Home PageResource Access ManagementDeveloper ReferenceSystem Policy ReferenceAliyunServiceRolePolicyForFluss
Search for Help Content

AliyunServiceRolePolicyForFluss

Updated at: 2025-03-25 02:51
Product
Community

AliyunServiceRolePolicyForFluss is the authorization policy dedicated to a service-linked role. The policy is automatically attached to a service role when the service role is created. Then, the service-linked role is authorized to access other cloud services. This policy is updated by the relevant Alibaba Cloud service. Do not attach this policy to a RAM identity other than a service-linked role.

Policy details

  • Type: service system policy

  • Creation time: 10:50:28 on March 25, 2025

  • Update time: 10:50:28 on March 25, 2025

  • Current version: v1

Policy content

{
  "Version": "1",
  "Statement": [
    {
      "Action": [
        "ecs:AssociateEipAddress",
        "ecs:AttachNetworkInterface",
        "ecs:AuthorizeSecurityGroup",
        "ecs:AuthorizeSecurityGroupEgress",
        "ecs:CreateNetworkInterface",
        "ecs:CreateNetworkInterfacePermission",
        "ecs:CreateSecurityGroup",
        "ecs:DeleteNetworkInterface",
        "ecs:DeleteNetworkInterfacePermission",
        "ecs:DeleteSecurityGroup",
        "ecs:DescribeNetworkInterfacePermissions",
        "ecs:DescribeNetworkInterfaces",
        "ecs:DescribeSecurityGroupAttribute",
        "ecs:DescribeSecurityGroupReferences",
        "ecs:DescribeSecurityGroups",
        "ecs:DetachNetworkInterface",
        "ecs:JoinSecurityGroup",
        "ecs:LeaveSecurityGroup",
        "ecs:ModifyNetworkInterfaceAttribute",
        "ecs:ModifySecurityGroupAttribute",
        "ecs:ModifySecurityGroupPolicy",
        "ecs:ModifySecurityGroupPolicy",
        "ecs:ModifySecurityGroupRule",
        "ecs:RevokeSecurityGroup",
        "ecs:RevokeSecurityGroupEgress",
        "ecs:UnassociateEipAddress"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "arms:ListDashboards",
        "arms:CreateContact",
        "arms:DeleteContact",
        "arms:SearchContact",
        "arms:UpdateContact",
        "arms:CreateContactGroup",
        "arms:DeleteContactGroup",
        "arms:SearchContactGroup",
        "arms:UpdateContactGroup",
        "arms:SearchAlertRules",
        "arms:CreateAlertRules",
        "arms:UpdateAlertRules",
        "arms:DeleteAlertRules",
        "arms:StartAlertRule",
        "arms:StopAlertRule",
        "arms:SearchAlarmHistories",
        "arms:OpenArmsService",
        "arms:CreateWebhook",
        "arms:CreateWehook",
        "arms:UpdateWebhook",
        "arms:CreateDispatchRule",
        "arms:ListDispatchRule",
        "arms:DeleteDispatchRule",
        "arms:UpdateDispatchRule",
        "arms:DescribeDispatchRule",
        "arms:GetAlarmHistories",
        "arms:SendCustomIncidents",
        "arms:SaveAlert",
        "arms:DeleteAlert",
        "arms:GetAlert",
        "arms:CheckServiceStatus",
        "arms:InstallManagedPrometheus",
        "arms:UninstallManagedPrometheus",
        "arms:GetManagedPrometheusStatus"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "vpc:DescribeVpcAttribute",
        "vpc:DescribeVpcs",
        "vpc:DescribeVSwitchAttributes",
        "vpc:DescribeVSwitches",
        "vpc:DescribeRouteTableList",
        "vpc:DescribeRouteTables",
        "vpc:DescribeRouteEntryList",
        "vpc:DescribeRouterInterfaceAttribute",
        "vpc:DescribeRouterInterfaces",
        "vpc:DescribeVRouters",
        "vpc:ModifyBypassToaAttribute",
        "vpc:CreateVpc",
        "vpc:CreateVSwitch"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "tag:ListTagResources",
        "tag:ListTagKeys",
        "tag:ListTagValues"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "dlf:BatchCreatePartitions",
        "dlf:BatchCreateTables",
        "dlf:BatchDeletePartitions",
        "dlf:BatchDeleteTables",
        "dlf:BatchDeleteTableVersions",
        "dlf:BatchGetPartitions",
        "dlf:BatchGetTables",
        "dlf:BatchUpdatePartitions",
        "dlf:BatchUpdateTables",
        "dlf:CreateCatalog",
        "dlf:CreateDatabase",
        "dlf:CreateFunction",
        "dlf:CreatePartition",
        "dlf:CreateTable",
        "dlf:DeleteCatalog",
        "dlf:DeleteDatabase",
        "dlf:DeleteFunction",
        "dlf:DeletePartition",
        "dlf:DeleteTable",
        "dlf:GetAsyncTaskStatus",
        "dlf:DeleteTableVersion",
        "dlf:GetCatalog",
        "dlf:GetCatalogAccessInfo",
        "dlf:GetCatalogByInstanceId",
        "dlf:GetCatalogSettings",
        "dlf:GetDatabase",
        "dlf:GetFunction",
        "dlf:GetPartition",
        "dlf:GetTable",
        "dlf:GetTableVersion",
        "dlf:ListCatalogs",
        "dlf:ListDatabases",
        "dlf:ListFunctionNames",
        "dlf:ListFunctions",
        "dlf:ListPartitionNames",
        "dlf:ListPartitions",
        "dlf:ListPartitionsByExpr",
        "dlf:ListPartitionsByFilter",
        "dlf:ListTableNames",
        "dlf:ListTables",
        "dlf:ListTableVersions",
        "dlf:RenamePartition",
        "dlf:RenameTable",
        "dlf:Search",
        "dlf:SearchAcrossCatalog",
        "dlf:UpdateCatalog",
        "dlf:UpdateDatabase",
        "dlf:UpdateFunction",
        "dlf:UpdateTable",
        "dlf:BatchGetPartitionColumnStatistics",
        "dlf:DeletePartitionColumnStatistics",
        "dlf:DeleteTableColumnStatistics",
        "dlf:GetPartitionColumnStatistics",
        "dlf:GetTableColumnStatistics",
        "dlf:UpdateTableColumnStatistics",
        "dlf:UpdatePartitionColumnStatistics",
        "dlf:CreateLock",
        "dlf:UnLock",
        "dlf:AbortLock",
        "dlf:RefreshLock",
        "dlf:GetLock",
        "dlf:GetCatalogAccessInfo",
        "dlf:GetDataToken",
        "dlf:GetDataTokenByName",
        "dlf:GrantPermissions",
        "dlf:RevokePermissions",
        "dlf:BatchGrantPermissions",
        "dlf:BatchRevokePermissions",
        "dlf:UpdatePermissions",
        "dlf:ListPermissions",
        "dlf:CreateRole",
        "dlf:UpdateRole",
        "dlf:DeleteRole",
        "dlf:GetRole",
        "dlf:ListRoles",
        "dlf:GrantRolesToUser",
        "dlf:RevokeRolesFromUser",
        "dlf:GrantRoleToUsers",
        "dlf:RevokeRoleFromUsers",
        "dlf:UpdateRoleUsers",
        "dlf:ListRoleUsers",
        "dlf:ListUserRoles",
        "dlf:GrantRolesToPrincipal",
        "dlf:RevokeRolesFromPrincipal",
        "dlf:GrantRoleToPrincipals",
        "dlf:RevokeRoleFromPrincipals",
        "dlf:UpdateRolePrincipals",
        "dlf:BatchDeleteRoles",
        "dlf:CheckPermissions",
        "dlf:GetCatalogStorageStatistics",
        "dlf:GetCatalogStorageIndicatorDetails",
        "dlf:GetCatalogStorageRank",
        "dlf:GetCatalogStorageAnalysis",
        "dlf:GetDatabaseProfile",
        "dlf:GetDatabaseStorageAnalysis",
        "dlf:GetTableProfile",
        "dlf:GetTableStorageAnalysis",
        "dlf:ListPartitionProfiles",
        "dlf:getLatestStorageStatisticsDate",
        "dlf:SubscribeOptimize",
        "dlf:GetOptimizeRegionStatus",
        "dlf:GetOptimizeWorkspaceAuthorization",
        "dlf:AddOptimizeWorkspace",
        "dlf:ListOptimizeWorkspaces",
        "dlf:CheckOptimizeWorkspaceConnection",
        "dlf:DeleteOptimizeWorkspace",
        "dlf:SetOptimizeEnable",
        "dlf:SetOptimizePolicy",
        "dlf:GetOptimizePolicy",
        "dlf:AddOptimizeScheduleRule",
        "dlf:ListOptimizeScheduleRules",
        "dlf:DeleteOptimizeScheduleRule",
        "dlf:RunOptimizeImmediately",
        "dlf:GetOptimizeInfo",
        "dlf:UpdateOptimizeTaskResult"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "dlf-auth:ActOnBehalfOfAnotherUser"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Effect": "Allow",
      "Action": "dlf:GetServiceStatus",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "dlf:GetRegionStatus",
      "Resource": "*"
    },
    {
      "Action": "ram:DeleteServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "fluss.aliyuncs.com"
        }
      }
    }
  ]
}

References

Previous: AliyunServiceRolePolicyForElasticsearchOSSNext: AliyunServiceRolePolicyForFlink
  • On this page （1）
  • Policy details
  • Policy content
  • References
Feedback