AliyunServiceRolePolicyForAlikafkaConnector is the authorization policy dedicated to a service-linked role. The policy is automatically attached to a service role when the service role is created. Then, the service-linked role is authorized to access other cloud services. This policy is updated by the relevant Alibaba Cloud service. Do not attach this policy to a RAM identity other than a service-linked role.
Policy details
Type: service system policy
Creation time: 13:42:46 on October 23, 2025
Update time: 13:42:46 on October 23, 2025
Current version: v1
Policy content
{
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"fc:InvokeFunction",
"fc:GetFunction",
"fc:ListServices",
"fc:ListFunctions",
"fc:ListServiceVersions",
"fc:ListAliases",
"fc:CreateService",
"fc:DeleteService",
"fc:CreateFunction",
"fc:DeleteFunction",
"fc:CreateLayerVersion",
"fc:ListLayers"
],
"Resource": "*"
},
{
"Action": [
"rds:DescribeDatabases"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"oss:ListBuckets",
"oss:GetBucketAcl"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"elasticsearch:DescribeInstance",
"elasticsearch:ListInstance"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"dataworks:CreateRealTimeProcess",
"dataworks:QueryRealTimeProcessStatus",
"dataworks:GetDISyncTask",
"dataworks:UpdateDISyncTask",
"dataworks:DeployDISyncTask",
"dataworks:GetDISyncInstanceInfo",
"dataworks:StartDISyncInstance",
"dataworks:StopDISyncInstance",
"dataworks:TerminateDISyncInstance",
"dataworks:DeleteDISyncTask"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"eventbridge:CreateEventStreaming",
"eventbridge:UpdateEventStreaming",
"eventbridge:GetEventStreaming",
"eventbridge:DeleteEventStreaming",
"eventbridge:ListEventStreamings",
"eventbridge:StartEventStreaming",
"eventbridge:PauseEventStreaming",
"eventbridge:ListEventStreamingMetrics"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"ots:GetInstance",
"ots:ListInstance",
"ots:ListTable",
"ots:CreateTable",
"ots:UpdateTable",
"ots:DescribeTable",
"ots:GetRow",
"ots:PutRow",
"ots:UpdateRow",
"ots:DeleteRow",
"ots:GetRange",
"ots:BatchGetRow",
"ots:BatchWriteRow",
"ots:BulkImport",
"ots:Search",
"ots:OpenOtsService",
"ots:GetOtsServiceStatus",
"ots:InsertInstance",
"ots:DeleteTable",
"ots:CreateSearchIndex",
"ots:DeleteSearchIndex",
"ots:UpdateSearchIndex",
"ots:DescribeSearchIndex",
"ots:CreateTimeseriesTable",
"ots:ListTimeseriesTable",
"ots:DescribeTimeseriesTable",
"ots:PutTimeseriesData"
],
"Effect": "Allow",
"Resource": "*"
},
{
"Action": [
"gpdb:DescribeDBInstances",
"gpdb:DescribeDBInstanceAttribute"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"adb:DescribeDBClusters",
"adb:DescribeSchemas",
"adb:DescribeTables"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Effect": "Allow",
"Action": [
"alikafka:ListInstance",
"alikafka:ListTopic",
"alikafka:CreateTopic",
"alikafka:UpdateTopic",
"alikafka:ListGroup",
"alikafka:CreateGroup",
"alikafka:ListAcl",
"alikafka:CreateAcl",
"alikafka:ListSaslUser",
"alikafka:CreateSaslUser"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "ram:DeleteServiceLinkedRole",
"Resource": "*",
"Condition": {
"StringEquals": {
"ram:ServiceName": "connector.alikafka.aliyuncs.com"
}
}
}
]
}