AliyunServiceRolePolicyForAgentRun

AliyunServiceRolePolicyForAgentRun is the authorization policy dedicated to a service-linked role. The policy is automatically attached to a service role when the service role is created. Then, the service-linked role is authorized to access other cloud services. This policy is updated by the relevant Alibaba Cloud service. Do not attach this policy to a RAM identity other than a service-linked role.

Policy details

Type: service system policy
Creation time: 10:54:40 on September 22, 2025
Update time: 09:38:34 on June 08, 2026
Current version: v23

Policy content

{
  "Version": "1",
  "Statement": [
    {
      "Action": [
        "apig:*Gateway*",
        "apig:*HttpApi*",
        "apig:*Domain*",
        "apig:*Service*",
        "apig:*Environment*",
        "apig:*HttpApiRoute*",
        "apig:*Policies*",
        "apig:*Policy*",
        "apig:*Source*",
        "apig:*McpServer*",
        "apig:*Plugin*"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "fc:ListFunctions",
        "fc:ListConcurrencyConfigs",
        "fc:DeleteConcurrencyConfig",
        "fc:PutConcurrencyConfig",
        "fc:DeleteFunction",
        "fc:UpdateFunction",
        "fc:CreateFunction",
        "fc:GetConcurrencyConfig",
        "fc:GetFunction",
        "fc:ListAliases",
        "fc:CreateAlias",
        "fc:UpdateAlias",
        "fc:GetAlias",
        "fc:DeleteAlias",
        "fc:ListTriggers",
        "fc:CreateTrigger",
        "fc:UpdateTrigger",
        "fc:GetTrigger",
        "fc:DeleteTrigger",
        "fc:PublishFunctionVersion",
        "fc:ListFunctionVersions",
        "fc:DeleteFunctionVersion",
        "fc:InvokeFunction",
        "fc:CreateSession",
        "fc:GetSession",
        "fc:UpdateSession",
        "fc:PauseSession",
        "fc:ResumeSession",
        "fc:ListSessions",
        "fc:DeleteSession",
        "fc:PutProvisionConfig",
        "fc:GetProvisionConfig",
        "fc:DeleteProvisionConfig",
        "fc:ChangeResourceGroup",
        "fc:PutScalingConfig",
        "fc:GetScalingConfig",
        "fc:DeleteScalingConfig",
        "fc:GetFunctionCode",
        "fc:TagResources"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "fnf:StartSyncExecution",
        "fnf:CreateFlow",
        "fnf:UpdateFlow",
        "fnf:DescribeFlow",
        "fnf:ListFlows",
        "fnf:DeleteFlow",
        "fnf:UpdateFlowDraft",
        "fnf:DescribeFlowDraft",
        "fnf:PublishFlowVersion",
        "fnf:DeleteFlowVersion",
        "fnf:ListFlowVersions",
        "fnf:CreateFlowAlias",
        "fnf:UpdateFlowAlias",
        "fnf:DeleteFlowAlias",
        "fnf:DescribeFlowAlias",
        "fnf:ListFlowAliases",
        "fnf:ChangeResourceGroup"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "cms:CreateService",
        "cms:GetService",
        "cms:DeleteService",
        "cms:GetServiceObservability",
        "cms:UpdateService",
        "cms:GetWorkspace",
        "cms:PutWorkspace",
        "cms:ListServices"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Effect": "Allow",
      "Action": "ram:PassRole",
      "Resource": "acs:ram::*:role/*",
      "Condition": {
        "StringEquals": {
          "acs:Service": [
            "log.aliyuncs.com",
            "ots.aliyuncs.com",
            "fc.aliyuncs.com",
            "fnf.aliyuncs.com",
            "oss.aliyuncs.com"
          ]
        }
      }
    },
    {
      "Action": [
        "ots:GetRow",
        "ots:GetRange",
        "ots:Search",
        "ots:DeleteRow",
        "ots:UpdateRow",
        "ots:PutRow",
        "ots:BatchGetRow"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "sae:CreateNamespace",
        "sae:UpdateNamespaceVpc",
        "sae:CreateApplication",
        "sae:ListApplications",
        "sae:GetApplication",
        "sae:DeleteApplication",
        "sae:CheckAppNameV2",
        "sae:DescribeChangeOrder",
        "sae:DescribeApplicationInstances",
        "sae:BindNlb",
        "sae:DescribeApplicationNlbs",
        "sae:UnbindNlb",
        "sae:DescribeApplicationGroups",
        "sae:DeployApplication",
        "sae:AbortChangeOrder",
        "sae:ListChangeOrders"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "vpc:DescribeVSwitches"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "appflow:CreateFlow",
        "appflow:DeleteFlow",
        "appflow:EnableFlow",
        "appflow:DisableFlow"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "agentidentity:CreateWorkloadIdentity",
        "agentidentity:UpdateWorkloadIdentity",
        "agentidentity:GetWorkloadIdentity",
        "agentidentity:DeleteWorkloadIdentity",
        "agentidentity:GetIdentityProvider",
        "agentidentitydata:GetWorkloadAccessTokenForJWT",
        "agentidentitydata:GetWorkloadAccessTokenForUserId",
        "agentidentitydata:GetWorkloadAccessToken"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": "ram:DeleteServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "agentrun.fc.aliyuncs.com"
        }
      }
    }
  ]
}

Policy details

Policy content

References