AliyunCISDefaultRolePolicy 是專用于服務角色的授權策略，通常會在創建對應的服務角色時同步完成授權，以允許服務角色代您訪問其他云服務。本策略由對應的阿里云服務按需更新，請勿將本策略授權給服務角色之外的 RAM 身份使用。

策略詳情

• 類型：系統策略

• 創建時間：2024-10-18 11:13:15

• 更新時間：2024-12-19 06:53:28

• 當前版本：v7

策略內容

{
	"Version": "1",
	"Statement": [{
			"Action": [
				"ecs:DescribeInstances",
				"ecs:DescribeInstanceStatus",
				"ecs:DescribeInstanceTypes",
				"ecs:DescribeInstanceTypeFamilies",
				"ecs:DescribeInstanceAttribute",
				"ecs:DescribeDiagnosticReports",
				"ecs:DescribeDiagnosticReportAttributes",
				"ecs:DescribeDiagnosticMetricSets",
				"ecs:DescribeDiagnosticMetrics",
				"ecs:DescribeSecurityGroupAttribute",
				"ecs:DescribeSecurityGroups",
				"ecs:DescribeSecurityGroupReferences",
				"ecs:DescribeBandwidthLimitation",
				"ecs:DescribeCloudAssistantStatus",
				"ecs:DescribeCommands",
				"ecs:DescribeInvocationResults",
				"ecs:CreateCommand",
				"ecs:InvokeCommand",
				"ecs:StopInvocation",
				"ecs:CreateDiagnosticReport",
				"ecs:DescribeNetworkInterfaces",
				"ecs:DescribeDisks",
				"ecs:RunCommand"
			],
			"Resource": "*",
			"Effect": "Allow"
		},
		{
			"Action": [
				"vpc:DescribeVpcs",
				"vpc:DescribeVpcAttribute",
				"vpc:DescribeVSwitches",
				"vpc:DescribeVSwitchAttributes",
				"vpc:DescribeRouteTableList",
				"vpc:DescribeRouteEntryList",
				"vpc:DescribeNatGateways",
				"vpc:DescribeRouteTables",
				"vpc:DescribeSnatTableEntries",
				"vpc:DescribeNetworkAcls",
				"vpc:DescribeNetworkAclAttributes",
				"vpc:DescribeEipAddresses"
			],
			"Resource": "*",
			"Effect": "Allow"
		},
		{
			"Action": [
				"sls:GetLogStore"
			],
			"Resource": "*",
			"Effect": "Allow"
		},
		{
			"Action": [
				"oss:GetBucketInfo"
			],
			"Resource": "*",
			"Effect": "Allow"
		},
		{
			"Action": [
				"slb:DescribeLoadBalancers",
				"slb:DescribeLoadBalancerAttribute",
				"slb:DescribeVServerGroups",
				"slb:DescribeVServerGroupAttribute",
				"slb:DescribeLoadBalancerTCPListenerAttribute",
				"slb:DescribeLoadBalancerUDPListenerAttribute",
				"slb:DescribeAccessControlLists",
				"slb:DescribeAccessControlListAttribute",
				"slb:DescribeLoadBalancerListeners",
				"slb:DescribeHealthStatus"
			],
			"Resource": [
				"*"
			],
			"Effect": "Allow"
		},
		{
			"Action": [
				"grace:GetFile",
				"grace:AnalyzeFile",
				"grace:UploadFileByOSS",
				"grace:UploadFileByURL"
			],
			"Resource": "acs:grace:*:*:*",
			"Effect": "Allow"
		},
		{
			"Action": [
				"ram:ListPoliciesForRole"
			],
			"Resource": [
				"acs:ram:*:*:role/kubernetesworkerrole*"
			],
			"Effect": "Allow"
		},
		{
			"Action": [
				"cms:DescribeMetricData",
				"cms:DescribeMetricLast",
				"cms:DescribeMetricMetaList",
				"cms:DescribeMetricTop",
				"cms:QueryMetricMeta",
				"cms:QueryMetricTop",
				"cms:ListMetricMeta",
				"cms:ListMetricMetaProject",
				"cms:QueryMetricData",
				"cms:QueryMetricLast",
				"cms:DescribeMetricList",
				"cms:QueryMetricList",
				"cms:MetricMeta",
				"cms:DescribeAlertLogList",
				"cms:DescribeSystemEventAttribute",
				"cms:GetMetricStreamMeta"
			],
			"Resource": "*",
			"Effect": "Allow"
		},
		{
			"Action": [
				"eflo:DescribeNode",
				"eflo:RunCommand",
				"eflo:DescribeInvocations"
			],
			"Resource": "*",
			"Effect": "Allow"
		},
		{
			"Action": [
				"eci:DescribeContainerGroups",
				"eci:RunCommand",
				"eci:DescribeCommandResult",
				"eci:ListUsage"
			],
			"Resource": "*",
			"Effect": "Allow"
		},
		{
			"Action": [
				"ess:DescribeScalingGroups",
				"ess:DescribeScalingInstances",
				"ess:DescribeScalingActivities",
				"ess:DescribeScalingConfigurations",
				"ess:DescribeScalingRules",
				"ess:DescribeScheduledTasks",
				"ess:DescribeLifecycleHooks",
				"ess:DescribeNotificationConfigurations",
				"ess:DescribeNotificationTypes",
				"ess:DescribeRegions",
				"ess:DescribePatternTypes"
			],
			"Resource": [
				"*"
			],
			"Effect": "Allow"
		},
		{
			"Action": [
				"cs:DescribeClusterDetail",
				"cs:DescribeClusterResources",
				"cs:DescribeTasks",
				"cs:DescribeTaskInfo",
				"cs:DescribeClusterNodePools",
				"cs:DescribeNodePoolVuls",
				"cs:DescribeKubernetesVersionMetadata",
				"cs:DescribeClusterNodes",
				"cs:ListClusterAddonInstances",
				"cs:DescribeAddon",
				"cs:DescribeClusterNodePoolDetail",
				"cs:DescribeClusterAddonsUpgradeStatus"
			],
			"Resource": "*",
			"Effect": "Allow"
		},
		{
			"Action": [
				"quotas:ListProducts",
				"quotas:ListProductQuotas",
				"quotas:ListProductQuotas",
				"quotas:ListProductQuotaDimensions",
				"quotas:GetProductQuota",
				"quotas:GetProductQuotaDimension"
			],
			"Resource": "acs:quotas:*:*:*",
			"Effect": "Allow"
		},
		{
			"Action": "ram:CreateServiceLinkedRole",
			"Resource": "*",
			"Effect": "Allow",
			"Condition": {
				"StringEquals": {
					"ram:ServiceName": "selfservice.ecs.aliyuncs.com"
				}
			}
		}
	]
}

相關文檔

• 權限策略基本元素

• 普通服務角色