AliyunServiceRolePolicyForXtrace-访问控制(RAM)-阿里云帮助中心

AliyunServiceRolePolicyForXtrace 是专用于服务关联角色的授权策略，会在创建服务关联角色 AliyunServiceRoleForXtrace 时自动授权，以允许服务关联角色代您访问其他云服务。本策略由对应的阿里云服务按需更新，请勿将本策略授权给服务关联角色之外的 RAM 身份使用。
策略详情

类型：系统策略
创建时间：2025-12-31 14:28:59
更新时间：2025-12-31 14:28:59
当前版本：v1
策略内容

{
  "Version": "1",
  "Statement": [
    {
      "Action": [
        "log:CreateProject",
        "log:GetProject",
        "log:GetLogStoreLogs",
        "log:ListProject",
        "log:GetHistograms",
        "log:GetLogStoreHistogram",
        "log:GetLogStore",
        "log:ListLogStores",
        "log:PostProjectQuery",
        "log:PutProjectQuery",
        "log:DeleteProjectQuery",
        "log:GetProjectQuery",
        "log:EnableService",
        "log:DescribeService",
        "log:CreateLogStore",
        "log:DeleteLogStore",
        "log:UpdateLogStore",
        "log:GetCursorOrData",
        "log:GetCursor",
        "log:PullLogs",
        "log:ListShards",
        "log:SplitShard",
        "log:PostLogStoreLogs",
        "log:BatchPostLogStoreLogs",
        "log:CreateConfig",
        "log:UpdateConfig",
        "log:DeleteConfig",
        "log:GetConfig",
        "log:ListConfig",
        "log:CreateMachineGroup",
        "log:UpdateMachineGroup",
        "log:UpdateSqlInstance",
        "log:CreateSqlInstance",
        "log:DeleteMachineGroup",
        "log:GetMachineGroup",
        "log:ListMachineGroup",
        "log:ListMachines",
        "log:ApplyConfigToGroup",
        "log:RemoveConfigFromGroup",
        "log:GetAppliedMachineGroups",
        "log:GetAppliedConfigs",
        "log:GetShipperStatus",
        "log:RetryShipperTask",
        "log:CreateConsumerGroup",
        "log:UpdateConsumerGroup",
        "log:DeleteConsumerGroup",
        "log:ListConsumerGroup",
        "log:UpdateCheckPoint",
        "log:HeartBeat",
        "log:GetCheckPoint",
        "log:CreateIndex",
        "log:DeleteIndex",
        "log:GetIndex",
        "log:UpdateIndex",
        "log:CreateSavedSearch",
        "log:UpdateSavedSearch",
        "log:GetSavedSearch",
        "log:DeleteSavedSearch",
        "log:ListSavedSearch",
        "log:CreateDashboard",
        "log:UpdateDashboard",
        "log:GetDashboard",
        "log:DeleteDashboard",
        "log:ListDashboard",
        "log:CreateJob",
        "log:UpdateJob",
        "log:GetJob",
        "log:DeleteJob",
        "log:ListJobs",
        "log:ConsumerGroupUpdateCheckPoint",
        "log:ConsumerGroupHeartBeat",
        "log:GetConsumerGroupCheckPoint",
        "log:GetSqlInstance",
        "log:ListDomains",
        "log:ListTagResources",
        "log:CreateFullstackObservabilityInstance",
        "log:ListFullStackObservabilityInstance",
        "log:GetStoreView",
        "log:CreateStoreView",
        "log:UpdateStoreView",
        "log:DeleteStoreView",
        "log:ListStoreViews",
        "log:GetStoreViewIndex",
        "log:GetSubStore",
        "log:UpdateSubStore",
        "log:GetSubStoreTTL",
        "log:GetMetricStore"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "arms:DescribeTraceLicenseKey"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "cs:ScaleCluster",
        "cs:GetClusterById",
        "cs:GetClusters",
        "cs:GetUserConfig",
        "cs:CheckKritisInstall",
        "cs:GetKritisAttestationAuthority",
        "cs:GetKritisGenericAttestationPolicy",
        "cs:AttachInstances",
        "cs:InstallKritis",
        "cs:InstallKritisAttestationAuthority",
        "cs:InstallKritisGenericAttestationPolicy",
        "cs:UpdateClusterTags",
        "cs:UninstallKritis",
        "cs:DeleteKritisAttestationAuthority",
        "cs:DeleteKritisGenericAttestationPolicy",
        "cs:UpdateKritisAttestationAuthority",
        "cs:UpdateKritisGenericAttestationPolicy",
        "cs:UpgradeCluster",
        "cs:GetClusterLogs"
      ],
      "Resource": [
        "acs:cs:*:*:cluster/*"
      ],
      "Effect": "Allow"
    },
    {
      "Action": [
        "ecs:DescribeInstanceAutoRenewAttribute",
        "ecs:DescribeInstances",
        "ecs:DescribeInstanceStatus",
        "ecs:DescribeInstanceVncUrl",
        "ecs:DescribeSpotPriceHistory",
        "ecs:DescribeUserdata",
        "ecs:DescribeInstanceRamRole",
        "ecs:DescribeDisks",
        "ecs:DescribeSnapshots",
        "ecs:DescribeAutoSnapshotPolicy",
        "ecs:DescribeSnapshotLinks",
        "ecs:DescribeImages",
        "ecs:DescribeImageSharePermission",
        "ecs:DescribeClassicLinkInstances",
        "ecs:AuthorizeSecurityGroup",
        "ecs:DescribeSecurityGroupAttribute",
        "ecs:DescribeSecurityGroups",
        "ecs:AuthorizeSecurityGroupEgress",
        "ecs:DescribeSecurityGroupReferences",
        "ecs:RevokeSecurityGroup",
        "ecs:DescribeNetworkInterfaces",
        "ecs:DescribeTags",
        "ecs:DescribeRegions",
        "ecs:DescribeZones",
        "ecs:DescribeInstanceMonitorData",
        "ecs:DescribeEipMonitorData",
        "ecs:DescribeDiskMonitorData",
        "ecs:DescribeInstanceTypes",
        "ecs:DescribeInstanceTypeFamilies",
        "ecs:DescribeTasks",
        "ecs:DescribeTaskAttribute",
        "ecs:DescribeInstanceAttribute",
        "ecs:InvokeCommand",
        "ecs:CreateCommand",
        "ecs:StopInvocation",
        "ecs:DeleteCommand",
        "ecs:DescribeCommands",
        "ecs:DescribeInvocations",
        "ecs:DescribeInvocationResults",
        "ecs:ModifyCommand",
        "ecs:InstallCloudAssistant"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "vpc:DescribeVpcs",
        "vpc:DescribeVSwitches",
        "vpc:DescribeEipAddresses",
        "vpc:DescribeRouterInterfaces",
        "vpc:DescribeGlobalAccelerationInstances",
        "vpc:DescribeVpnGateways",
        "vpc:DescribeNatGateways"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "slb:DescribeLoadBalancers",
        "slb:DescribeLoadBalancerAttribute",
        "slb:SetLoadbalancerListenerAttributeEx",
        "slb:DescribeLoadbalancerListenersEx",
        "slb:DescribeLoadbalancerListenersEx",
        "slb:SetAccessLogsDownloadAttribute",
        "slb:DeleteAccessLogsDownloadAttribute",
        "slb:DescribeAccessLogsDownloadAttribute"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "alikafka:GetInstanceList",
        "alikafka:ListInstance",
        "cms:QueryMetricLast",
        "cms:QueryMetricList",
        "cms:DescribeMetricLast",
        "cms:DescribeMetricList",
        "cms:DescribeMetricData",
        "cms:DescribeMetricMetaList",
        "cms:DescribeSystemEventAttribute",
        "dds:DescribeDBInstances",
        "drds:DescribeDrdsInstances",
        "drds:DescribeDrdsInstance",
        "drds:DescribeDrdsDbInstance",
        "drds:DescribeDrdsDbInstances",
        "drds:DescribeDrdsDBs",
        "drds:DescribeDrdsInstanceMonitor",
        "elasticsearch:ListInstance",
        "hbase:DescribeClusterList",
        "hbase:DescribeInstances",
        "hbase:DescribeInstance",
        "hitsdb:DescribeHiTSDBInstanceList",
        "hitsdb:DescribeHiTSDBInstance",
        "kvstore:DescribeInstances",
        "kvstore:DescribeLogicInstanceTopology",
        "mongodb:DescribeDBInstances",
        "mns:ListQueue",
        "mns:ListTopic",
        "netgateway:DescribeNatGateways",
        "ocs:DescribeInstances",
        "ons:OnsInstanceInServiceList",
        "opensearch:ListApps",
        "oss:ListBuckets",
        "rds:DescribeDBInstances",
        "rds:DescribeReplicas",
        "slb:DescribeLoadBalancers",
        "actiontrail:LookupEvents"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": "ram:DeleteServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "xtrace.aliyuncs.com"
        }
      }
    },
    {
      "Action": "ram:CreateServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": [
            "audit.log.aliyuncs.com",
            "fullobserverbility.log.aliyuncs.com",
            "xtrace.aliyuncs.com"
          ]
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "ram:PassRole"
      ],
      "Resource": "acs:ram::*:role/aliyunserviceroleforxtrace"
    }
  ]
}
策略详情

策略内容

相关文档
