AliyunServiceRolePolicyForEMROnACS is the authorization policy dedicated to a service-linked role. The policy is automatically attached to a service role when the service role is created. Then, the service-linked role is authorized to access other cloud services. This policy is updated by the relevant Alibaba Cloud service. Do not attach this policy to a RAM identity other than a service-linked role.
Policy details
Type: service system policy
Creation time: 09:51:44 on October 12, 2024
Update time: 11:49:03 on December 02, 2025
Current version: v11
Policy content
{
"Version": "1",
"Statement": [
{
"Action": [
"cs:CreateCluster",
"cs:GetClusterById",
"cs:GetClusters",
"cs:DeleteCluster",
"cs:ModifyCluster",
"cs:DescribeClusterResources",
"cs:DescribeClusterInnerServiceKubeconfig",
"cs:RevokeClusterInnerServiceKubeconfig",
"cs:CreateClusterNodePool",
"cs:DeleteClusterNodepool",
"cs:DescribeClusterNodePoolDetail",
"cs:DescribeClusterNodePools",
"cs:ModifyClusterNodePool",
"cs:ScaleClusterNodePool",
"cs:AttachInstancesToNodePool",
"cs:RemoveNodePoolNodes",
"cs:SyncClusterNodePool",
"cs:DescribeClusterAttachScripts",
"cs:CreateAutoscalingConfig",
"cs:InstallClusterAddons",
"cs:UnInstallClusterAddons",
"cs:ListClusterAddonInstances",
"cs:ListAddons",
"cs:DescribeAddon",
"cs:DescribeKubernetesVersionMetadata",
"cs:DescribeClusterNodes"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"pvtz:DescribeZones",
"pvtz:DescribeZoneRecords",
"pvtz:DescribeZoneInfo",
"pvtz:AddZone",
"pvtz:DescribeUserServiceStatus",
"pvtz:AddZoneRecord",
"pvtz:UpdateZoneRecord",
"pvtz:BindZoneVpc"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"vpc:DescribeVSwitches",
"vpc:DescribeVpcs",
"vpc:DescribeVSwitchAttributes",
"vpc:DescribeVpcAttribute",
"vpc:ListTagResources",
"vpc:TagResources",
"vpc:UnTagResources",
"vpc:CreateVpc",
"vpc:CreateDefaultVpc",
"vpc:DescribeVpcAttribute",
"vpc:DeleteVpc",
"vpc:CreateVSwitch",
"vpc:DescribeVSwitchAttributes",
"vpc:DeleteVSwitch"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"privatelink:CheckProductOpen",
"privatelink:ListVpcEndpoints",
"privatelink:ListVpcEndpointZones",
"privatelink:AddZoneToVpcEndpoint",
"privatelink:RemoveZoneFromVpcEndpoint",
"privatelink:GetVpcEndpointAttribute",
"privatelink:GetVpcEndpointServiceAttribute",
"privatelink:ListVpcEndpointServicesByEndUser",
"privatelink:ListVpcEndpointServices",
"privatelink:ListVpcEndpointServiceUsers",
"privatelink:AddUserToVpcEndpointService",
"privatelink:RemoveUserFromVpcEndpointService",
"privatelink:CreateVpcEndpointService",
"privatelink:DeleteVpcEndpointService",
"privatelink:CreateVpcEndpoint",
"privatelink:DeleteVpcEndpoint",
"privatelink:ListVpcEndpointServiceResources"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": "ram:DeleteServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": "emrkube.aliyuncs.com"
}
}
},
{
"Action": [
"ecs:AssociateEipAddress",
"ecs:AttachNetworkInterface",
"ecs:AuthorizeSecurityGroup",
"ecs:AuthorizeSecurityGroupEgress",
"ecs:CreateNetworkInterface",
"ecs:CreateNetworkInterfacePermission",
"ecs:CreateSecurityGroup",
"ecs:DeleteNetworkInterface",
"ecs:DeleteNetworkInterfacePermission",
"ecs:DeleteSecurityGroup",
"ecs:DescribeNetworkInterfacePermissions",
"ecs:DescribeNetworkInterfaces",
"ecs:DescribeSecurityGroupAttribute",
"ecs:DescribeSecurityGroupReferences",
"ecs:DescribeSecurityGroups",
"ecs:DescribePrice",
"ecs:DetachNetworkInterface",
"ecs:JoinSecurityGroup",
"ecs:LeaveSecurityGroup",
"ecs:ModifyNetworkInterfaceAttribute",
"ecs:ModifySecurityGroupAttribute",
"ecs:ModifySecurityGroupPolicy",
"ecs:ModifySecurityGroupPolicy",
"ecs:ModifySecurityGroupRule",
"ecs:RevokeSecurityGroup",
"ecs:RevokeSecurityGroupEgress",
"ecs:UnassociateEipAddress",
"ecs:AssignIpv6Addresses",
"ecs:AssignPrivateIpAddresses",
"ecs:DescribeInstanceAttribute",
"ecs:DescribeInstances",
"ecs:ListTagResources",
"ecs:ModifySecurityGroupEgressRule",
"ecs:TagResources",
"ecs:UnassignIpv6Addresses",
"ecs:UnassignPrivateIpAddresses",
"ecs:UntagResources"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": "ram:PassRole",
"Resource": "acs:ram::*:role/aliyunkubernetesworkerforemrrole",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"acs:Service": "cs.aliyuncs.com"
}
}
},
{
"Action": "ram:CreateServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": "privatelink.aliyuncs.com"
}
}
}
]
}