操作步驟

1. 登錄辦公安全平臺控制臺。

2. 在歡迎使用SASE對話框，單擊確認創建。

   您開通辦公安全平臺后，首次登錄控制臺時，辦公安全平臺會提示您創建服務關聯角色的流程。

   當您單擊確認創建后，阿里云將自動為您創建SASE的服務關聯角色AliyunServiceRoleForCsas。您可以在RAM控制臺的角色頁面查看阿里云為SASE自動創建的服務關聯角色。只有創建服務關聯角色完成后，您的SASE實例才能訪問IDaaS、SAG等云服務的資源。

辦公安全平臺關聯角色介紹

以下是辦公安全平臺關聯角色的介紹：

• 角色名稱：AliyunServiceRoleForCsas

• 權限策略名稱：AliyunServiceRolePolicyForCsas

  說明

  該權限策略為系統默認提供的策略，其策略名稱和策略內容都不支持修改。

• 權限策略示例：

  {
    "Version": "1",
    "Statement": [
      {
        "Action": [
          "ecs:DescribeInstances",
          "ecs:CreateSecurityGroup",
          "ecs:DeleteSecurityGroup",
          "ecs:AuthorizeSecurityGroup",
          "ecs:DescribeSecurityGroups",
          "ecs:DescribeSecurityGroupReferences",
          "ecs:ModifySecurityGroupPolicy",
          "ecs:ModifySecurityGroupRule",
          "ecs:ModifySecurityGroupEgressRule",
          "ecs:CreateNetworkInterface",
          "ecs:DeleteNetworkInterface",
          "ecs:DescribeNetworkInterfaces",
          "ecs:CreateNetworkInterfacePermission",
          "ecs:DescribeNetworkInterfacePermissions",
          "ecs:DeleteNetworkInterfacePermission",
          "ecs:AttachNetworkInterface",
          "ecs:DetachNetworkInterface",
          "ecs:RevokeSecurityGroup"
        ],
        "Resource": "*",
        "Effect": "Allow"
      },
      {
        "Action": [
          "rds:DescribeDBInstances",
          "rds:DescribeSecurityGroupConfiguration",
          "rds:ModifySecurityGroupConfiguration",
          "rds:DescribeDBInstanceIPArrayList",
          "rds:ModifySecurityIps"
        ],
        "Resource": "*",
        "Effect": "Allow"
      },
      {
        "Action": [
          "kvstore:DescribeInstances",
          "kvstore:DescribeGlobalDistributeCache",
          "kvstore:DescribeSecurityIps",
          "kvstore:ModifySecurityIps",
          "kvstore:DescribeSecurityGroupConfiguration",
          "kvstore:ModifySecurityGroupConfiguration"
        ],
        "Resource": "*",
        "Effect": "Allow"
      },
      {
        "Action": [
          "dds:DescribeDBInstances",
          "dds:DescribeSecurityIps",
          "dds:ModifySecurityIps",
          "dds:DescribeSecurityGroupConfiguration",
          "dds:ModifySecurityGroupConfiguration"
        ],
        "Resource": "*",
        "Effect": "Allow"
      },
      {
        "Action": [
          "polardb:DescribeDBClusters",
          "polardb:DescribeDBClusterAccessWhitelist",
          "polardb:ModifyDBClusterAccessWhitelist"
        ],
        "Resource": "*",
        "Effect": "Allow"
      },
      {
        "Action": [
          "vpc:DescribeVpcs",
          "vpc:DescribeVSwitches",
          "vpc:CreateVpc",
          "vpc:DeleteVpc",
          "vpc:CreateVSwitch",
          "vpc:DeleteVSwitch",
          "vpc:DescribeZones",
          "vpc:DescribePhysicalConnections",
          "vpc:DescribeVirtualBorderRouters",
          "vpc:DescribeVirtualBorderRoutersForPhysicalConnection",
          "vpc:DescribeVpnGateways",
          "vpc:DescribeVpnGateway",
          "vpc:DescribeCustomerGateways",
          "vpc:DescribeVpnConnections",
          "vpc:DescribeVpcAttribute",
          "vpc:DescribeRouteTables",
          "vpc:DescribeRouteTableList",
          "vpc:DescribeRouteEntryList"
        ],
        "Resource": "*",
        "Effect": "Allow"
      },
      {
        "Action": [
          "cen:DescribeCens",
          "cen:DescribeCenAttachedChildInstances",
          "cen:DescribeCenAttachedChildInstanceAttribute",
          "cen:AttachCenChildInstance",
          "cen:DetachCenChildInstance",
          "cen:GrantInstanceToCen",
          "cen:RevokeInstanceFromCen"
        ],
        "Resource": "*",
        "Effect": "Allow"
      },
      {
        "Action": [
          "smartag:CreateSmartAGTrafficService",
          "smartag:UpdateSmartAGTrafficService",
          "smartag:DeleteSmartAGTrafficSerivce",
          "smartag:ListSmartAGTrafficService",
          "smartag:DescribeSmartAccessGateways",
          "smartag:DescribeCloudConnectNetworks",
          "smartag:CreateCloudConnectNetwork",
          "smartag:ModifyCloudConnectNetwork",
          "smartag:DeleteCloudConnectNetwork",
          "smartag:CreateSmartAccessGatewaySoftware",
          "smartag:UpgradeSmartAccessGatewaySoftware",
          "smartag:DowngradeSmartAccessGatewaySoftware",
          "smartag:BindSmartAccessGateway",
          "smartag:UnbindSmartAccessGateway"
        ],
        "Resource": "*",
        "Effect": "Allow"
      },
      {
        "Action": [
          "log:PostLogStoreLogs",
          "log:GetProject",
          "log:ListProject",
          "log:GetLogStore",
          "log:ListLogStores",
          "log:CreateLogStore",
          "log:CreateProject",
          "log:GetIndex",
          "log:CreateIndex",
          "log:UpdateIndex",
          "log:CreateDashboard",
          "log:ClearLogStoreStorage",
          "log:UpdateLogStore",
          "log:UpdateDashboard",
          "log:CreateSavedSearch",
          "log:UpdateSavedSearch",
          "log:DeleteLogStore",
          "log:DeleteSavedSearch",
          "log:GetSavedSearch",
          "log:ListSavedSearch",
          "log:DeleteDashboard",
          "log:GetDashboard",
          "log:ListDashboard"
        ],
        "Resource": "acs:log:*:*:project/csas-project-*",
        "Effect": "Allow"
      },
      {
        "Action": [
          "pvtz:DescribeZones",
          "pvtz:DescribeZoneInfo",
          "pvtz:DescribeZoneRecords"
        ],
        "Resource": "*",
        "Effect": "Allow"
      },
      {
        "Action": "ram:DeleteServiceLinkedRole",
        "Resource": "*",
        "Effect": "Allow",
        "Condition": {
          "StringEquals": {
            "ram:ServiceName": "csas.aliyuncs.com"
          }
        }
      }
    ]
  }

相關問題

為什么我使用RAM用戶無法自動創建SASE服務關聯角色？

{
    "Statement": [
        {
            "Action": [
                "ram:CreateServiceLinkedRole"
            ],
            "Resource": "acs:ram:*:主賬號ID:role/*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": [
                        "csas.aliyuncs.com"
                    ]
                }
            }
        }
    ],
    "Version": "1"
}