Home PageResource Access ManagementDeveloper ReferenceSystem Policy ReferenceAliyunServiceRolePolicyForAegis
Search for Help Content

AliyunServiceRolePolicyForAegis

Updated at: 2025-04-01 10:01
Product
Community

AliyunServiceRolePolicyForAegis is the authorization policy dedicated to a service-linked role. The policy is automatically attached to a service role when the service role is created. Then, the service-linked role is authorized to access other cloud services. This policy is updated by the relevant Alibaba Cloud service. Do not attach this policy to a RAM identity other than a service-linked role.

Policy details

  • Type: service system policy

  • Creation time: 13:48:10 on January 31, 2024

  • Update time: 10:00:35 on April 01, 2025

  • Current version: v7

Policy content

{
  "Version": "1",
  "Statement": [
    {
      "Action": [
        "cr:GetRepository",
        "cr:GetInstanceEndpoint",
        "cr:GetAuthorizationToken",
        "cr:GetInstanceVpcEndpoint",
        "cr:GetRepoBuildList",
        "cr:ListRepository",
        "cr:ListRepositoryTag",
        "cr:ListRepoTag",
        "cr:ListInstanceEndpoint",
        "cr:GetRegionList",
        "cr:PullRepository",
        "cr:ListArtifactBuildTaskLog",
        "cr:GetRepositoryTag",
        "cr:GetImageScan",
        "cr:ListInstance"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "cs:UpdateKritisAttestationAuthority",
        "cs:GetKritisAttestationAuthority",
        "cs:InstallKritisAttestationAuthority",
        "cs:DeleteKritisAttestationAuthority",
        "cs:UpdateKritisGenericAttestationPolicy",
        "cs:InstallKritisGenericAttestationPolicy",
        "cs:DeleteKritisGenericAttestationPolicy",
        "cs:InstallKritis",
        "cs:DescribeClusterNamespaces",
        "cs:DescribeClusters",
        "cs:CheckKritisInstall",
        "cs:GetClusterAuditProject",
        "cs:GetClusterAudit",
        "cs:GetClusters",
        "cs:GetUserClusterResource",
        "cs:QueryUserClusterResource",
        "cs:GetUserInstanceResource",
        "cs:DescribeClusterNodes",
        "cs:DescribeClusterInnerServiceKubeconfig",
        "cs:RevokeClusterInnerServiceKubeconfig",
        "cs:DescribePolicies",
        "cs:DescribePoliceDetails",
        "cs:DescribePolicyGovernanceInCluster",
        "cs:DescribePolicyInstances",
        "cs:DescribePolicyInstancesStatus",
        "cs:DeployPolicyInstance",
        "cs:DeletePolicyInstance",
        "cs:ModifyPolicyInstance",
        "cs:DescribeClusterDetail",
        "cs:DescribeClustersV1",
        "cs:DescribeClusterAddonsVersion",
        "cs:DescribeUserPermission",
        "cs:InstallClusterAddons",
        "cs:UnInstallClusterAddons",
        "cs:DescribeClusterAddonMetadata",
        "cs:ModifyClusterAddon",
        "cs:UpgradeK8sComponents",
        "cs:PauseComponentUpgrade",
        "cs:ResumeComponentUpgrade",
        "cs:CancelComponentUpgrade",
        "cs:DescribeAddons",
        "cs:DescribeClusterAddonsUpgradeStatus",
        "cs:Queryk8sComponentsUpdateVersion",
        "cs:UpgradeClusterAddons"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "ecs:CreateCommand",
        "ecs:InstallCloudAssistant",
        "ecs:InvokeCommand",
        "ecs:StopInvocation",
        "ecs:DeleteCommand",
        "ecs:DescribeCloudAssistantStatus",
        "ecs:DescribeCommands",
        "ecs:DescribeInvocations",
        "ecs:DescribeInvocationResults",
        "ecs:ModifyCommand",
        "ecs:DescribeInstances",
        "ecs:DescribeDisks",
        "ecs:DescribeSnapshots",
        "ecs:CreateSnapshot",
        "ecs:DescribeInstanceAttribute",
        "ecs:CreateSecurityGroup",
        "ecs:AuthorizeSecurityGroup",
        "ecs:RevokeSecurityGroup",
        "ecs:DescribeSecurityGroupAttribute",
        "ecs:DescribeSecurityGroups",
        "ecs:JoinSecurityGroup",
        "ecs:AuthorizeSecurityGroupEgress",
        "ecs:LeaveSecurityGroup",
        "ecs:RevokeSecurityGroupEgress",
        "ecs:CreateNetworkInterface",
        "ecs:DeleteNetworkInterface",
        "ecs:DescribeNetworkInterfaces",
        "ecs:CreateNetworkInterfacePermission",
        "ecs:DescribeNetworkInterfacePermissions",
        "ecs:DeleteNetworkInterfacePermission",
        "ecs:DescribeSecurityGroupReferences",
        "ecs:DetachNetworkInterface",
        "ecs:AttachNetworkInterface",
        "ecs:ModifySecurityGroupAttribute",
        "ecs:ModifySecurityGroupPolicy",
        "ecs:ModifySecurityGroupRule",
        "ecs:CreateActivation",
        "ecs:DescribeResourceByTags",
        "ecs:CreateImage",
        "ecs:DescribeImages",
        "ecs:CopyImage",
        "ecs:ModifyImageSharePermission",
        "ecs:DeleteImage",
        "ecs:DeleteSnapshot",
        "ecs:DescribeAutoSnapshotPolicyEx",
        "ecs:DescribeZones"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "log:PostLogStoreLogs",
        "log:GetProject",
        "log:ListProject",
        "log:GetLogStore",
        "log:ListLogStores",
        "log:CreateLogStore",
        "log:CreateProject",
        "log:GetIndex",
        "log:CreateIndex",
        "log:UpdateIndex",
        "log:CreateDashboard",
        "log:ClearLogStoreStorage",
        "log:UpdateLogStore",
        "log:UpdateDashboard",
        "log:CreateSavedSearch",
        "log:UpdateSavedSearch",
        "log:DeleteLogStore",
        "log:DeleteSavedSearch",
        "log:GetSavedSearch",
        "log:ListSavedSearch",
        "log:DeleteDashboard",
        "log:GetDashboard",
        "log:ListDashboard",
        "log:DeleteProject",
        "log:ListShards",
        "log:GetCursorOrData",
        "log:GetConsumerGroupCheckPoint",
        "log:UpdateConsumerGroup",
        "log:ConsumerGroupHeartBeat",
        "log:ConsumerGroupUpdateCheckPoint",
        "log:ListConsumerGroup",
        "log:CreateConsumerGroup",
        "log:GetSlsService"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "oss:ListBuckets",
        "oss:GetBucketAcl",
        "oss:GetBucketLogging",
        "oss:GetBucketReplication",
        "oss:GetBucketEncryption",
        "oss:GetBucketReferer",
        "oss:GetBucketPolicy",
        "oss:GetBucketVersioning",
        "oss:PutBucketAcl",
        "oss:ListBucketInventory",
        "oss:GetBucketInventory",
        "oss:GetObject",
        "oss:GetObjectMetadata",
        "oss:GetBucketStat",
        "oss:ListBuckets",
        "oss:ListObjects",
        "oss:GetBucketInfo"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "slb:DescribeLoadBalancers",
        "slb:DescribeListenerAccessControlAttribute",
        "slb:DescribeLoadBalancerAttribute",
        "slb:DescribeLoadBalancerHTTPListenerAttribute",
        "slb:DescribeLoadBalancerHTTPSListenerAttribute",
        "slb:DescribeLoadBalancerTCPListenerAttribute",
        "slb:DescribeLoadBalancerUDPListenerAttribute",
        "slb:DescribeAccessControlListAttribute",
        "slb:DescribeHealthStatus",
        "slb:DescribeCACertificates",
        "slb:DescribeServerCertificates",
        "slb:DescribeAccessLogsDownloadAttribute",
        "slb:DescribeVServerGroups",
        "slb:DescribeVServerGroupAttribute",
        "slb:DescribeMasterSlaveServerGroupAttribute",
        "alb:ListLoadBalancers",
        "alb:GetLoadBalancerAttribute",
        "alb:ListListeners",
        "alb:ListAclEntries",
        "alb:GetListenerHealthStatus",
        "alb:GetListenerAttribute",
        "alb:ListServerGroupServers",
        "alb:ListListenerCertificates",
        "nlb:GetLoadBalancerAttribute",
        "nlb:ListListeners",
        "nlb:ListServerGroupServers"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "vpc:DescribeNatGateways",
        "vpc:DescribeForwardTableEntries",
        "vpc:DescribeVpnGateways",
        "vpc:DescribeVpcAttribute",
        "vpc:DescribeVSwitchAttributes",
        "vpc:DescribeRegions",
        "vpc:DescribeVpcs",
        "vpc:DescribeVSwitches",
        "vpc:DescribeNetworkAcls",
        "vpc:DescribeEipAddresses"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": "ram:DeleteServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "sas.aliyuncs.com"
        }
      }
    },
    {
      "Action": "ram:DeleteServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "aegis.aliyuncs.com"
        }
      }
    },
    {
      "Action": [
        "bms:ListInstance",
        "bms:ListBmcpInstance",
        "bms:ListManageableInstance",
        "bms:ListASCMHistoryEvent",
        "bms:DescribeLicenseInfo",
        "bms:DescribeServiceStatus"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "kms:DescribeKeyVersion",
        "kms:GetPublicKey",
        "kms:DescribeAccountKmsStatus",
        "kms:Decrypt",
        "kms:ListKeys",
        "kms:ListAliases",
        "kms:ListAliasesByKeyId",
        "kms:DescribeKey",
        "kms:DescribeService",
        "kms:ListResourceTags",
        "kms:ListKeyVersions"
      ],
      "Resource": "*",
      "Effect": "Allow"
    }
  ]
}

References

Previous: AliyunServiceRolePolicyForAccessOSSNext: AliyunServiceRolePolicyForAlbFc
  • On this page （1）
  • Policy details
  • Policy content
  • References
Feedback
phone Contact Us

Chat now with Alibaba Cloud Customer Service to assist you in finding the right products and services to meet your needs.

alicare alicarealicarealicare