AliyunGovernanceReadOnlyAccess is a service system policy that is managed by Alibaba Cloud. You can attach the AliyunGovernanceReadOnlyAccess policy to a Resource Access Management (RAM) identity, such as a RAM user, RAM user group, and RAM role. The AliyunGovernanceReadOnlyAccess policy: Provides read-only access to Cloud Governance Center(Governance) via Management Console.
Policy details
Type: service system policy
Creation time: 09:30:13 on July 08, 2021
Update time: 03:37:51 on January 07, 2026
Current version: v12
Policy content
{
"Statement": [
{
"Effect": "Allow",
"Action": [
"governance:List*",
"governance:Get*",
"governance:CheckOnboardingGuide"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"resourcemanager:GetResourceDirectory",
"resourcemanager:ListResources",
"resourcemanager:ListFoldersForParent",
"resourcemanager:GetAccount",
"resourcemanager:GetPayerForAccount",
"resourcemanager:GetFolder",
"resourcemanager:ListAccountRecordsForParent",
"resourcemanager:ListChildrenForParent",
"resourcemanager:ListAccounts",
"resourcemanager:ListAccountsForParent",
"resourcemanager:ListAncestors",
"resourcemanager:ListDelegatedAdministrators"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"ram:GetAccountSummary",
"ram:ListSAMLProviders"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"config:DescribeDeliveryChannels",
"config:GetAggregateConfigRuleComplianceByPack",
"config:ListSupportedProducts",
"config:ListAggregateConfigRuleEvaluationResults",
"config:ListCompliancePackTemplates",
"config:GetManagedRule",
"config:GetConfigRule",
"config:ListAggregators",
"config:DescribeConfigurationRecorder",
"config:GetAggregateDiscoveredResource",
"config:ListAggregateResourceEvaluationResults",
"config:ListAggregateConfigDeliveryChannels",
"actiontrail:DescribeTrails",
"config:GetAggregateResourceComplianceByConfigRule"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"cloudsso:GetServiceStatus",
"cloudsso:ListDirectories",
"cloudsso:GetExternalSAMLIdentityProvider",
"cloudsso:GetDirectorySAMLServiceProviderInfo",
"cloudsso:GetMFAAuthenticationStatus"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"cen:ListTransitRouterAvailableResource"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "ram:ListPolicies",
"Resource": "acs:ram:*:system:policy/*"
},
{
"Effect": "Allow",
"Action": [
"ecs:DescribeImages",
"ecs:DescribeImageSharePermission",
"ecs:DescribeRegions"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "log:ListProject",
"Resource": "acs:log:*:*:project/*"
},
{
"Effect": "Allow",
"Action": [
"quotas:GetProductQuota"
],
"Resource": "*"
}
],
"Version": "1"
}