When you activate Container Service for Kubernetes (ACK), you must grant default roles to a service account. Then, the service account can be used to call services, such as Elastic Compute Service (ECS), Object Storage Service (OSS), Apsara File Storage NAS, and Server Load Balancer (SLB), create clusters, and save cluster logs. This topic describes the permissions of the ACK default roles.
Role permissions
This topic describes the permissions of the following roles:
AliyunCSManagedLogRole
The Logtail component of ACK uses AliyunCSManagedLogRole to access resources of other cloud services.
Permission | Description |
---|---|
log:CreateProject | Creates a project. |
log:GetProject | Queries a project by name. |
log:DeleteProject | Deletes a specified project. |
log:CreateLogStore | Creates a Logstore in a project. |
log:GetLogStore | Queries the attributes of a Logstore. |
log:UpdateLogStore | Updates the attributes of a Logstore. |
log:DeleteLogStore | Deletes a Logstore. |
log:CreateConfig | Creates a log collection configuration. |
log:UpdateConfig | Updates a log collection configuration. |
log:GetConfig | Queries the details of a log collection configuration. |
log:DeleteConfig | Deletes a specified log collection configuration. |
log:CreateMachineGroup | Creates a machine group to apply log collection configurations. |
log:UpdateMachineGroup | Updates the information of a machine group. |
log:GetMachineGroup | Queries the information of a specified machine group. |
log:DeleteMachineGroup | Deletes a machine group. |
log:ApplyConfigToGroup | Applies a log collection configuration to a machine group. |
log:GetAppliedMachineGroups | Queries the machines to which a log collection configuration is applied in a machine group. |
log:GetAppliedConfigs | Queries the configurations that are applied to a machine group. |
log:RemoveConfigFromMachineGroup | Removes a configuration from a machine group. |
log:CreateIndex | Creates an index for a specified Logstore. |
log:GetIndex | Queries the index of a specified Logstore. |
log:UpdateIndex | Updates the index of a specified Logstore. |
log:DeleteIndex | Deletes the index of a specified Logstore. |
log:CreateSavedSearch | Creates a saved search. |
log:GetSavedSearch | Queries a specified saved search. |
log:UpdateSavedSearch | Updates a saved search. |
log:DeleteSavedSearch | Deletes a saved search. |
log:CreateDashboard | Creates a dashboard. |
log:GetDashboard | Queries a specified dashboard. |
log:UpdateDashboard | Updates a dashboard. |
log:DeleteDashboard | Deletes a dashboard. |
log:CreateJob | Creates a job. For example, create an alert or a subscription. |
log:GetJob | Queries a job. |
log:DeleteJob | Deletes a job. |
log:UpdateJob | Updates a job. |
log:PostLogStoreLogs | Adds logs to a specified Logstore. |
log:CreateSortedSubStore | Creates a sorted sub-Logstore. |
log:GetSortedSubStore | Queries a sorted sub-Logstore. |
log:ListSortedSubStore | Lists sorted sub-Logstores. |
log:UpdateSortedSubStore | Updates a sorted sub-Logstore. |
log:DeleteSortedSubStore | Deletes a sorted sub-Logstore. |
log:CreateApp | Creates applications, such as Cost Manager and Log Audit Service. |
log:UpdateApp | Updates applications, such as Cost Manager and Log Audit Service. |
log:GetApp | Queries applications, such as Cost Manager and Log Audit Service. |
log:DeleteApp | Deletes applications, such as Cost Manager and Log Audit Service. |
cs:DescribeTemplates | Queries container templates. |
cs:DescribeTemplateAttribute | Queries the attributes of a container template. |
AliyunCSManagedCmsRole
The Cloud Monitor component of an ACK cluster uses AliyunCSManagedCmsRole to access resources of other cloud services.
Permission | Description |
---|---|
cms:DescribeMonitorGroups | Queries application groups. |
cms:DescribeMonitorGroupInstances | Queries the resources in a specified application group. |
cms:CreateMonitorGroup | Creates an application group. |
cms:DeleteMonitorGroup | Deletes a specified application group. |
cms:ModifyMonitorGroupInstances | Modifies the resources in an application group. |
cms:CreateMonitorGroupInstances | Adds resources to an application group. |
cms:DeleteMonitorGroupInstances | Deletes resources from an application group. |
cms:TaskConfigCreate | Creates a monitoring job configuration. |
cms:TaskConfigList | Lists monitoring job configurations. |
cms:DescribeMetricList | Queries the time series metrics of a cloud service in a specified period. |
cs:DescribeMonitorToken | Queries the token that is required to use the Cloud Monitor component. |
ahas:GetSentinelAppSumMetric | Queries the metrics that are monitored by the AHAS Sentinel application. |
log:GetLogStoreLogs | Queries logs in a Logstore. |
slb:DescribeMetricList | Queries the time series metrics of a cloud service in a specified period. |
sls:GetLogs | Queries logs in a Logstore of a specified project in Log Service. |
sls:PutLogs | Updates logs in a Logstore of a specified project in Log Service. |
AliyunCSManagedCsiRole
The volume plug-in of an ACK cluster uses AliyunCSManagedCsiRole to access resources of other cloud services.
- Permissions on ECS resources
Permission Description ecs:AttachDisk Attaches a pay-as-you-go data disk or a system disk to an ECS instance. ecs:DetachDisk Detaches a pay-as-you-go disk from an ECS instance. ecs:DescribeDisks Queries one or more disks that you have created and local disks. ecs:CreateDisk Creates a pay-as-you-go or subscription data disk. ecs:ResizeDisk Expands a disk. You can expand a system disk or a data disk. ecs:CreateSnapshot Creates a snapshot for a disk. ecs:DeleteSnapshot Deletes a specified snapshot. If you call this operation to delete a snapshot that is being created, the snapshot creation task is canceled. ecs:CreateAutoSnapshotPolicy Creates an automatic snapshot policy. ecs:ApplyAutoSnapshotPolicy Attaches an automatic snapshot policy to one or more disks. ecs:CancelAutoSnapshotPolicy Detaches an automatic snapshot policy from one or more disks. ecs:DeleteAutoSnapshotPolicy Deletes an automatic snapshot policy. ecs:DescribeAutoSnapshotPolicyEX Queries automatic snapshot policies that you have created. ecs:ModifyAutoSnapshotPolicyEx Modifies an automatic snapshot policy. ecs:AddTags Attaches tags to an ECS instance. ecs:DescribeTags Queries tags of an ECS instance. ecs:DescribeSnapshots Queries all the snapshots of an ECS instance or a disk. ecs:ListTagResources Queries tags that are attached to one or more ECS instances. ecs:TagResources Creates tags and attaches the tags to a specified group of ECS instances. ecs:UntagResources Detaches tags from a specified group of ECS instances and deletes the tags. ecs:ModifyDiskSpec Upgrades the performance level of an enhanced SSD. ecs:CreateSnapshot Creates a snapshot for a disk. ecs:DeleteDisk Releases a pay-as-you-go data disk. ecs:DescribeInstanceAttribute Queries all attributes of an ECS instance. ecs:DescribeInstances Queries the information of one or more ECS instances. - Permissions on NAS file systems
Permission Description nas:DescribeFileSystems Queries the descriptions of file systems. nas:DescribeMountTargets Queries the descriptions of mount targets. nas:AddTags Attaches one or more tags to a file system or overwrites the tags. nas:DescribeTags Queries existing tags. nas:RemoveTags Detaches one or more tags from a file system. nas:CreateFileSystem Creates a file system. nas:DeleteFileSystem Deletes a file system. nas:DescribeFileSystems Queries the descriptions of file systems. nas:ModifyFileSystem Modifies the information of file systems. nas:CreateMountTarget Creates a mount target. nas:DeleteMountTarget Deletes a mount target. nas:DescribeMountTargets Queries the descriptions of mount targets. nas:ModifyMountTarget Modifies the information of mount targets.
AliyunCSManagedVKRole
The Virtual Kubelet component of an ACK cluster uses AliyunCSManagedVKRole to access resources of other cloud services.
- Permissions on VPC resources
Permission Description vpc:DescribeVSwitches Queries existing vSwitches. vpc:DescribeVpcs Queries existing VPCs. vpc:AssociateEipAddress Binds an elastic IP address (EIP) to a cloud service instance in the same region. vpc:DescribeEipAddresses Queries the EIPs that you create in a specified region. vpc:AllocateEipAddress Applies for an EIP. vpc:ReleaseEipAddress Releases a specified EIP. - Permissions on ECS resources
Permission Description ecs:DescribeSecurityGroups Queries the basic information of the security groups that you create. ecs:CreateNetworkInterface Creates an elastic network interface (ENI). ecs:CreateNetworkInterfacePermission Grants permissions to create an ENI. ecs:DescribeNetworkInterfaces Queries ENIs. ecs:AttachNetworkInterface Attaches an ENI to a VPC-connected ECS instance. ecs:DetachNetworkInterface Detaches an ENI from an ECS instance. ecs:DeleteNetworkInterface Deletes an ENI. ecs:DeleteNetworkInterfacePermission Grants permissions to delete an ENI. - Permissions on Alibaba Cloud DNS PrivateZone resources
Permission Description pvtz:AddZone Creates a private zone. pvtz:DeleteZone Deletes a private zone. pvtz:DescribeZones Queries private zones. pvtz:DescribeZoneInfo Queries the information of a specified private zone. pvtz:BindZoneVpc Binds a private zone to a VPC or unbinds a private zone from a VPC. pvtz:AddZoneRecord Adds a DNS record to a private zone. pvtz:DeleteZoneRecord Deletes a DNS record. pvtz:DeleteZoneRecordsByRR Deletes DNS records. pvtz:DescribeZoneRecordsByRR Queries DNS records. pvtz:DescribeZoneRecords Queries DNS records. - Permissions on elastic container instances (ECIs)
Permission Description eci:CreateContainerGroup Creates a pod. eci:DeleteContainerGroup Deletes a pod. eci:DescribeContainerGroups Queries the information of multiple pods. eci:DescribeContainerLog Queries the logs of a pod. eci:UpdateContainerGroup Updates a pod. eci:UpdateContainerGroupByTemplate Updates an ECI by template. eci:CreateContainerGroupFromTemplate Creates an ECI by template. eci:RestartContainerGroup Restarts an ECI. eci:ExportContainerGroupTemplate Exports an ECI template. eci:DescribeContainerGroupMetric Queries the monitoring data of an ECI. eci:DescribeMultiContainerGroupMetric Queries the monitoring data of multiple pods. eci:ExecContainerCommand Runs commands on a container. eci:CreateImageCache Creates an image cache. eci:DescribeImageCaches Queries the information of image caches. eci:DeleteImageCache Deletes an image cache.
AliyunCSClusterRole
When the applications are running, an ACK cluster uses AliyunCSClusterRole to access resources of other cloud services.
- Permissions on ECS resources
Permission Description ecs:Describe* Queries ECS resources. - Permissions on OSS resources
Permission Description oss:PutObject Uploads a file or a folder. oss:GetObject Obtains a file or a folder. oss:ListObjects Queries files. - Permissions on Cloud Monitor Service (CMS)
Permission Description cms:List* Lists permissions on CMS resources. cms:Get* Obtains permissions on CMS resources. cms:UpdateAlert Updates an alert. cms:CreateAlert Creates an alert. cms:DeleteAlert Deletes an alert. cms:UpdateDimensions Updates monitoring metrics configurations. cms:CreateDimensions Creates monitoring metrics configurations. cms:DeleteDimensions Deletes monitoring metrics configurations. cms:SendAlarm Sends a monitoring alert. cms:CreateProject Creates a monitoring project. cms:DeleteProject Deletes a monitoring project. cms:UpdateProject Updates a monitoring project. cms:QueryAlarm Queries a monitoring alert. cms:ListAlarm Lists monitoring alerts. cms:CreateAlarm Creates a monitoring alert. cms:DeleteAlarm Deletes a monitoring alert. cms:UpdateAlarm Updates a monitoring alert. - Permissions on Server Load Balancer (SLB) resources
Permission Description slb:Describe* Queries the information about an SLB instance. slb:CreateLoadBalancer Creates an SLB instance. slb:DeleteLoadBalancer Deletes an SLB instance. slb:RemoveBackendServers Unbinds backend servers from an SLB instance. slb:StartLoadBalancerListener Starts a specified listener. slb:StopLoadBalancerListener Stops a specified listener. slb:CreateLoadBalancerTCPListener Creates a TCP listener for an SLB instance. slb:AddBackendServers* Adds backend servers to an SLB instance. slb:DeleteLoadBalancerListener Deletes an SLB instance. slb:CreateVServerGroup Creates a VServer group and adds backend servers to the VServer group. slb:ModifyVServerGroupBackendServers Modifies backend servers in a VServer group. slb:CreateLoadBalancerHTTPListener Creates an HTTP listener for an SLB instance. slb:SetBackendServers Configures backend servers of an SLB instance and sets weights for the backend servers. The backend servers are ECS instances. slb:AddTags Attaches tags to an SLB instance. - Permissions on Log Service resources
Permission Description log:Get* Obtains permissions on Log Service resources. log:List* Lists permissions on Log Service resources. log:CreateProject Creates a project. log:DeleteProject Deletes a specified project. log:UpdateProject Updates a project. log:CreateMachineGroup Creates a machine group to apply log collection configurations. log:DeleteMachineGroup Deletes a machine group. log:UpdateMachineGroup Updates the information of a machine group. log:CreateLogStore Creates a Logstore in a project. log:DeleteLogStore Deletes a Logstore. log:UpdateLogStore Updates the attributes of a Logstore. log:CreateIndex Creates an index for a specified Logstore. log:DeleteIndex Deletes the index of a specified Logstore. log:UpdateIndex Updates the index of a specified Logstore. log:CreateConfig Creates a log collection configuration. log:DeleteConfig Deletes a specified log collection configuration. log:UpdateConfig Updates a log collection configuration. log:ApplyConfigToGroup Applies a log collection configuration to a machine group.
AliyunCSServerlessKubernetesRole
By default, a serverless Kubernetes cluster uses AliyunCSServerlessKubernetesRole to access resources of other cloud services.
- Permissions on VPC resources
Permission Description DescribeVSwitches Queries existing vSwitches. DescribeVpcs Queries existing VPCs. AssociateEipAddress Binds an EIP to a cloud service instance in the same region. DescribeEipAddresses Queries the EIPs that you create in a specified region. AllocateEipAddress Applies for an EIP. ReleaseEipAddress Releases a specified EIP. AddCommonBandwidthPackageIp Binds an EIP to an EIP bandwidth plan. RemoveCommonBandwidthPackageIp Unbinds an EIP from an EIP bandwidth plan. - Permissions on ECS resources
Permission Description DescribeSecurityGroups Queries the basic information of the security groups that you create. CreateNetworkInterface Creates an ENI. CreateNetworkInterfacePermission Grants permissions to create an ENI. DescribeNetworkInterfaces Queries ENIs. AttachNetworkInterface Attaches an ENI to a VPC-connected ECS instance. DetachNetworkInterface Detaches an ENI from an ECS instance. DeleteNetworkInterface Deletes an ENI. DeleteNetworkInterfacePermission Grants permissions to delete an ENI. - Permissions on SLB resources
Permission Description slb:Describe* Queries SLB resources. slb:CreateLoadBalancer Creates an SLB instance. slb:DeleteLoadBalancer Deletes a pay-as-you-go SLB instance. slb:RemoveBackendServers Removes backend servers from an SLB instance. slb:StartLoadBalancerListener Starts a listener. slb:StopLoadBalancerListener Stops a listener. slb:DeleteLoadBalancerListener Deletes a listener of an SLB instance. slb:CreateLoadBalancerTCPListener Creates a TCP listener for an SLB instance. slb:AddBackendServers* Adds backend servers to an SLB instance. slb:UploadServerCertificate Uploads a server certificate. slb:CreateLoadBalancerHTTPListener Creates an HTTP listener for an SLB instance. slb:CreateLoadBalancerHTTPSListener Creates an HTTPS listener for an SLB instance. slb:CreateLoadBalancerUDPListener Creates a UDP listener. slb:ModifyLoadBalancerInternetSpec Changes the billing method of a public-facing SLB instance. slb:CreateRules Adds forwarding rules to a specified HTTP or HTTPS listener. slb:DeleteRules Deletes forwarding rules. slb:SetRule Modifies a forwarding rule of a VServer group. slb:CreateVServerGroup Adds backend servers to a VServer group. slb:SetVServerGroupAttribute Modifies the configurations of a VServer group. slb:AddVServerGroupBackendServers Adds backend servers to a VServer group. slb:RemoveVServerGroupBackendServers Removes backend servers from a specified VServer group. slb:ModifyVServerGroupBackendServers Changes the backend servers of a VServer group. slb:DeleteVServerGroup Deletes a VServer group. slb:SetLoadBalancerTCPListenerAttribute Modifies the configuration of a TCP listener. slb:SetLoadBalancerHTTPListenerAttribute Modifies the configuration of an HTTP listener. slb:SetLoadBalancerHTTPSListenerAttribute Modifies the configuration of an HTTPS listener. slb:AddTags Adds tags to a specified SLB instance. - Permissions on Alibaba Cloud DNS PrivateZone
Permission Description AddZone Creates a private zone. DeleteZone Deletes a private zone. DescribeZones Queries private zones. DescribeZoneInfo Queries the information of a specified private zone. BindZoneVpc Binds a private zone to a VPC or unbinds a private zone from a VPC. AddZoneRecord Adds a DNS record to a private zone. DeleteZoneRecord Deletes a DNS record. DeleteZoneRecordsByRR Deletes DNS records. DescribeZoneRecordsByRR Queries DNS records. DescribeZoneRecords Queries DNS records. - Permissions on Container Registry (ACR) resources
Permission Description Get* Queries ACR resources. List* Queries image repositories. PullRepository Pulls an image. - Permissions on ECIs
Permission Description CreateContainerGroup Creates a pod. DeleteContainerGroup Deletes a pod. DescribeContainerGroups Queries the information of multiple pods. DescribeContainerLog Queries the logs of a pod. UpdateContainerGroup Updates a pod. UpdateContainerGroupByTemplate Updates an ECI by template. CreateContainerGroupFromTemplate Creates an ECI by template. RestartContainerGroup Restarts an ECI. ExportContainerGroupTemplate Exports an ECI template. DescribeContainerGroupMetric Queries the monitoring data of an ECI. DescribeMultiContainerGroupMetric Queries the monitoring data of multiple pods. ExecContainerCommand Runs commands on a container. CreateImageCache Creates an image cache. DescribeImageCaches Queries the information of image caches. DeleteImageCache Deletes an image cache. - Permissions on RAM resources
Permission Description ram:PassRole Visits the Alibaba Cloud CodePipeline console. - Permissions on OSS resources
Permission Description oss:GetObject Obtains a file or a folder. oss:GetObjectMeta Queries the metadata information of an object. - Permissions on Function Compute
Permission Description fc:CreateService Creates a service. fc:ListServices Queries services. fc:GetService Queries a specified service. fc:UpdateService Updates a specified service. fc:DeleteService Deletes a specified service. fc:CreateFunction Creates a function. fc:ListFunctions Queries the functions of a service. fc:GetFunction Queries the configurations of a specified function. fc:GetFunctionCode Queries the code of a function. fc:UpdateFunction Updates a function, including its configurations and code. fc:DeleteFunction Deletes a specified function. fc:CreateTrigger Creates a function trigger. fc:ListTriggers Queries the triggers of a function. fc:GetTrigger Queries a specified trigger. fc:UpdateTrigger Updates the configurations of a specified trigger. fc:DeleteTrigger Deletes the triggers of a specified function. fc:PublishServiceVersion Releases a Function Compute version. fc:ListServiceVersions Lists Function Compute versions. fc:DeleteServiceVersion Deletes a Function Compute version. fc:CreateAlias Creates an alias and binds it to a customer master key (CMK). fc:ListAliases Lists all aliases of the current Alibaba Cloud account in the current region. fc:GetAlias Queries the information about an alias. fc:UpdateAlias Binds an alias to a different CMK. fc:DeleteAlias Deletes an alias.
AliyunCSKubernetesAuditRole
The auditing feature of ACK uses AliyunCSKubernetesAuditRole to access resources of other cloud services.
Permission | Description |
---|---|
log:CreateProject | Creates a project. |
log:GetProject | Queries a project by name. |
log:DeleteProject | Deletes a specified project. |
log:CreateLogStore | Creates a Logstore in a project. |
log:GetLogStore | Queries the attributes of a Logstore. |
log:UpdateLogStore | Updates the attributes of a Logstore. |
log:DeleteLogStore | Deletes a Logstore. |
log:CreateConfig | Creates a log collection configuration. |
log:UpdateConfig | Updates a log collection configuration. |
log:GetConfig | Queries the details of a log collection configuration. |
log:DeleteConfig | Deletes a specified log collection configuration. |
log:CreateMachineGroup | Creates a machine group to apply log collection configurations. |
log:UpdateMachineGroup | Updates the information of a machine group. |
log:GetMachineGroup | Queries the information of a specified machine group. |
log:DeleteMachineGroup | Deletes a machine group. |
log:ApplyConfigToGroup | Applies a log collection configuration to a machine group. |
log:GetAppliedMachineGroups | Queries the machines to which a log collection configuration is applied in a machine group. |
log:GetAppliedConfigs | Queries the configurations that are applied to a machine group. |
log:RemoveConfigFromMachineGroup | Removes a configuration from a machine group. |
log:CreateIndex | Creates an index for a specified Logstore. |
log:GetIndex | Queries the index of a specified Logstore. |
log:UpdateIndex | Updates the index of a specified Logstore. |
log:DeleteIndex | Deletes the index of a specified Logstore. |
log:CreateSavedSearch | Creates a saved search. |
log:GetSavedSearch | Queries a specified saved search. |
log:UpdateSavedSearch | Updates a saved search. |
log:DeleteSavedSearch | Deletes a saved search. |
log:CreateDashboard | Creates a dashboard. |
log:GetDashboard | Queries a specified dashboard. |
log:UpdateDashboard | Updates a dashboard. |
log:DeleteDashboard | Deletes a dashboard. |
log:CreateJob | Creates a job. For example, create an alert or a subscription. |
log:GetJob | Queries a job. |
log:DeleteJob | Deletes a job. |
log:UpdateJob | Updates a job. |
log:PostLogStoreLogs | Adds logs to a specified Logstore. |
AliyunCSManagedNetworkRole
The network component of an ACK cluster uses AliyunCSManagedNetworkRole to access resources of other cloud services.
Permission | Description |
---|---|
ecs:CreateNetworkInterface | Creates an ENI. |
ecs:DescribeNetworkInterfaces | Queries ENIs. |
ecs:AttachNetworkInterface | Attaches an ENI to a VPC-connected ECS instance. |
ecs:DetachNetworkInterface | Detaches an ENI from an ECS instance. |
ecs:DeleteNetworkInterface | Deletes an ENI. |
ecs:DescribeInstanceAttribute | Queries the information of one or more ECS instances. |
ecs:AssignPrivateIpAddresses | Assigns one or more secondary private IP addresses to an ENI. |
ecs:UnassignPrivateIpAddresses | Unbinds one or more secondary private IP addresses from an ENI. |
ecs:DescribeInstances | Queries the information of one or more ECS instances. |
vpc:DescribeVSwitches | Queries the information of one or more vSwitches. |
AliyunCSDefaultRole
By default, AliyunCSDefaultRole is used to access resources of other cloud services when you perform operations on ACK clusters.
- Permissions on ECS resources
Permission Description ecs:RunInstances Starts an ECS instance. ecs:RenewInstance Renews an ECS instance. ecs:Create* Creates ECS resources, such as ECS instances and disks. ecs:AllocatePublicIpAddress Assigns a public IP address to an ECS instance. ecs:AllocateEipAddress Assigns an EIP to an ECS instance. ecs:Delete* Deletes an ECS instance. ecs:StartInstance Starts ECS resources. ecs:StopInstance Stops an ECS instance. ecs:RebootInstance Restarts an ECS instance. ecs:Describe* Queries ECS resources. ecs:AuthorizeSecurityGroup Sets inbound rules for a security group. ecs:RevokeSecurityGroup Revokes security group rules. ecs:AuthorizeSecurityGroupEgress Sets outbound rules for a security group. ecs:AttachDisk Attaches a disk to an ECS instance. ecs:DetachDisk Detaches a disk from an ECS instance. ecs:WaitFor* Waits for the execution of a task. ecs:AddTags Adds tags to an ECS instance. ecs:ReplaceSystemDisk Replaces the system disk of an ECS instance. ecs:ModifyInstanceAttribute Modifies the attributes of an ECS instance. ecs:JoinSecurityGroup Adds an ECS instance to a security group. ecs:LeaveSecurityGroup Removes an ECS instance from a security group. ecs:UnassociateEipAddress Detaches an EIP from an ECS instance. ecs:ReleaseEipAddress Releases an EIP. ecs:CreateKeyPair Creates an SSH key pair. ecs:ImportKeyPair Imports the public key of an RSA key pair that is created by using a third-party tool. ecs:AttachKeyPair Attaches an SSH key pair to one or more Linux-based ECS instances. ecs:DetachKeyPair Detaches an SSH key pair from one or more Linux-based ECS instances. ecs:DeleteKeyPairs Deletes one or more SSH key pairs. ecs:AttachInstanceRamRole Attaches a RAM role to one or more ECS instances. ecs:DetachInstanceRamRole Detaches a RAM role from one or more ECS instances. ecs:AllocateDedicatedHosts Creates one or more pay-as-you-go or subscription dedicated hosts. ecs:CreateOrder Creates an order to purchase ECS instances. ecs:DeleteInstance Releases a pay-as-you-go instance or an expired subscription instance. ecs:CreateDisk Creates a pay-as-you-go or subscription data disk. ecs:Createvpc Creates a VPC for an ECS instance. ecs:Deletevpc Deletes the VPC that is connected to an ECS instance. ecs:DeleteVSwitch Deletes the vSwitch that is connected to an ECS instance. ecs:ResetDisk Rolls back a disk to a specified state by using a disk snapshot. ecs:DeleteSnapshot Deletes a specified snapshot. ecs:AllocatePublicIpAddress Assigns a public IP address to an ECS instance. ecs:CreateVSwitch Creates a vSwitch for an ECS instance. ecs:DeleteSecurityGroup Deletes a security group. ecs:CreateImage Creates a custom image. ecs:RemoveTags Deletes tags from an ECS instance. ecs:ReleaseDedicatedHost Releases a pay-as-you-go dedicated host. ecs:CreateInstance Creates a subscription or pay-as-you-go ECS instance. ecs:RevokeSecurityGroupEgress Deletes an outbound rule of a security group. This revokes outbound permissions of the security group. ecs:DeleteDisk Releases a pay-as-you-go data disk. ecs:StopInstance Stops an ECS instance. ecs:CreateSecurityGroup Creates a security group. ecs:RevokeSecurityGroup Deletes an inbound rule of a security group. This revokes inbound permissions of the security group. ecs:DeleteImage Deletes a custom image. ecs:ModifyInstanceSpec Modifies the instance type of ECS instances or public bandwidth of a pay-as-you-go ECS instance. ecs:CreateSnapshot Creates a snapshot for a disk. ecs:CreateCommand Creates a Cloud Assistant command. ecs:InvokeCommand Triggers a Cloud Assistant command on one or more ECS instances. ecs:StopInvocation Stops the process of a running Cloud Assistant command on one or more ECS instances. ecs:DeleteCommand Deletes a Cloud Assistant command. ecs:RunCommand Creates a Cloud Assistant command of the shell, PowerShell, or batch type, and runs the command on one or more ECS instances. ecs:DescribeInvocationResults Queries the result of running a Cloud Assistant command on a specified ECS instance. ecs:ModifyCommand Modifies a Cloud Assistant command. - Permissions on VPC resources
Permission Description vpc:Describe* Queries VPC resources. vpc:AllocateEipAddress Assigns an EIP to an ECS instance. vpc:AssociateEipAddress Binds an EIP to an ECS instance. vpc:UnassociateEipAddress Unbinds an EIP from an ECS instance. vpc:ReleaseEipAddress Releases an EIP. vpc:CreateRouteEntry Creates a route entry. vpc:DeleteRouteEntry Deletes a route entry. vpc:CreateVSwitch Creates a vSwitch. vpc:DeleteVSwitch Deletes a vSwitch. vpc:CreateVpc Creates a VPC. vpc:DeleteVpc Deletes a VPC. vpc:CreateNatGateway Creates a network address translation (NAT) gateway. vpc:DeleteNatGateway Deletes a specified NAT gateway. vpc:CreateSnatEntry Adds a source network address translation (SNAT) entry to a specified SNAT table. vpc:DeleteSnatEntry Deletes an SNAT entry from a specified SNAT table. vpc:ModifyEipAddressAttribute Modifies the name, description, and peak bandwidth of a specified EIP. vpc:CreateForwardEntry Adds a destination network address translation (DNAT) entry to a specified DNAT table. vpc:DeleteBandwidthPackage Creates a NAT service plan. vpc:CreateBandwidthPackage Deletes a NAT service plan. vpc:DeleteForwardEntry Deletes a DNAT entry from a specified DNAT table. vpc:TagResources Creates tags and attaches them to a specified resource. vpc:DeletionProtection Enables or disables deletion protection for an instance. - Permissions on SLB resources
Permission Description slb:Describe* Queries the information about an SLB instance. slb:CreateLoadBalancer Creates an SLB instance. slb:DeleteLoadBalancer Deletes an SLB instance. slb:RemoveBackendServers Unbinds backend servers from an SLB instance. slb:StartLoadBalancerListener Starts a specified listener. slb:StopLoadBalancerListener Stops a specified listener. slb:CreateLoadBalancerTCPListener Creates a TCP listener for an SLB instance. slb:AddBackendServers Adds backend servers to an SLB instance. slb:CreateVServerGroup Creates a VServer group and adds backend servers to the VServer group. slb:CreateLoadBalancerHTTPSListener Creates an HTTPS listener for an SLB instance. slb:CreateLoadBalancerUDPListener Creates a UDP listener. slb:ModifyLoadBalancerInternetSpec Changes the billing method of a public-facing SLB instance. slb:SetBackendServers Configures backend servers of an SLB instance and sets weights for the backend servers. The backend servers are ECS instances. slb:AddVServerGroupBackendServers Adds backend servers to a VServer group. slb:DeleteVServerGroup Deletes a VServer group. slb:ModifyVServerGroupBackendServers Changes the backend servers of a VServer group. slb:CreateLoadBalancerHTTPListener Creates an HTTP listener for an SLB instance. slb:RemoveVServerGroupBackendServers Removes backend servers from a specified VServer group. slb:DeleteLoadBalancerListener Deletes a listener of an SLB instance. slb:AddTags Adds tags to a specified SLB instance. slb:RemoveTags Removes tags from a specified SLB instance. slb:SetLoadBalancerDeleteProtection Enables or disables deletion protection for an SLB instance. - Permissions on Domain Name System (DNS) resources
Permission Description dns:Describe* Queries DNS resources. dns:AddDomainRecord Adds a DNS record. - Permissions on RDS resources
Permission Description rds:Describe* Queries RDS resources. rds:ModifySecurityIps Modifies the IP address whitelist of an RDS instance. - Permissions on Resource Orchestration Service (ROS)
Permission Description ros:Describe* Queries ROS resources. ros:WaitConditions Waits for the execution of an ROS script. ros:AbandonStack Stops a stack. ros:DeleteStack Deletes a stack. ros:CreateStack Creates a stack. ros:UpdateStack Updates a stack. ros:ValidateTemplate Validates an ROS template. ros:DoActions Performs actions. ros:InquiryStack Queries a stack. ros:SetDeletionProtection Enables or disables deletion protection. ros:PreviewStack Previews a stack. - Permissions on Auto Scaling (ESS)
Permission Description ess:Describe* Queries ESS resources. ess:CreateScalingConfiguration Creates a scaling configuration. ess:EnableScalingGroup Enables a scaling group. ess:ExitStandby Switches the status of a standby ECS instance in a scaling group to running. ess:DetachDBInstances Removes one or more RDS instances from a scaling group. ess:DetachLoadBalancers Removes one or more SLB instances from a scaling group. ess:AttachInstances Adds one or more ECS instances to a scaling group. ess:DeleteScalingConfiguration Deletes a scaling configuration. ess:AttachLoadBalancers Adds one or more SLB instances. ess:DetachInstances Removes one or more ECS instances from a scaling group. ess:ModifyScalingRule Modifies a scaling group rule. ess:RemoveInstances Removes ECS instances from a specified scaling group. ess:ModifyScalingGroup Modifies a scaling group. ess:AttachDBInstances Adds one or more RDS instances. ess:CreateScalingRule Creates a scaling rule. ess:DeleteScalingRule Deletes a scaling rule. ess:ExecuteScalingRule Runs a scaling rule. ess:SetInstancesProtection Enables or disables protection for one or more ECS instances in a scaling group. ess:ModifyNotificationConfiguration Modifies a notification configuration for auto scaling events and resource changes. ess:CreateNotificationConfiguration Creates a notification configuration for auto scaling events and resource changes. ess:EnterStandby Switches the status of an ECS instance in the scaling group to standby. ess:DeleteScalingGroup Deletes a scaling group. ess:CreateScalingGroup Creates a scaling group. ess:DeleteNotificationConfiguration Deletes a notification configuration for auto scaling events and resource changes. ess:DisableScalingGroup Disables a scaling group. ModifyScalingConfiguration Modifies a scaling configuration. SetGroupDeletionProtection Enables or disables deletion protection for a scaling group. - Permissions on RAM resources
Permission Description ram:PassRole Authorizes a RAM user to use other cloud services. ram:Get* Queries permissions on RAM resources. ram:List* Lists permissions on RAM resources. ram:DetachPolicyFromRole Revokes a specified permission from a role. ram:AttachPolicyToRole Grants a permission to a specified role. ram:DeletePolicy Deletes a specified permission policy. ram:DeletePolicyVersion Deletes a policy of a specified version. ram:DeleteRole Deletes a RAM role. ram:CreateRole Creates a RAM role. ram:CreatePolicy Creates a RAM policy. ram:CreateServiceLinkedRole Creates permissions to be granted to service linked roles. - Permissions on CMS resources
Permission Description cms:CreateMyGroups Creates private application groups. cms:AddMyGroupInstances Adds resources to a private application group. cms:DeleteMyGroupInstances Deletes resources from a private application group. cms:DeleteMyGroups Deletes private application groups. cms:GetMyGroups Queries private application groups. cms:ListMyGroups Lists private application groups. cms:UpdateMyGroupInstances Updates resources in a private application group. cms:UpdateMyGroups Updates private application groups. cms:TaskConfigCreate Creates a monitoring job configuration. cms:TaskConfigList Lists monitoring job configurations. - Permissions on ESS resources
Permission Description ess:CreateLifecycleHook Creates one or more lifecycle hooks for a scaling group. ess:DescribeLifecycleHooks Queries lifecycle hooks. ess:ModifyLifecycleHook Modifies a lifecycle hook. ess:DeleteLifecycleHook Deletes a lifecycle hook. - Permissions on Edge Node Service (ENS) resources
Permission Description ens:Describe* Queries the permissions on ENS resources. ens:CreateInstance Creates an ENS instance. ens:StartInstance Starts an ENS instance. ens:StopInstance Stops an ENS instance. ens:ReleasePrePaidInstance Releases a subscription instance.
AliyunCSManagedKubernetesRole
A managed Kubernetes cluster uses AliyunCSManagedKubernetesRole to access resources of other cloud services.
- Permissions on ECS resources
Permission Description ecs:Describe* Queries ECS resources. ecs:CreateRouteEntry Creates a route entry. ecs:DeleteRouteEntry Deletes a route entry. ecs:CreateNetworkInterface Creates an ENI. ecs:DeleteNetworkInterface Deletes an ENI. ecs:CreateNetworkInterfacePermission Grants permissions to create an ENI. ecs:DeleteNetworkInterfacePermission Grants permissions to delete an ENI. ecs:ModifyInstanceAttribute Modifies the attributes of an instance. ecs:AttachKeyPair Attaches an SSH key pair to one or more Linux-based ECS instances. ecs:StopInstance Stops an instance. ecs:StartInstance Starts an instance. ecs:ReplaceSystemDisk Replaces the system disk or the operating system of an ECS instance. - Permissions on SLB resources
Permission Description slb:Describe* Queries SLB resources. slb:CreateLoadBalancer Creates an SLB instance. slb:DeleteLoadBalancer Deletes an SLB instance. slb:ModifyLoadBalancerInternetSpec Changes the billing method of a public-facing SLB instance. slb:RemoveBackendServers Removes backend servers from an SLB instance. slb:AddBackendServers Adds backend servers to an SLB instance. slb:RemoveTags Removes tags from a specified SLB instance. slb:AddTags Adds tags to a specified SLB instance. slb:StopLoadBalancerListener Stops a listener. slb:StartLoadBalancerListener Starts a listener. slb:SetLoadBalancerHTTPListenerAttribute Modifies the configuration of an HTTP listener. slb:SetLoadBalancerHTTPSListenerAttribute Modifies the configuration of an HTTPS listener. slb:SetLoadBalancerTCPListenerAttribute Modifies the configuration of a TCP listener. slb:SetLoadBalancerUDPListenerAttribute Modifies the configuration of a UDP listener. slb:CreateLoadBalancerHTTPSListener Creates an HTTPS listener for an SLB instance. slb:CreateLoadBalancerHTTPListener Creates an HTTP listener for an SLB instance. slb:CreateLoadBalancerTCPListener Creates a TCP listener for an SLB instance. slb:CreateLoadBalancerUDPListener Creates a UDP listener. slb:DeleteLoadBalancerListener Deletes a listener of an SLB instance. slb:CreateVServerGroup Adds backend servers to a VServer group. slb:DescribeVServerGroups Queries VServer groups. slb:DeleteVServerGroup Deletes a VServer group. slb:SetVServerGroupAttribute Modifies the configurations of a VServer group. slb:DescribeVServerGroupAttribute Queries the information about a VServer group. slb:ModifyVServerGroupBackendServers Changes the backend servers of a VServer group. slb:AddVServerGroupBackendServers Adds backend servers to a VServer group. slb:ModifyLoadBalancerInstanceSpec Modifies the specifications of an SLB instance. slb:ModifyLoadBalancerInternetSpec Changes the billing method of a public-facing SLB instance. slb:RemoveVServerGroupBackendServers Removes backend servers from a specified VServer group. - Permissions on VPC resources
Permission Description vpc:Describe* Queries VPC resources. vpc:DeleteRouteEntry Deletes a custom route entry. vpc:CreateRouteEntry Creates a custom route entry. - Permissions on ACR resources
Permission Description cr:Get* Queries ACR resources. cr:List* Queries image repositories. cr:PullRepository Pulls an image.
AliyunCSManagedArmsRole
The application real-time monitoring agent of an ACK cluster uses AliyunCSManagedArmsRole to access resources of other cloud services.
Permission | Description |
---|---|
arms:CreateApp | Creates an application monitoring job. |
arms:DeleteApp | Deletes an application monitoring job. |
arms:ConfigAgentLabel | Modifies the tags of the application monitoring agent. |
arms:GetAssumeRoleCredentials | Queries the key that is required for a RAM user to assume a RAM role during application monitoring. |
arms:CreateProm | Creates a monitoring job based on Alibaba Cloud Prometheus Monitoring. |
arms:SearchEvents | Queries alert events. |
arms:SearchAlarmHistories | Queries the records of sending alerts. |
arms:SearchAlertRules | Queries monitoring alert rules. |
arms:GetAlertRules | Obtains monitoring alert rules. |
arms:CreateAlertRules | Creates monitoring alert rules. |
arms:UpdateAlertRules | Updates monitoring alert rules. |
arms:StartAlertRule | Enables a monitoring alert rule. |
arms:StopAlertRule | Disables a monitoring alert rule. |
arms:CreateContact | Creates an alert contact. |
arms:SearchContact | Queries an alert contact. |
arms:UpdateContact | Updates an alert contact. |
arms:CreateContactGroup | Creates an alert contact group. |
arms:SearchContactGroup | Queries an alert contact group. |
arms:UpdateContactGroup | Updates an alert contact group. |