AliyunServiceRolePolicyForTag is the authorization policy dedicated to a service-linked role. The policy is automatically attached to a service role when the service role is created. Then, the service-linked role is authorized to access other cloud services. This policy is updated by the relevant Alibaba Cloud service. Do not attach this policy to a RAM identity other than a service-linked role.
Policy details
Type: service system policy
Creation time: 09:42:28 on March 06, 2020
Update time: 11:32:58 on August 11, 2025
Current version: v19
Policy content
{
"Version": "1",
"Statement": [
{
"Action": [
"actiontrail:CreateServiceTrail",
"actiontrail:DeleteServiceTrail",
"actiontrail:ListServiceTrail",
"oos:ListExecutions"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"*:TagResources",
"*:UntagResources",
"*:UnTagResources",
"dcdn:TagDcdnResources",
"dcdn:UntagDcdnResources",
"vpc:TagResourcesForExpressConnect",
"vpc:UntagResourcesForExpressConnect",
"vod:TagVodResources",
"vod:UnTagVodResources",
"live:TagLiveResources",
"live:UnTagLiveResources",
"ecs:AddTags",
"ecs:RemoveTags",
"slb:AddTags",
"slb:RemoveTags",
"rds:AddTagsToResource",
"rds:RemoveTagsFromResource",
"oss:PutBucketTagging",
"oss:DeleteBucketTags",
"elasticsearch:CreateTags",
"elasticsearch:RemoveTags"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"ecs:DescribeSnapshots",
"ecs:DescribeDisks",
"ecs:DescribeNetworkInterfaces",
"vpc:DescribeEipAddresses",
"mq:QueryInstanceBaseInfo"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"alikafka:ListGroup",
"alikafka:ListTopic"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"vpc:AssociateEipAddressBatch",
"vpc:DescribeNatGateways",
"nlb:UpdateLoadBalancerZones",
"nlb:UpdateLoadBalancerAddressTypeConfig",
"nlb:GetLoadbalancerAttribute",
"alb:UpdateLoadBalancerZones",
"alb:UpdateLoadBalancerAddressTypeConfig",
"alb:GetLoadbalancerAttribute"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": "ram:DeleteServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": "tag.aliyuncs.com"
}
}
},
{
"Action": [
"config:StartConfigurationRecorder",
"config:DescribeConfigurationRecorder",
"config:CreateConfigRule",
"config:DeleteConfigRules",
"config:UpdateConfigRule",
"config:ListConfigRules",
"config:GetConfigRule",
"config:CreateAggregateConfigRule",
"config:DeleteAggregateConfigRules",
"config:ListAggregateConfigRules",
"config:GetAggregateConfigRule",
"config:UpdateAggregateConfigRule",
"config:ListAggregators",
"config:CreateAggregator",
"config:GetConfigRulesReport",
"config:GenerateConfigRulesReport",
"config:CreateRemediation",
"config:CreateAggregateRemediation",
"config:GetAggregateConfigRulesReport",
"config:GenerateAggregateConfigRulesReport",
"config:ListRemediations",
"config:ListAggregateRemediations",
"config:StartAggregateRemediation",
"config:StartRemediation",
"config:GetResourceComplianceGroupByRegion",
"config:ListConfigRuleEvaluationResults",
"config:GetAggregateResourceComplianceByConfigRule",
"config:ListAggregateConfigRuleEvaluationResults",
"config:ListRemediationExecutions",
"config:ListAggregateRemediationExecutions",
"config:GetDiscoveredResource",
"config:GetAggregateDiscoveredResource",
"config:UpdateRemediation"
],
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"config:ServiceChannel": "TagPolicy"
}
}
},
{
"Action": "ram:CreateServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": [
"config.aliyuncs.com",
"remediation.config.aliyuncs.com"
]
}
}
}
]
}