长期任务权限配置-全域智能运维平台 STAROps(STAROps)-阿里云帮助中心

本文介绍 STAROps 长期任务的权限配置方法。

RAM 用户负责创建和管理长期任务，自定义数字员工负责异步执行任务；任务执行时能访问什么数据、能执行什么动作，取决于数字员工绑定的 RAM Role。

适用对象

本文适用于需要为 RAM 用户配置长期任务权限的管理员。阿里云主账号默认具备长期任务管理权限，无需额外配置。

权限模型

长期任务用于周期性巡检、告警分析、报告生成等异步场景。用户负责创建和管理长期任务，数字员工负责执行长期任务。

长期任务不支持系统内置员工，只支持自定义数字员工。原因是长期任务会在用户离开当前会话后继续运行，异步执行必须有稳定运行主体；这个主体就是自定义数字员工绑定的 RAM Role。

配置长期任务时，只需要关注三件事：

RAM 用户是否具备长期任务、会话和产物的操作权限。
RAM 用户是否具备所选数字员工 RAM Role 的 ram:PassRole 权限。
数字员工绑定的 RAM Role 是否具备任务执行所需的数据访问或资源操作权限。

长期任务本身不会扩大数字员工权限。任务能访问什么数据、能执行什么动作，仍取决于所选数字员工绑定的 RAM Role。

RAM Policy 示例

以下策略可直接复制到 RAM 自定义权限策略中。示例沿用线上帮助文档配置，便于复制使用；生产环境建议按任务、自定义数字员工、会话和产物范围收敛。若策略中包含 ram:PassRole 且 Resource 为 *，建议替换为长期任务所使用数字员工的服务角色或自定义角色 RoleArn。

完整管理权限

授予 RAM 用户长期任务的完整管理权限，包括创建、查看、修改、删除长期任务，以及查看事项和产物。

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "starops:CreateDigitalEmployee",
        "starops:GetDigitalEmployee",
        "starops:ListDigitalEmployees",
        "starops:UpdateDigitalEmployee",
        "starops:DeleteDigitalEmployee"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:CreateArtifactUploadToken",
        "starops:GetArtifactDownloadUrl",
        "starops:CreateChat",
        "starops:CreateThread",
        "starops:GetThread",
        "starops:GetThreadData",
        "starops:ListThreads",
        "starops:UpdateThread",
        "starops:DeleteThread"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*",
        "acs:starops:*:*:digitalemployee/*/thread/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:CreateDigitalEmployeeSkill",
        "starops:GetDigitalEmployeeSkill",
        "starops:ListDigitalEmployeeSkills",
        "starops:UpdateDigitalEmployeeSkill",
        "starops:DeleteDigitalEmployeeSkill",
        "starops:ListDigitalEmployeeSkillVersions"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*/skill/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:CreateMission",
        "starops:GetMission",
        "starops:ListMissions",
        "starops:ListTasks",
        "starops:UpdateMission",
        "starops:DeleteMission"
      ],
      "Resource": [
        "acs:starops:*:*:mission/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:CreateMcpService",
        "starops:GetMcpService",
        "starops:ListMcpServices",
        "starops:UpdateMcpService",
        "starops:DeleteMcpService",
        "starops:FetchRemoteMcpTools"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*/mcpservice/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetArtifact",
        "starops:ListArtifacts"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*/artifact/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetCreditQuota",
        "starops:SetCreditQuota"
      ],
      "Resource": [
        "acs:starops:*:*:quota/credit"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:CreateDigitalEmployee",
        "cms:GetDigitalEmployee",
        "cms:ListDigitalEmployees",
        "cms:UpdateDigitalEmployee",
        "cms:DeleteDigitalEmployee"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:CreateChat",
        "cms:CreateThread",
        "cms:GetThread",
        "cms:GetThreadData",
        "cms:ListThreads",
        "cms:UpdateThread",
        "cms:DeleteThread"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*",
        "acs:cms:*:*:digitalemployee/*/thread/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:CreateDigitalEmployeeSkill",
        "cms:GetDigitalEmployeeSkill",
        "cms:ListDigitalEmployeeSkills",
        "cms:UpdateDigitalEmployeeSkill",
        "cms:DeleteDigitalEmployeeSkill",
        "cms:ListDigitalEmployeeSkillVersions"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*/skill/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:CreateMission",
        "cms:GetMission",
        "cms:ListMissions",
        "cms:ListTasks",
        "cms:UpdateMission",
        "cms:DeleteMission"
      ],
      "Resource": [
        "acs:cms:*:*:mission/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:CreateMcpService",
        "cms:GetMcpService",
        "cms:ListMcpServices",
        "cms:UpdateMcpService",
        "cms:DeleteMcpService",
        "cms:FetchRemoteMcpTools"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*/mcpservice/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetArtifact",
        "cms:ListArtifacts"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*/artifact/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:ListWorkspaces",
        "cms:GetWorkspace",
        "cms:GetEntityStore",
        "cms:GetEntityStoreData"
      ],
      "Resource": [
        "acs:cms:*:*:workspace/*",
        "acs:cms:*:*:entitystore/*",
        "acs:cms:*:*:entitystoredata/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetCloudResourceData"
      ],
      "Resource": [
        "acs:cms:*:*:cloudresource"
      ]
    },
    {
      "Action": [
        "log:Get*",
        "log:List*",
        "log:Query*"
      ],
      "Resource": "acs:log:*:*:*",
      "Effect": "Allow"
    },
    {
      "Effect": "Allow",
      "Action": "ram:PassRole",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "acs:Service": "operation-platform.aliyuncs.com"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": "ram:PassRole",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "acs:Service": "cloudmonitor.aliyuncs.com"
        }
      }
    }
  ]
}

只读权限

授予 RAM 用户长期任务的只读权限，仅允许查看任务列表、详情、事项和产物，不允许创建、修改或删除长期任务。

线上只读模板中包含会话和 ram:PassRole 配置。如果用户只做审计查看，不需要发起会话或传递角色，可以删除 CreateChat、CreateThread 和 ram:PassRole 相关语句。

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetDigitalEmployee",
        "starops:ListDigitalEmployees"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:CreateArtifactUploadToken",
        "starops:GetArtifactDownloadUrl",
        "starops:CreateChat",
        "starops:CreateThread",
        "starops:GetThread",
        "starops:GetThreadData",
        "starops:ListThreads"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*",
        "acs:starops:*:*:digitalemployee/*/thread/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetDigitalEmployeeSkill",
        "starops:ListDigitalEmployeeSkills",
        "starops:ListDigitalEmployeeSkillVersions"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*/skill/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetMission",
        "starops:ListMissions",
        "starops:ListTasks"
      ],
      "Resource": [
        "acs:starops:*:*:mission/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetMcpService",
        "starops:ListMcpServices",
        "starops:FetchRemoteMcpTools"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*/mcpservice/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetArtifact",
        "starops:ListArtifacts"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*/artifact/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetCreditQuota"
      ],
      "Resource": [
        "acs:starops:*:*:quota/credit"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetDigitalEmployee",
        "cms:ListDigitalEmployees"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:CreateChat",
        "cms:CreateThread",
        "cms:GetThread",
        "cms:GetThreadData",
        "cms:ListThreads"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*",
        "acs:cms:*:*:digitalemployee/*/thread/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetDigitalEmployeeSkill",
        "cms:ListDigitalEmployeeSkills",
        "cms:ListDigitalEmployeeSkillVersions"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*/skill/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetMission",
        "cms:ListMissions",
        "cms:ListTasks"
      ],
      "Resource": [
        "acs:cms:*:*:mission/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetMcpService",
        "cms:ListMcpServices",
        "cms:FetchRemoteMcpTools"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*/mcpservice/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetArtifact",
        "cms:ListArtifacts"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*/artifact/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:ListWorkspaces",
        "cms:GetWorkspace",
        "cms:GetEntityStore",
        "cms:GetEntityStoreData"
      ],
      "Resource": [
        "acs:cms:*:*:workspace/*",
        "acs:cms:*:*:entitystore/*",
        "acs:cms:*:*:entitystoredata/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetCloudResourceData"
      ],
      "Resource": [
        "acs:cms:*:*:cloudresource"
      ]
    },
    {
      "Action": [
        "log:Get*",
        "log:List*",
        "log:Query*"
      ],
      "Resource": "acs:log:*:*:*",
      "Effect": "Allow"
    },
    {
      "Effect": "Allow",
      "Action": "ram:PassRole",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "acs:Service": "operation-platform.aliyuncs.com"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": "ram:PassRole",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "acs:Service": "cloudmonitor.aliyuncs.com"
        }
      }
    }
  ]
}

数字员工 + 长期任务组合权限

授予 RAM 用户数字员工和长期任务的完整操作权限。适用于需要同时管理自定义数字员工和长期任务的运维管理员。

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "starops:CreateDigitalEmployee",
        "starops:GetDigitalEmployee",
        "starops:ListDigitalEmployees",
        "starops:UpdateDigitalEmployee",
        "starops:DeleteDigitalEmployee"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:CreateArtifactUploadToken",
        "starops:GetArtifactDownloadUrl",
        "starops:CreateChat",
        "starops:CreateThread",
        "starops:GetThread",
        "starops:GetThreadData",
        "starops:ListThreads",
        "starops:UpdateThread",
        "starops:DeleteThread"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*",
        "acs:starops:*:*:digitalemployee/*/thread/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:CreateDigitalEmployeeSkill",
        "starops:GetDigitalEmployeeSkill",
        "starops:ListDigitalEmployeeSkills",
        "starops:UpdateDigitalEmployeeSkill",
        "starops:DeleteDigitalEmployeeSkill",
        "starops:ListDigitalEmployeeSkillVersions"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*/skill/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:CreateMission",
        "starops:GetMission",
        "starops:ListMissions",
        "starops:ListTasks",
        "starops:UpdateMission",
        "starops:DeleteMission"
      ],
      "Resource": [
        "acs:starops:*:*:mission/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:CreateMcpService",
        "starops:GetMcpService",
        "starops:ListMcpServices",
        "starops:UpdateMcpService",
        "starops:DeleteMcpService",
        "starops:FetchRemoteMcpTools"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*/mcpservice/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetArtifact",
        "starops:ListArtifacts"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*/artifact/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetCreditQuota",
        "starops:SetCreditQuota"
      ],
      "Resource": [
        "acs:starops:*:*:quota/credit"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:CreateDigitalEmployee",
        "cms:GetDigitalEmployee",
        "cms:ListDigitalEmployees",
        "cms:UpdateDigitalEmployee",
        "cms:DeleteDigitalEmployee"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:CreateChat",
        "cms:CreateThread",
        "cms:GetThread",
        "cms:GetThreadData",
        "cms:ListThreads",
        "cms:UpdateThread",
        "cms:DeleteThread"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*",
        "acs:cms:*:*:digitalemployee/*/thread/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:CreateDigitalEmployeeSkill",
        "cms:GetDigitalEmployeeSkill",
        "cms:ListDigitalEmployeeSkills",
        "cms:UpdateDigitalEmployeeSkill",
        "cms:DeleteDigitalEmployeeSkill",
        "cms:ListDigitalEmployeeSkillVersions"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*/skill/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:CreateMission",
        "cms:GetMission",
        "cms:ListMissions",
        "cms:ListTasks",
        "cms:UpdateMission",
        "cms:DeleteMission"
      ],
      "Resource": [
        "acs:cms:*:*:mission/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:CreateMcpService",
        "cms:GetMcpService",
        "cms:ListMcpServices",
        "cms:UpdateMcpService",
        "cms:DeleteMcpService",
        "cms:FetchRemoteMcpTools"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*/mcpservice/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetArtifact",
        "cms:ListArtifacts"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*/artifact/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:ListWorkspaces",
        "cms:GetWorkspace",
        "cms:GetEntityStore",
        "cms:GetEntityStoreData"
      ],
      "Resource": [
        "acs:cms:*:*:workspace/*",
        "acs:cms:*:*:entitystore/*",
        "acs:cms:*:*:entitystoredata/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetCloudResourceData"
      ],
      "Resource": [
        "acs:cms:*:*:cloudresource"
      ]
    },
    {
      "Action": [
        "log:Get*",
        "log:List*",
        "log:Query*"
      ],
      "Resource": "acs:log:*:*:*",
      "Effect": "Allow"
    },
    {
      "Effect": "Allow",
      "Action": "ram:PassRole",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "acs:Service": "operation-platform.aliyuncs.com"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": "ram:PassRole",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "acs:Service": "cloudmonitor.aliyuncs.com"
        }
      }
    }
  ]
}

权限验证

完成配置后，按以下顺序验证：

RAM 用户能否进入长期任务页面。
RAM 用户能否查看任务列表和任务详情。
RAM 用户能否创建一个测试长期任务。
RAM 用户能否选择目标自定义数字员工。
所选自定义数字员工是否已绑定 RAM Role。
创建或运行任务时是否出现 PassRole 相关错误。
任务是否能读取目标 Workspace、日志或云资源数据。
任务执行结束后，RAM 用户能否查看报告和产物。
如果需要人工核验，RAM 用户能否在对应控制台查看原始数据。

常见问题

能创建 Mission 但执行失败

Mission 创建权限只表示用户能创建长期任务。长期任务执行失败通常与自定义数字员工运行权限有关。请检查任务是否选择了自定义数字员工，以及该员工绑定的 RAM Role 是否具备目标数据和资源权限。

能看任务但看不到报告

请检查 RAM 用户是否具备报告和产物的 Get/List 权限。长期任务、会话和报告是不同 STAROps 资源，能看任务不等于能看报告。

任务能运行但查不到日志

请检查执行任务的自定义数字员工是否具备 SLS 查询权限。长期任务运行时使用自定义数字员工绑定的 RAM Role，该 RAM Role 必须具备对应日志权限。

为什么不能选择系统内置员工创建长期任务

系统内置员工没有客户侧可配置的 RAM Role，只适合当前用户发起的同步会话。长期任务需要异步执行，异步执行必须有稳定运行主体，因此只能选择绑定 RAM Role 的自定义数字员工。

使用自定义数字员工创建任务时报 PassRole 错误

请检查 RAM 用户是否对该数字员工绑定的 RAM Role 具备 ram:PassRole。建议将 Resource 指定到目标 RoleArn，并通过 acs:Service 限定 STAROps 相关服务。

只读用户是否可以创建长期任务

不可以。只读用户只应具备 Mission Get/List、任务状态查看、报告查看等权限，不应授予 Mission Create/Update/Delete，也不应授予 ram:PassRole。