AliyunServiceRolePolicyForCMHPrivate is the authorization policy dedicated to a service-linked role. The policy is automatically attached to a service role when the service role is created. Then, the service-linked role is authorized to access other cloud services. This policy is updated by the relevant Alibaba Cloud service. Do not attach this policy to a RAM identity other than a service-linked role.
Policy details
Type: service system policy
Creation time: 11:52:37 on January 14, 2025
Update time: 08:59:18 on August 21, 2025
Current version: v4
Policy content
{
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"smc:DescribeSourceServers",
"smc:DescribeReplicationJobs",
"smc:CreateReplicationJob",
"smc:StartReplicationJob",
"smc:StopReplicationJob",
"smc:CreateCrossZoneMigrationJob",
"smc:CreateAccessToken",
"smc:DescribeTestRunReports",
"smc:CreateAccessToken",
"smc:ListAccessTokens",
"smc:CutOverReplicationJob",
"smc:ModifyReplicationJobAttribute",
"smc:DeleteSourceServer",
"smc:DeleteReplicationJob",
"smc:DescribeGlobalVariables",
"smc:DescribeReplicationJobDetails"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"dts:DescribeDtsJobs",
"dts:ConfigureDtsJob",
"dts:StartDtsJob",
"dts:CreateDtsInstance",
"dts:DescribeDatabases",
"dts:DescribePreCheckStatus",
"dts:DescribeDtsJobDetail",
"dts:ModifyDynamicConfig",
"dts:DescribeDynamicConfig",
"dts:SuspendDtsJob",
"dts:DeleteDtsJobs",
"dts:DescribeSubscriptionMeta",
"dts:WhiteIpList",
"dts:CountJobByCondition",
"dts:StopDtsJobs",
"dts:CreateCheckJob",
"dts:DescribeCheckJobStatus",
"dts:DescribeCheckJobDiffDetails",
"dts:DescribeCheckJobs",
"dts:DescribeDataCheckTableDiffDetails",
"dts:DescribeDataCheckTableDetails",
"dts:DescribeMigrationJobStatus",
"dts:DescribeMigrationJobDetail",
"dts:StopDtsJob",
"dts:DeleteDtsJob",
"dts:RunEndpointLinkTest"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"rds:CreateDBInstance",
"rds:DescribeDBInstanceAttribute",
"rds:MigrateToOtherZone",
"rds:DescribeAvailableClasses",
"rds:DescribeAvailableZones",
"rds:DescribeDatabases",
"rds:DescribeDBInstanceHAConfig",
"rds:DescribeDBInstanceNetInfo",
"rds:DescribeDBInstances",
"rds:CheckServiceLinkedRole",
"rds:DescribeDatabases",
"rds:DescribeDescribeRegions",
"rds:CheckInstanceExist",
"rds:DeleteDBInstance",
"rds:CreateAccount",
"rds:DescribeAccounts",
"rds:ModifySecurityIps",
"rds:DescribeDBInstanceIPArrayList",
"rds:CreateDatabase",
"rds:DeleteDatabase",
"rds:DescribeDBInstancePerformance"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"polardb:DescribeDBClusterAvailableResources",
"polardb:DescribeClassList",
"polardb:DescribeDatabases",
"polardb:DescribeDBClusters",
"polardb:DescribeDBClusterEndpoints",
"polardb:DescribeDBInstancePerformance",
"polardb:DeleteDatabase",
"polardb:CreateDBInstance",
"polardb:DeleteDBInstance",
"polardb:DescribeDBInstances",
"polardb:CreateAccount",
"polardb:DescribeAccounts",
"polardb:ModifySecurityIps",
"polardb:DescribeDBInstanceIPArrayList",
"polardb:DescribeDBInstanceAttribute",
"polardb:CreateDBCluster",
"polardb:DescribeDBClusters",
"polardb:CreateAccount",
"polardb:ModifySecurityIps"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"polardbx:DescribeDBInstances",
"polardbx:DescribeDBInstanceAttribute"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"cms:DescribeMetricList"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"oss:ListBuckets",
"oss:PutBucket",
"oss:ListObjects",
"oss:ListObjectsV2",
"oss:GetBucketInfo",
"oss:GetBucketLocation",
"oss:GetBucketStat",
"oss:PutBucketAcl",
"oss:GetBucketAcl",
"oss:PutBucketLifecycle",
"oss:GetBucketLifecycle",
"oss:DeleteBucketLifecycle",
"oss:PutBucketVersioning",
"oss:GetBucketVersioning",
"oss:PutBucketPolicy",
"oss:GetBucketPolicy",
"oss:DeleteBucketPolicy",
"oss:PutBucketEncryption",
"oss:GetBucketEncryption",
"oss:DeleteBucketEncryption"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"vpc:DescribeVpcs",
"vpc:DescribeZones",
"vpc:DescribeVSwitches",
"vpc:CheckCanAllocateVpcPrivateIpAddress",
"vpc:CreateVSwitch",
"vpc:CreateVpc",
"vpc:DescribeVpcAttribute",
"vpc:AssociateVpcCidrBlock",
"vpc:AllocateEipAddress",
"vpc:ReleaseEipAddress",
"vpc:AssociateEipAddress",
"vpc:UnassociateEipAddress",
"vpc:DescribeEipAddresses",
"ecs:DescribeInstanceAttribute",
"ecs:DescribeAvailableResource",
"ecs:CloneInstanceWithIncrementSnapshot",
"ecs:DescribeDisks",
"ecs:DescribeAvailableResource",
"ecs:StartInstance",
"ecs:DescribeVSwitches",
"ecs:RunInstances",
"ecs:DescribeSnapshots",
"ecs:CreateImage",
"ecs:DescribeInstances",
"ecs:DescribeImages",
"ecs:CreateSnapshot",
"ecs:DescribePrice",
"ecs:DescribeSecurityGroups",
"ecs:DescribeSecurityGroupAttribute",
"ecs:ModifyLaunchTemplateDefaultVersion",
"ecs:CreateLaunchTemplateVersion",
"ecs:DescribeInvocationResults",
"ecs:DescribeRegions",
"ecs:DeleteLaunchTemplateVersion",
"ecs:DescribeLaunchTemplateVersions",
"ecs:DescribeInvocations",
"ecs:CopyImage",
"ecs:DescribeLaunchTemplates",
"ecs:DescribeKeyPairs",
"ecs:DescribeDeploymentSets",
"ecs:DescribeInstanceCrossZoneModifyConstraint",
"ecs:DescribeResourcesModification",
"ecs:DescribeInstanceTypes",
"ecs:DescribePrice",
"ecs:DescribeCloudAssistantStatus",
"ecs:CreateSecurityGroup",
"ecs:AuthorizeSecurityGroup",
"ecs:AuthorizeSecurityGroupEgress",
"ecs:RevokeSecurityGroup",
"ecs:RevokeSecurityGroupEgress",
"ecs:DeleteSecurityGroup",
"ecs:JoinSecurityGroup",
"ecs:LeaveSecurityGroup",
"ecs:ModifySecurityGroupRule",
"ecs:ModifySecurityGroupEgressRule",
"ecs:RunCommand",
"ecs:DeleteInstance",
"ecs:ModifyInstanceAttribute",
"ecs:StopInstance",
"ecs:DeleteInstances",
"ecs:DescribeInstanceStatus"
],
"Resource": "*"
},
{
"Action": "ram:DeleteServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": "apds-private.apds.aliyuncs.com"
}
}
}
]
}