AliyunCloudMonitorFullAccess is a service system policy that is managed by Alibaba Cloud. You can attach the AliyunCloudMonitorFullAccess policy to a Resource Access Management (RAM) identity, such as a RAM user, RAM user group, and RAM role. The AliyunCloudMonitorFullAccess policy: Provides full access to Cloud Monitor via Management Console.
Policy details
Type: service system policy
Creation time: 02:50:27 on January 27, 2016
Update time: 01:58:24 on January 30, 2026
Current version: v20
Policy content
{
"Version": "1",
"Statement": [
{
"Action": "cms:*",
"Resource": "*",
"Effect": "Allow"
},
{
"Action": "arms:*",
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"ecs:DescribeInstances",
"rds:DescribeDBInstances",
"slb:DescribeLoadBalancer*",
"vpc:DescribeEipAddresses",
"vpc:DescribeRouterInterfaces",
"vpc:DescribeGlobalAccelerationInstances",
"vpc:DescribeVpnGateways",
"vpc:DescribeNatGateways",
"vpc:DescribeBandwidthPackages",
"vpc:DescribeCommonBandwidthPackages",
"oss:ListBuckets",
"log:ListProject",
"log:EnableService",
"log:GetMLServiceResults",
"cdn:DescribeUserDomains",
"mns:ListQueue",
"mns:ListTopic",
"ess:DescribeScalingGroups",
"ocs:DescribeInstances",
"kvstore:DescribeInstances",
"kvstore:DescribeLogicInstanceTopology",
"hbase:DescribeClusterList",
"hitsdb:DescribeHiTSDBInstanceList",
"dds:DescribeDBInstances",
"petadata:DescribeInstances",
"petadata:DescribeDatabases",
"gpdb:DescribeDBInstances",
"emr:ListClusters",
"opensearch:ListApps",
"elasticsearch:ListInstance",
"mongodb:DescribeDBInstances",
"rds:DescribeReplicas",
"CloudAPI:DescribeApis",
"netgateway:DescribeNatGateways",
"ddos:DescribeInstancePage",
"live:DescribeLiveUserDomains",
"cen:DescribeCens",
"cen:DescribeCenAttachedChildInstances",
"kafka:GetKafkaInstanceList",
"scdn:DescribeScdnUserDomains",
"dcdn:DescribeDcdnUserDomains",
"polardb:DescribeDBInstances",
"polardb:DescribeRegions",
"polardb:DescribeDBClusters",
"cs:DescribeClusters",
"resourcemanager:GetAccount",
"resourcemanager:ListAccountsForParent",
"resourcemanager:ListAccounts",
"resourcemanager:GetFolder",
"resourcemanager:ListFoldersForParent",
"resourcemanager:ListAncestors",
"resourcemanager:GetResourceDirectory",
"tag:ListTagKeys",
"tag:ListTagValues"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"quotas:ListProductQuotas",
"quotas:GetProductQuota",
"quotas:ListProducts",
"quotas:ListProductQuotaDimensions",
"quotas:ListProductDimensionGroups"
],
"Resource": "acs:quotas:*:*:*",
"Effect": "Allow"
},
{
"Action": "ram:CreateServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": [
"cloudmonitor.aliyuncs.com",
"audit.log.aliyuncs.com"
]
}
}
},
{
"Action": [
"log:GetLogStoreLogs",
"log:GetLogStoreHistogram",
"log:QueryPrometheusMetrics",
"log:PostLogStoreLogs",
"log:RemoteWritePrometheus"
],
"Resource": [
"acs:log:*:*:project/*/logstore/aliyun-prom-*",
"acs:log:*:*:project/*/storeview/aliyun_prom_*",
"acs:log:*:*:project/proj-xtrace-*/logstore/*"
],
"Effect": "Allow"
},
{
"Action": [
"log:PostLogStoreLogs",
"log:RemoteWritePrometheus"
],
"Resource": [
"acs:log:*:*:project/prom-*/logstore/*-gateway"
],
"Effect": "Allow"
}
]
}