AliyunServiceRolePolicyForAegis 是专用于服务关联角色的授权策略，会在创建服务关联角色 AliyunServiceRoleForAegis 时自动授权，以允许服务关联角色代您访问其他云服务。本策略由对应的阿里云服务按需更新，请勿将本策略授权给服务关联角色之外的 RAM 身份使用。
策略详情
类型：系统策略
创建时间：2024-01-31 13:48:10
更新时间：2024-01-31 13:48:10
当前版本：v1
策略内容
{
"Version": "1",
"Statement": [
{
"Action": [
"cr:GetRepository",
"cr:GetInstanceEndpoint",
"cr:GetAuthorizationToken",
"cr:GetInstanceVpcEndpoint",
"cr:GetRepoBuildList",
"cr:ListRepository",
"cr:ListRepositoryTag",
"cr:ListRepoTag",
"cr:ListInstanceEndpoint",
"cr:GetRegionList",
"cr:PullRepository",
"cr:ListArtifactBuildTaskLog",
"cr:GetRepositoryTag",
"cr:GetImageScan",
"cr:ListInstance"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"cs:DescribeClusterNamespaces",
"cs:DescribeClusters",
"cs:GetClusterAuditProject",
"cs:GetClusterAudit",
"cs:GetClusters",
"cs:GetUserClusterResource",
"cs:QueryUserClusterResource",
"cs:GetUserInstanceResource",
"cs:DescribeClusterNodes",
"cs:DescribeClusterInnerServiceKubeconfig",
"cs:RevokeClusterInnerServiceKubeconfig",
"cs:DescribeClusterDetail",
"cs:DescribeClustersV1",
"cs:DescribeUserPermission",
"cs:UpgradeK8sComponents",
"cs:PauseComponentUpgrade",
"cs:ResumeComponentUpgrade",
"cs:CancelComponentUpgrade",
"cs:DescribeAddons",
"cs:DescribeClusterAddonsUpgradeStatus"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"ecs:CreateCommand",
"ecs:InstallCloudAssistant",
"ecs:InvokeCommand",
"ecs:StopInvocation",
"ecs:DeleteCommand",
"ecs:DescribeCloudAssistantStatus",
"ecs:DescribeCommands",
"ecs:DescribeInvocations",
"ecs:DescribeInvocationResults",
"ecs:ModifyCommand",
"ecs:DescribeInstances",
"ecs:DescribeDisks",
"ecs:DescribeSnapshots",
"ecs:CreateSnapshot",
"ecs:DescribeInstanceAttribute",
"ecs:CreateSecurityGroup",
"ecs:AuthorizeSecurityGroup",
"ecs:RevokeSecurityGroup",
"ecs:DescribeSecurityGroupAttribute",
"ecs:DescribeSecurityGroups",
"ecs:JoinSecurityGroup",
"ecs:AuthorizeSecurityGroupEgress",
"ecs:LeaveSecurityGroup",
"ecs:RevokeSecurityGroupEgress",
"ecs:CreateNetworkInterface",
"ecs:DeleteNetworkInterface",
"ecs:DescribeNetworkInterfaces",
"ecs:CreateNetworkInterfacePermission",
"ecs:DescribeNetworkInterfacePermissions",
"ecs:DeleteNetworkInterfacePermission",
"ecs:DescribeSecurityGroupReferences",
"ecs:DetachNetworkInterface",
"ecs:AttachNetworkInterface",
"ecs:ModifySecurityGroupAttribute",
"ecs:ModifySecurityGroupPolicy",
"ecs:ModifySecurityGroupRule",
"ecs:CreateActivation",
"ecs:DescribeResourceByTags",
"ecs:CreateImage",
"ecs:DescribeImages",
"ecs:CopyImage",
"ecs:ModifyImageSharePermission",
"ecs:DeleteImage",
"ecs:DeleteSnapshot",
"ecs:DescribeAutoSnapshotPolicyEx",
"ecs:DescribeZones"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"log:PostLogStoreLogs",
"log:GetProject",
"log:ListProject",
"log:GetLogStore",
"log:ListLogStores",
"log:CreateLogStore",
"log:CreateProject",
"log:GetIndex",
"log:CreateIndex",
"log:UpdateIndex",
"log:CreateDashboard",
"log:ClearLogStoreStorage",
"log:UpdateLogStore",
"log:UpdateDashboard",
"log:CreateSavedSearch",
"log:UpdateSavedSearch",
"log:DeleteLogStore",
"log:DeleteSavedSearch",
"log:GetSavedSearch",
"log:ListSavedSearch",
"log:DeleteDashboard",
"log:GetDashboard",
"log:ListDashboard",
"log:DeleteProject",
"log:ListShards",
"log:GetCursorOrData",
"log:GetConsumerGroupCheckPoint",
"log:UpdateConsumerGroup",
"log:ConsumerGroupHeartBeat",
"log:ConsumerGroupUpdateCheckPoint",
"log:ListConsumerGroup",
"log:CreateConsumerGroup",
"log:GetSlsService"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"oss:ListBuckets",
"oss:GetBucketAcl",
"oss:GetBucketLogging",
"oss:GetBucketReplication",
"oss:GetBucketEncryption",
"oss:GetBucketReferer",
"oss:GetBucketPolicy",
"oss:GetBucketVersioning",
"oss:PutBucketAcl",
"oss:ListBucketInventory",
"oss:GetBucketInventory",
"oss:GetObject",
"oss:GetObjectMetadata",
"oss:GetBucketStat",
"oss:ListBuckets",
"oss:ListObjects",
"oss:GetBucketInfo"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"slb:DescribeLoadBalancers",
"slb:DescribeListenerAccessControlAttribute",
"slb:DescribeLoadBalancerAttribute",
"slb:DescribeLoadBalancerHTTPListenerAttribute",
"slb:DescribeLoadBalancerHTTPSListenerAttribute",
"slb:DescribeLoadBalancerTCPListenerAttribute",
"slb:DescribeLoadBalancerUDPListenerAttribute",
"slb:DescribeAccessControlListAttribute",
"slb:DescribeHealthStatus",
"slb:DescribeCACertificates",
"slb:DescribeServerCertificates",
"slb:DescribeAccessLogsDownloadAttribute",
"slb:DescribeVServerGroups",
"slb:DescribeVServerGroupAttribute",
"slb:DescribeMasterSlaveServerGroupAttribute",
"alb:ListLoadBalancers",
"alb:GetLoadBalancerAttribute",
"alb:ListListeners",
"alb:ListAclEntries",
"alb:GetListenerHealthStatus",
"alb:GetListenerAttribute",
"alb:ListServerGroupServers",
"alb:ListListenerCertificates",
"nlb:GetLoadBalancerAttribute",
"nlb:ListListeners",
"nlb:ListServerGroupServers"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"vpc:DescribeNatGateways",
"vpc:DescribeForwardTableEntries",
"vpc:DescribeVpnGateways",
"vpc:DescribeVpcAttribute",
"vpc:DescribeVSwitchAttributes",
"vpc:DescribeRegions",
"vpc:DescribeVpcs",
"vpc:DescribeVSwitches",
"vpc:DescribeNetworkAcls",
"vpc:DescribeEipAddresses"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": "ram:DeleteServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": "sas.aliyuncs.com"
}
}
},
{
"Action": "ram:DeleteServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": "aegis.aliyuncs.com"
}
}
},
{
"Action": [
"bms:ListInstance",
"bms:ListBmcpInstance",
"bms:ListManageableInstance",
"bms:ListASCMHistoryEvent",
"bms:DescribeLicenseInfo",
"bms:DescribeServiceStatus"
],
"Resource": "*",
"Effect": "Allow"
}
]
}