AliyunServiceRolePolicyForTag 是专用于服务关联角色的授权策略，会在创建服务关联角色 AliyunServiceRoleForTag 时自动授权，以允许服务关联角色代您访问其他云服务。本策略由对应的阿里云服务按需更新，请勿将本策略授权给服务关联角色之外的 RAM 身份使用。
策略详情
类型：系统策略
创建时间：2020-03-06 09:42:28
更新时间：2023-08-16 11:42:02
当前版本：v12
策略内容
{
"Version": "1",
"Statement": [
{
"Action": [
"actiontrail:CreateServiceTrail",
"actiontrail:DeleteServiceTrail",
"actiontrail:ListServiceTrail",
"oos:ListExecutions"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"*:TagResources",
"*:UntagResources",
"*:UnTagResources",
"dcdn:TagDcdnResources",
"dcdn:UntagDcdnResources",
"vpc:TagResourcesForExpressConnect",
"vpc:UntagResourcesForExpressConnect",
"vod:TagVodResources",
"vod:UnTagVodResources",
"live:TagLiveResources",
"live:UnTagLiveResources",
"ecs:AddTags",
"ecs:RemoveTags",
"slb:AddTags",
"slb:RemoveTags",
"rds:AddTagsToResource",
"rds:RemoveTagsFromResource",
"oss:PutBucketTagging",
"oss:DeleteBucketTags",
"elasticsearch:CreateTags",
"elasticsearch:RemoveTags"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"ecs:DescribeSnapshots",
"ecs:DescribeDisks",
"ecs:DescribeNetworkInterfaces",
"vpc:DescribeEipAddresses"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"alikafka:ListGroup",
"alikafka:ListTopic"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"vpc:AssociateEipAddressBatch",
"vpc:DescribeNatGateways",
"nlb:UpdateLoadBalancerZones",
"nlb:UpdateLoadBalancerAddressTypeConfig",
"nlb:GetLoadbalancerAttribute",
"alb:UpdateLoadBalancerZones",
"alb:UpdateLoadBalancerAddressTypeConfig",
"alb:GetLoadbalancerAttribute"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": "ram:DeleteServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": "tag.aliyuncs.com"
}
}
},
{
"Action": [
"config:StartConfigurationRecorder",
"config:DescribeConfigurationRecorder",
"config:CreateConfigRule",
"config:DeleteConfigRules",
"config:UpdateConfigRule",
"config:ListConfigRules",
"config:GetConfigRule",
"config:CreateAggregateConfigRule",
"config:DeleteAggregateConfigRules",
"config:ListAggregateConfigRules",
"config:GetAggregateConfigRule",
"config:UpdateAggregateConfigRule",
"config:ListAggregators",
"config:CreateAggregator",
"config:GetConfigRulesReport",
"config:GenerateConfigRulesReport",
"config:CreateRemediation",
"config:CreateAggregateRemediation",
"config:GetAggregateConfigRulesReport",
"config:GenerateAggregateConfigRulesReport",
"config:ListRemediations",
"config:ListAggregateRemediations",
"config:StartAggregateRemediation",
"config:StartRemediation",
"config:GetResourceComplianceGroupByRegion",
"config:ListConfigRuleEvaluationResults",
"config:GetAggregateResourceComplianceByConfigRule",
"config:ListAggregateConfigRuleEvaluationResults",
"config:ListRemediationExecutions",
"config:ListAggregateRemediationExecutions",
"config:GetDiscoveredResource",
"config:GetAggregateDiscoveredResource"
],
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"config:ServiceChannel": "TagPolicy"
}
}
},
{
"Action": "ram:CreateServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": [
"config.aliyuncs.com",
"remediation.config.aliyuncs.com"
]
}
}
}
]
}