Function Compute:Policies and sample policies

• System policies: the policies that are created by Alibaba Cloud. You can use these policies, but cannot modify them. Alibaba Cloud maintains the version updates of the policies.
• Custom policies: the policies that you can create, update, and delete. You maintain the version updates of these policies.

• System policies for Function Compute

  Policy	Description
  AliyunFCReadOnlyAccess	The read-only permissions on all Function Compute resources.
  AliyunFCInvocationAccess	The permissions to invoke all functions.
  AliyunFCFullAccess	The permissions to manage all Function Compute resources.

  Note The permissions to manage all Function Compute resources defined in the AliyunFCFullAccess policy include the permissions to invoke all functions defined in the AliyunFCInvocationAccess policy and the read-only permissions on all Function Compute resources defined in the AliyunFCReadOnlyAccess policy. After you attach the AliyunFCFullAccess policy to a RAM user, you do not need to attach the AliyunFCInvocationAccess or AliyunFCReadOnlyAccess policy to the RAM user.
• System policies for other Alibaba Cloud services

  Alibaba Cloud service	System policies
  Log Service	AliyunLogReadOnlyAccess: the read-only permissions on all Log Service resources. AliyunLogFullAccess: the permissions to manage all Log Service resources. Note To access Log Service as a RAM user, you need to attach only the AliyunLogReadOnlyAccess policy to the RAM user based on the principle of least privilege.
  Object Storage Service (OSS)	AliyunOSSReadOnlyAccess: the read-only permissions on all OSS resources. AliyunOSSFullAccess: the permissions to manage all OSS resources.
  CloudMonitor	AliyunCloudMonitorReadOnlyAccess: the read-only permissions on all CloudMonitor resources.
  SSL Certificates Service	AliyunYundunCertReadOnlyAccess: the read-only permissions on all SSL Certificates Service resources.
  Virtual Private Cloud	AliyunVPCReadOnlyAccess: the read-only permissions on all VPC resources.
  Elastic Compute Service (ECS)	AliyunECSReadOnlyAccess: the read-only permissions on all ECS resources.
  Resource Access Management (RAM)	AliyunRAMReadOnlyAccess: the read-only permissions on all RAM resources, including the permissions to view users, groups, and authorization information. AliyunRAMFullAccess: the permissions to manage all RAM resources, including the permissions to manage users and grant permissions. Note If you attach only the AliyunRAMReadOnlyAccess policy to a RAM user, you can only obtain the list of roles in the console as the RAM user. If you need to perform other operations as the RAM user, you must attach the AliyunRAMFullAccess policy to the RAM user.
  Application Real-Time Monitoring Service	AliyunARMSReadOnlyAccess: the read-only permissions on ARMS resources. AliyunARMSFullAccess: the permission to manage ARMS resources. Note To access ARMS as a RAM user, you need to attach only the AliyunARMSReadOnlyAccess policy to the RAM user based on the principle of least privilege.
  Message Service (MNS)	AliyunMNSReadOnlyAccess: the read-only permissions on all MNS resources. AliyunMNSFullAccess: the permissions to manage all MNS resources. Note To access MNS as a RAM user, you need to attach only the AliyunMNSReadOnlyAccess policy to the RAM user based on the principle of least privilege.
  EventBridge	AliyunEventBridgeReadOnlyAccess: the read-only permissions on all EventBridge resources. AliyunEventBridgeFullAccess: the permissions to manage all EventBridge resources. Note To access EventBridge as a RAM user, you need to attach only the AliyunEventBridgeReadOnlyAccess policy to the RAM user based on the principle of least privilege.
  Message Queue for Apache RocketMQ	AliyunMQReadOnlyAccess: the read-only permissions on all Message Queue for Apache RocketMQ resources. AliyunMQFullAccess: the permissions to manage all Message Queue for Apache RocketMQ resources. Note To access Message Queue for Apache RocketMQ as a RAM user, you need to attach only the AliyunMQReadOnlyAccess policy to the RAM user based on the principle of least privilege.
  Container Registry	AliyunContainerRegistryReadOnlyAccess: the read-only permissions on all Container Registry resources. AliyunContainerRegistryFullAccess: the permissions to manage all Container Registry resources. Note To access Container Registry as a RAM user, you need to attach only the AliyunContainerRegistryReadOnlyAccess policy to the RAM user based on the principle of least privilege.
  Apsara File Storage NAS	AliyunNASReadOnlyAccess: the read-only permissions on all NAS resources. AliyunNASFullAccess: the permissions to manage all NAS resources. Note To access NAS as a RAM user, you need to attach only the AliyunNASReadOnlyAccess policy to the RAM user based on the principle of least privilege.
  ApsaraDB RDS	AliyunRDSReadOnlyAccess: the read-only permissions on all ApsaraDB RDS resources. AliyunRDSFullAccess: the permissions to manage all ApsaraDB RDS resources. Note To access ApsaraDB RDS as a RAM user, you need to attach only the AliyunRDSReadOnlyAccess policy to the RAM user based on the principle of least privilege.
  Apsara Devops	AliyunRDCReadOnlyAccess: the read-only permissions on Apsara DevOps RDC resources. AliyunRDCFullAccess: the permissions to manage the Apsara DevOps RDC resources. Note To access ApsaraDB RDS as a RAM user, you need to attach only the AliyunRDCReadOnlyAccesss policy to the RAM user based on the principle of least privilege.

 {
        "Statement": [
            {
                "Action": [
                    "ram:PassRole"
                ],
                "Effect": "Allow",
                "Resource": "*"
            }
        ],
        "Version": "1"
    }

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "fc:InvokeFunction"
            ],
            "Resource": "acs:fc:cn-hangzhou:*:services/test/functions/demo",
            "Effect": "Allow"
        }
    ]
}