion",
"fc:ListServiceVersions",
"fc:DeleteServiceVersion",
"fc:CreateAlias",
"fc:GetAlias",
"fc:UpdateAlias",
"fc:ListAliases",
"fc:DeleteAlias",
"fc:PutProvisionConfig",
"fc:GetProvisionConfig",
"fc:ListProvisionConfigs",
"fc:DeleteProvisionConfig",
"fc:CreateCustomDomain",
"fc:GetCustomDomain",
"fc:UpdateCustomDomain",
"fc:ListCustomDomains",
"fc:DeleteCustomDomain",
"fc:PutFunctionOnDemandConfig",
"fc:GetFunctionOnDemandConfig",
"fc:ListFunctionOnDemandConfigs",
"fc:DeleteFunctionOnDemandConfig",
"fc:ListFunctionAsyncInvokeConfigs",
"fc:ListConcurrencyConfigs",
"fc:DeleteConcurrencyConfig",
"fc:PutConcurrencyConfig",
"fc:GetConcurrencyConfig",
"fc:ListInstances",
"fc:PublishFunctionVersion",
"fc:ListFunctionVersions",
"fc:DeleteFunctionVersion",
"fc:CreateVpcBinding",
"fc:ListVpcBindings",
"fc:DeleteVpcBinding",
"fc:DeleteFunctionAsyncInvokeConfig",
"fc:GetFunctionAsyncInvokeConfig",
"fc:GetFunctionCode",
"fc:PutFunctionAsyncInvokeConfig",
"fc:GetLayerVersionByArn",
"fc:ListLayers",
"fc:PutLayerACL",
"fc:ListLayerVersions",
"fc:CreateLayerVersion",
"fc:DeleteLayerVersion",
"fc:GetLayerVersion",
"fc:TagResources",
"fc:UntagResources",
"fc:ListTagResources"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"sae:DescribeApplicationConfig",
"sae:VirtualServerProxy",
"sae:DescribeRegions",
"sae:DescribeInstanceLog",
"sae:DescribeComponents",
"sae:DescribeEdasContainers",
"sae:DescribeApplicationImage",
"sae:DescribeApplicationInstances",
"sae:DescribeApplicationGroups",
"sae:ListApplications",
"sae:QueryResourceStatics",
"sae:ListLogConfigs",
"sae:DescribeApplicationStatus",
"sae:DescribeNamespaces",
"sae:DeployApplication",
"sae:CreateApplication",
"sae:DeleteApplication",
"sae:StopApplication",
"sae:RescaleApplicationVertically",
"sae:StartApplication",
"sae:ConfirmPipelineBatch",
"sae:ListChangeOrders",
"sae:AbortAndRollbackChangeOrder",
"sae:DescribeChangeOrder",
"sae:DescribeInstanceSpecifications",
"sae:RescaleApplication",
"sae:RestartApplication",
"sae:AbortChangeOrder",
"sae:UpdateJob",
"sae:DescribeJob",
"sae:ListJobs",
"sae:CreateCredential",
"sae:GetWebshellToken"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"pvtz:AddZone",
"pvtz:DeleteZone",
"pvtz:DescribeZones",
"pvtz:DescribeZoneInfo",
"pvtz:BindZoneVpc",
"pvtz:AddZoneRecord",
"pvtz:UpdateZoneRecord",
"pvtz:DeleteZoneRecord",
"pvtz:DescribeZoneRecords"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"pvtz:AddZone",
"pvtz:DeleteZone",
"pvtz:DescribeZones",
"pvtz:DescribeZoneInfo",
"pvtz:BindZoneVpc",
"pvtz:AddZoneRecord",
"pvtz:UpdateZoneRecord",
"pvtz:DeleteZoneRecord",
"pvtz:DescribeZoneRecords"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"privatelink:CheckProductOpen",
"privatelink:AttachSecurityGroupToVpcEndpoint",
"privatelink:DetachSecurityGroupFromVpcEndpoint",
"privatelink:AddZoneToVpcEndpoint",
"privatelink:OpenPrivateLinkService",
"privatelink:CreateVpcEndpoint",
"privatelink:GetVpcEndpointAttribute",
"privatelink:UpdateVpcEndpointAttribute",
"privatelink:DeleteVpcEndpoint",
"privatelink:ListVpcEndpoints",
"privatelink:ListVpcEndpointZones",
"privatelink:RemoveZoneFromVpcEndpoint",
"privatelink:ListVpcEndpointSecurityGroups",
"privatelink:EnableVpcEndpointConnection",
"privatelink:ListVpcEndpointConnections",
"privatelink:UpdateVpcEndpointConnectionAttribute",
"privatelink:DisableVpcEndpointConnection",
"privatelink:AddUserToVpcEndpointService",
"privatelink:ListVpcEndpointServiceUsers",
"privatelink:DescribeZones",
"privatelink:RemoveUserFromVpcEndpointService"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"vpc:DescribeVpcAttribute",
"vpc:DescribeVpcs",
"vpc:DescribeVSwitches",
"vpc:DescribeVSwitchAttributes",
"vpc:DescribeNatGateways",
"vpc:GetNatGatewayAttribute",
"vpc:DescribeNatGatewayAssociateNetworkInterfaces",
"vpc:VpcDescribeVpcNatGatewayNetworkInterfaceQuota",
"vpc:ListNatIps",
"vpc:CreateFullNatEntry",
"vpc:DeleteFullNatEntry",
"vpc:ModifyFullNatEntryAttribute",
"vpc:ListEnhanhcedNatGatewayAvailableZones",
"vpc:DescribeSnatTableEntries",
"vpc:ListFullNatEntries"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": "ecs:DescribeSecurityGroupAttribute",
"Resource": "*",
"Effect": "Allow"
},
{
"Action": "ram:DeleteServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": "standard.rdc.aliyuncs.com"
}
}
},
{
"Action": [
"oss:ListBuckets",
"oss:PutBucket",
"oss:GetBucketLocation",
"oss:ListObjects",
"oss:GetObject",
"oss:PutObject",
"oss:DeleteObject",
"oss:PutBucketAcl",
"oss:GetBucketAcl",
"oss:GetObjectAcl",
"oss:PutObjectAcl"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"oss:PutObject",
"oss:GetObject",
"oss:DeleteObject"
],
"Resource": [
"acs:oss:*:*:*/repositories/*",
"acs:oss:*:*:*/archive/*"
],
"Effect": "Allow"
},
{
"Action": "ram:CreateServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": "privatelink.aliyuncs.com"
}
}
},
{
"Action": [
"cs:GetClusterToken",
"cs:GetClusterEndpoints",
"cs:GetClusters",
"cs:GetClusterById",
"cs:GetClusterCerts",
"cs:GetClusterProjects",
"cs:DescribeClusterAddonsUpgradeStatus",
"cs:DescribeClusterAddonsVersion",
"cs:DescribeClusterUserKubeconfig",
"cs:InstallClusterAddons"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"cr:GetRepository",
"cr:ListRepositoryTag",
"cr:ListRepository",
"cr:PullRepository",
"cr:PushRepository",
"cr:ListNamespace",
"cr:GetAuthorizationToken",
"cr:CreateRepository",
"cr:CreateNamespace",
"cr:GetNamespace",
"cr:ListNamespace",
"cr:ListInstance"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"ecs:CreateNetworkInterface",
"ecs:DeleteNetworkInterface",
"ecs:DescribeNetworkInterfaces",
"ecs:CreateNetworkInterfacePermission",
"ecs:DescribeNetworkInterfacePermissions",
"ecs:AttachNetworkInterface",
"ecs:DetachNetworkInterface",
"ecs:CreateSecurityGroup",
"ecs:DeleteSecurityGroup",
"ecs:AuthorizeSecurityGroupEgress",
"ecs:ListTagResources",
"ecs:RunInstances",
"ecs:DescribeManagedInstances",
"ecs:StartInstance",
"ecs:AllocatePublicIpAddress",
"ecs:StopInstance",
"ecs:DeleteInstance",
"ecs:DescribeInstances",
"ecs:DescribeInstanceAttribute",
"ecs:ModifyInstanceAttribute",
"ecs:DescribeImages",
"ecs:DescribeSnapshots",
"ecs:DescribeKeyPairs",
"ecs:DescribeSecurityGroups",
"ecs:CreateCommand",
"ecs:RunCommand",
"ecs:InstallCloudAssistant",
"ecs:InvokeCommand",
"ecs:StopInvocation",
"ecs:DeleteCommand",
"ecs:DescribeCloudAssistantStatus",
"ecs:DescribeCommands",
"ecs:DescribeInvocations",
"ecs:DescribeInvocationResults",
"slb:DescribeLoadBalancerAttribute",
"slb:RemoveBackendServers",
"slb:DescribeHealthStatus",
"slb:AddBackendServers",
"slb:SetBackendServers",
"ess:DescribeScalingGroups",
"ess:DescribeLifecycleHooks",
"ess:DescribeScalingInstances",
"ess:ModifyLifecycleHook",
"ess:CreateLifecycleHook",
"ess:ResumeProcesses",
"ess:SuspendProcesses",
"ess:DescribeEciScalingConfigurations",
"ess:ModifyEciScalingConfiguration",
"eci:UpdateContainerGroup",
"eci:DescribeContainerGroups",
"ess:EnterStandby",
"ess:ExitStandBy",
"ecs:DescribeInstances",
"ecs:TagResources",
"ecs:DescribeInvocations",
"ecs:DescribeInvocationResults",
"ecs:RunCommand"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"bss:ModifyInstance"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"log:CreateProject",
"log:DeleteProject",
"log:GetProject",
"log:ListProject",
"log:UpdateProject",
"log:ListTagResources",
"log:TagResources",
"log:UntagResources",
"log:CreateLogStore",
"log:DeleteLogStore",
"log:GetLogStore",
"log:UpdateLogStore",
"log:ListLogStores",
"log:GetLogs",
"log:GetHistograms",
"log:GetContextLogs",
"log:GetLogStoreHistogram",
"log:GetLogStoreContextLogs",
"log:PostLogStoreLogs",
"log:ListShards",
"log:SplitShard",
"log:MergeShards",
"log:GetCursorOrData",
"log:CreateIndex",
"log:DeleteIndex",
"log:GetIndex",
"log:UpdateIndex",
"log:CreateDashboard",
"log:DeleteDashboard",
"log:GetDashboard",
"log:UpdateDashboard",
"log:ListDashboard"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Effect": "Allow",
"Action": "starops:CreateTicket",
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "log:RefreshToken",
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"starops:Get*",
"starops:List*"
],
"Resource": [
"acs:starops:*:*:digitalemployee/*",
"acs:starops:*:*:digitalemployee/*/thread/*",
"acs:starops:*:*:digitalemployee/*/skill/*",
"acs:starops:*:*:digitalemployee/*/mcpservice/*",
"acs:starops:*:*:digitalemployee/*/artifact/*",
"acs:starops:*:*:mission/*",
"acs:starops:*:*:skill/*"
]
},
{
"Effect": "Allow",
"Action": [
"cms:Get*",
"cms:List*"
],
"Resource": [
"acs:cms:*:*:digitalemployee/*",
"acs:cms:*:*:digitalemployee/*/thread/*",
"acs:cms:*:*:digitalemployee/*/skill/*",
"acs:cms:*:*:digitalemployee/*/mcpservice/*",
"acs:cms:*:*:digitalemployee/*/artifact/*",
"acs:cms:*:*:mission/*"
]
},
{
"Effect": "Allow",
"Action": [
"starops:CreateDigitalEmployee",
"starops:UpdateDigitalEmployee",
"starops:DeleteDigitalEmployee"
],
"Resource": "acs:starops:*:*:digitalemployee/*"
},
{
"Effect": "Allow",
"Action": [
"starops:CreateChat",
"starops:CreateThread",
"starops:UpdateThread",
"starops:DeleteThread"
],
"Resource": [
"acs:starops:*:*:digitalemployee/*",
"acs:starops:*:*:digitalemployee/*/thread/*"
]
},
{
"Effect": "Allow",
"Action": [
"starops:CreateDigitalEmployeeSkill",
"starops:UpdateDigitalEmployeeSkill",
"starops:DeleteDigitalEmployeeSkill"
],
"Resource": "acs:starops:*:*:digitalemployee/*/skill/*"
},
{
"Effect": "Allow",
"Action": [
"starops:CreateMission",
"starops:UpdateMission",
"starops:DeleteMission"
],
"Resource": "acs:starops:*:*:mission/*"
},
{
"Effect": "Allow",
"Action": [
"starops:CreateMcpService",
"starops:UpdateMcpService",
"starops:DeleteMcpService",
"starops:FetchRemoteMcpTools"
],
"Resource": "acs:starops:*:*:digitalemployee/*/mcpservice/*"
},
{
"Effect": "Allow",
"Action": "starops:CreateArtifactUploadToken",
"Resource": "acs:starops:*:*:digitalemployee/*/artifact/*"
},
{
"Effect": "Allow",
"Action": [
"starops:GetCreditQuota",
"starops:SetCreditQuota"
],
"Resource": "acs:starops:*:*:quota/credit"
},
{
"Effect": "Allow",
"Action": [
"starops:CreateSkill",
"starops:UpdateSkill",
"starops:DeleteSkill",
"starops:UpdateSkillDraft",
"starops:DeleteSkillDraft",
"starops:PublishSkill"
],
"Resource": "acs:starops:*:*:skill/*"
},
{
"Effect": "Allow",
"Action": [
"starops:MountDigitalEmployeeSkill",
"starops:UpdateDigitalEmployeeSkillMount",
"starops:DeleteDigitalEmployeeSkillMount"
],
"Resource": [
"acs:starops:*:*:digitalemployee/*",
"acs:starops:*:*:skill/*"
]
},
{
"Effect": "Allow",
"Action": [
"cms:CreateDigitalEmployee",
"cms:UpdateDigitalEmployee",
"cms:DeleteDigitalEmployee"
],
"Resource": "acs:cms:*:*:digitalemployee/*"
},
{
"Effect": "Allow",
"Action": [
"cms:CreateChat",
"cms:CreateThread",
"cms:UpdateThread",
"cms:DeleteThread"
],
"Resource": [
"acs:cms:*:*:digitalemployee/*",
"acs:cms:*:*:digitalemployee/*/thread/*"
]
},
{
"Effect": "Allow",
"Action": [
"cms:CreateDigitalEmployeeSkill",
"cms:UpdateDigitalEmployeeSkill",
"cms:DeleteDigitalEmployeeSkill"
],
"Resource": "acs:cms:*:*:digitalemployee/*/skill/*"
},
{
"Effect": "Allow",
"Action": [
"cms:CreateMission",
"cms:UpdateMission",
"cms:DeleteMission"
],
"Resource": "acs:cms:*:*:mission/*"
},
{
"Effect": "Allow",
"Action": [
"cms:CreateMcpService",
"cms:UpdateMcpService",
"cms:DeleteMcpService",
"cms:FetchRemoteMcpTools"
],
"Resource": "acs:cms:*:*:digitalemployee/*/mcpservice/*"
},
{
"Effect": "Allow",
"Action": "cms:CreateArtifactUploadToken",
"Resource": "acs:cms:*:*:digitalemployee/*/artifact/*"
},
{
"Action": "ram:CreateServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": "operation-platform.aliyuncs.com"
}
}
},
{
"Effect": "Allow",
"Action": "ram:PassRole",
"Resource": "*",
"Condition": {
"StringEquals": {
"acs:Service": "operation-platform.aliyuncs.com"
}
}
},
{
"Effect": "Allow",
"Action": "ram:PassRole",
"Resource": "*",
"Condition": {
"StringEquals": {
"acs:Service": "cloudmonitor.aliyuncs.com"
}
}
}
]
}
相关文档
该文章对您有帮助吗？