Digital Employee permission configuration - STAROps - Alibaba Cloud Documentation Center

This topic describes the permission configuration methods for built-in employees and custom Digital Employees.

For the STAROps permission model and authorization target descriptions, see Permission configuration. This topic does not repeat the permission concepts and only provides scenario-based permission policies that you can copy.

Before configuring Digital Employees, determine whether you are using a built-in employee or a custom Digital Employee.

User operation permissions (RAM user permissions)

User operation permissions are granted to RAM users to control whether a user can view, create, manage, or use Digital Employees. This permission layer must be configured regardless of whether you use built-in employees or custom Digital Employees.

When you use a built-in employee, you only need to grant the RAM user STAROps usage permissions and the necessary data read permissions. Built-in employees are not bound to customer-side RAM roles. Therefore, ram:PassRole is not required.

When you use a custom Digital Employee, in addition to Digital Employee operation permissions, the RAM user must also have ram:PassRole for the target RAM role. Otherwise, the user can view or create Digital Employees but cannot pass the role to STAROps.

Use built-in employees

The following policy applies to scenarios where you use built-in employees for conversations, view sessions, view artifacts, and read diagnostic data. Built-in employees do not support MCP, Alibaba Cloud CLI, and other extension configurations. If you need these capabilities, use custom Digital Employees.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetDigitalEmployee",
        "starops:ListDigitalEmployees"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:CreateArtifactUploadToken",
        "starops:GetArtifactDownloadUrl",
        "starops:CreateChat",
        "starops:CreateThread",
        "starops:GetThread",
        "starops:GetThreadData",
        "starops:ListThreads"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*",
        "acs:starops:*:*:digitalemployee/*/thread/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetDigitalEmployeeSkill",
        "starops:ListDigitalEmployeeSkills",
        "starops:ListDigitalEmployeeSkillVersions"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*/skill/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetMission",
        "starops:ListMissions",
        "starops:ListTasks"
      ],
      "Resource": [
        "acs:starops:*:*:mission/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetMcpService",
        "starops:ListMcpServices",
        "starops:FetchRemoteMcpTools"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*/mcpservice/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetArtifact",
        "starops:ListArtifacts"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*/artifact/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetCreditQuota"
      ],
      "Resource": [
        "acs:starops:*:*:quota/credit"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetDigitalEmployee",
        "cms:ListDigitalEmployees"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:CreateChat",
        "cms:CreateThread",
        "cms:GetThread",
        "cms:GetThreadData",
        "cms:ListThreads"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*",
        "acs:cms:*:*:digitalemployee/*/thread/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetDigitalEmployeeSkill",
        "cms:ListDigitalEmployeeSkills",
        "cms:ListDigitalEmployeeSkillVersions"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*/skill/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetMission",
        "cms:ListMissions",
        "cms:ListTasks"
      ],
      "Resource": [
        "acs:cms:*:*:mission/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetMcpService",
        "cms:ListMcpServices",
        "cms:FetchRemoteMcpTools"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*/mcpservice/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetArtifact",
        "cms:ListArtifacts"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*/artifact/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:ListWorkspaces",
        "cms:GetWorkspace",
        "cms:GetEntityStore",
        "cms:GetEntityStoreData"
      ],
      "Resource": [
        "acs:cms:*:*:workspace/*",
        "acs:cms:*:*:entitystore/*",
        "acs:cms:*:*:entitystoredata/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetCloudResourceData"
      ],
      "Resource": [
        "acs:cms:*:*:cloudresource"
      ]
    },
    {
      "Action": [
        "log:Get*",
        "log:List*",
        "log:Query*"
      ],
      "Resource": "acs:log:*:*:*",
      "Effect": "Allow"
    }
  ]
}

Create and manage custom Digital Employees

The following policy allows RAM users to create, modify, delete, and view Digital Employees, manage skills and MCP services, sessions, long-term missions, and artifacts, and initiate conversations with Digital Employees. In the example, ram:PassRole is restricted to the service role AliyunServiceRoleForCloudMonitor by default. If the Digital Employee is bound to a custom RAM role, replace the Resource value with the corresponding RoleArn.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "starops:CreateDigitalEmployee",
        "starops:GetDigitalEmployee",
        "starops:ListDigitalEmployees",
        "starops:UpdateDigitalEmployee",
        "starops:DeleteDigitalEmployee"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:CreateArtifactUploadToken",
        "starops:GetArtifactDownloadUrl",
        "starops:CreateChat",
        "starops:CreateThread",
        "starops:GetThread",
        "starops:GetThreadData",
        "starops:ListThreads",
        "starops:UpdateThread",
        "starops:DeleteThread"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*",
        "acs:starops:*:*:digitalemployee/*/thread/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:CreateDigitalEmployeeSkill",
        "starops:GetDigitalEmployeeSkill",
        "starops:ListDigitalEmployeeSkills",
        "starops:UpdateDigitalEmployeeSkill",
        "starops:DeleteDigitalEmployeeSkill",
        "starops:ListDigitalEmployeeSkillVersions"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*/skill/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:CreateMission",
        "starops:GetMission",
        "starops:ListMissions",
        "starops:ListTasks",
        "starops:UpdateMission",
        "starops:DeleteMission"
      ],
      "Resource": [
        "acs:starops:*:*:mission/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:CreateMcpService",
        "starops:GetMcpService",
        "starops:ListMcpServices",
        "starops:UpdateMcpService",
        "starops:DeleteMcpService",
        "starops:FetchRemoteMcpTools"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*/mcpservice/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetArtifact",
        "starops:ListArtifacts"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*/artifact/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetCreditQuota",
        "starops:SetCreditQuota"
      ],
      "Resource": [
        "acs:starops:*:*:quota/credit"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:CreateDigitalEmployee",
        "cms:GetDigitalEmployee",
        "cms:ListDigitalEmployees",
        "cms:UpdateDigitalEmployee",
        "cms:DeleteDigitalEmployee"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:CreateChat",
        "cms:CreateThread",
        "cms:GetThread",
        "cms:GetThreadData",
        "cms:ListThreads",
        "cms:UpdateThread",
        "cms:DeleteThread"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*",
        "acs:cms:*:*:digitalemployee/*/thread/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:CreateDigitalEmployeeSkill",
        "cms:GetDigitalEmployeeSkill",
        "cms:ListDigitalEmployeeSkills",
        "cms:UpdateDigitalEmployeeSkill",
        "cms:DeleteDigitalEmployeeSkill",
        "cms:ListDigitalEmployeeSkillVersions"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*/skill/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:CreateMission",
        "cms:GetMission",
        "cms:ListMissions",
        "cms:ListTasks",
        "cms:UpdateMission",
        "cms:DeleteMission"
      ],
      "Resource": [
        "acs:cms:*:*:mission/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:CreateMcpService",
        "cms:GetMcpService",
        "cms:ListMcpServices",
        "cms:UpdateMcpService",
        "cms:DeleteMcpService",
        "cms:FetchRemoteMcpTools"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*/mcpservice/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetArtifact",
        "cms:ListArtifacts"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*/artifact/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:ListWorkspaces",
        "cms:GetWorkspace",
        "cms:GetEntityStore",
        "cms:GetEntityStoreData"
      ],
      "Resource": [
        "acs:cms:*:*:workspace/*",
        "acs:cms:*:*:entitystore/*",
        "acs:cms:*:*:entitystoredata/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetCloudResourceData"
      ],
      "Resource": [
        "acs:cms:*:*:cloudresource"
      ]
    },
    {
      "Action": [
        "log:Get*",
        "log:List*",
        "log:Query*"
      ],
      "Resource": "acs:log:*:*:*",
      "Effect": "Allow"
    },
    {
      "Effect": "Allow",
      "Action": "ram:PassRole",
      "Resource": "acs:ram::*:role/aliyunserviceroleforcloudmonitor",
      "Condition": {
        "StringEquals": {
          "acs:Service": [
            "operation-platform.aliyuncs.com",
            "cloudmonitor.aliyuncs.com"
          ]
        }
      }
    }
  ]
}

Conversation-only permissions

The following policy applies to scenarios where you only allow users to converse with custom Digital Employees and view their own sessions and artifacts, without the ability to create, modify, or delete Digital Employees and skills. Because conversations require the RAM role bound to the Digital Employee, ram:PassRole must also be granted.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetDigitalEmployee",
        "starops:ListDigitalEmployees"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:CreateArtifactUploadToken",
        "starops:GetArtifactDownloadUrl",
        "starops:CreateChat",
        "starops:CreateThread",
        "starops:GetThread",
        "starops:GetThreadData",
        "starops:ListThreads",
        "starops:UpdateThread"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*",
        "acs:starops:*:*:digitalemployee/*/thread/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetDigitalEmployeeSkill",
        "starops:ListDigitalEmployeeSkills",
        "starops:ListDigitalEmployeeSkillVersions"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*/skill/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:CreateMission",
        "starops:GetMission",
        "starops:ListMissions",
        "starops:ListTasks",
        "starops:UpdateMission"
      ],
      "Resource": [
        "acs:starops:*:*:mission/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetMcpService",
        "starops:ListMcpServices",
        "starops:FetchRemoteMcpTools"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*/mcpservice/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetArtifact",
        "starops:ListArtifacts"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*/artifact/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetCreditQuota"
      ],
      "Resource": [
        "acs:starops:*:*:quota/credit"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetDigitalEmployee",
        "cms:ListDigitalEmployees"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:CreateChat",
        "cms:CreateThread",
        "cms:GetThread",
        "cms:GetThreadData",
        "cms:ListThreads",
        "cms:UpdateThread"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*",
        "acs:cms:*:*:digitalemployee/*/thread/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetDigitalEmployeeSkill",
        "cms:ListDigitalEmployeeSkills",
        "cms:ListDigitalEmployeeSkillVersions"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*/skill/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:CreateMission",
        "cms:GetMission",
        "cms:ListMissions",
        "cms:ListTasks",
        "cms:UpdateMission"
      ],
      "Resource": [
        "acs:cms:*:*:mission/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetMcpService",
        "cms:ListMcpServices",
        "cms:FetchRemoteMcpTools"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*/mcpservice/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetArtifact",
        "cms:ListArtifacts"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*/artifact/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:ListWorkspaces",
        "cms:GetWorkspace",
        "cms:GetEntityStore",
        "cms:GetEntityStoreData"
      ],
      "Resource": [
        "acs:cms:*:*:workspace/*",
        "acs:cms:*:*:entitystore/*",
        "acs:cms:*:*:entitystoredata/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetCloudResourceData"
      ],
      "Resource": [
        "acs:cms:*:*:cloudresource"
      ]
    },
    {
      "Action": [
        "log:Get*",
        "log:List*",
        "log:Query*"
      ],
      "Resource": "acs:log:*:*:*",
      "Effect": "Allow"
    },
    {
      "Effect": "Allow",
      "Action": "ram:PassRole",
      "Resource": "acs:ram::*:role/aliyunserviceroleforcloudmonitor",
      "Condition": {
        "StringEquals": {
          "acs:Service": [
            "operation-platform.aliyuncs.com",
            "cloudmonitor.aliyuncs.com"
          ]
        }
      }
    }
  ]
}

Read-only permissions

The following policy applies to scenarios where you view Digital Employees, sessions, artifacts, and related diagnostic data, and allows users to initiate conversations with custom Digital Employees that are bound to a service role. If the user only performs audit reviews and does not need to initiate conversations or pass roles, you can remove the CreateChat, CreateThread, and ram:PassRole statements.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetDigitalEmployee",
        "starops:ListDigitalEmployees"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:CreateArtifactUploadToken",
        "starops:GetArtifactDownloadUrl",
        "starops:CreateChat",
        "starops:CreateThread",
        "starops:GetThread",
        "starops:GetThreadData",
        "starops:ListThreads"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*",
        "acs:starops:*:*:digitalemployee/*/thread/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetDigitalEmployeeSkill",
        "starops:ListDigitalEmployeeSkills",
        "starops:ListDigitalEmployeeSkillVersions"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*/skill/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetMission",
        "starops:ListMissions",
        "starops:ListTasks"
      ],
      "Resource": [
        "acs:starops:*:*:mission/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetMcpService",
        "starops:ListMcpServices",
        "starops:FetchRemoteMcpTools"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*/mcpservice/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetArtifact",
        "starops:ListArtifacts"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*/artifact/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetCreditQuota"
      ],
      "Resource": [
        "acs:starops:*:*:quota/credit"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetDigitalEmployee",
        "cms:ListDigitalEmployees"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:CreateChat",
        "cms:CreateThread",
        "cms:GetThread",
        "cms:GetThreadData",
        "cms:ListThreads"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*",
        "acs:cms:*:*:digitalemployee/*/thread/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetDigitalEmployeeSkill",
        "cms:ListDigitalEmployeeSkills",
        "cms:ListDigitalEmployeeSkillVersions"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*/skill/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetMission",
        "cms:ListMissions",
        "cms:ListTasks"
      ],
      "Resource": [
        "acs:cms:*:*:mission/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetMcpService",
        "cms:ListMcpServices",
        "cms:FetchRemoteMcpTools"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*/mcpservice/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetArtifact",
        "cms:ListArtifacts"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*/artifact/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:ListWorkspaces",
        "cms:GetWorkspace",
        "cms:GetEntityStore",
        "cms:GetEntityStoreData"
      ],
      "Resource": [
        "acs:cms:*:*:workspace/*",
        "acs:cms:*:*:entitystore/*",
        "acs:cms:*:*:entitystoredata/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetCloudResourceData"
      ],
      "Resource": [
        "acs:cms:*:*:cloudresource"
      ]
    },
    {
      "Action": [
        "log:Get*",
        "log:List*",
        "log:Query*"
      ],
      "Resource": "acs:log:*:*:*",
      "Effect": "Allow"
    },
    {
      "Effect": "Allow",
      "Action": "ram:PassRole",
      "Resource": "acs:ram::*:role/aliyunserviceroleforcloudmonitor",
      "Condition": {
        "StringEquals": {
          "acs:Service": [
            "operation-platform.aliyuncs.com",
            "cloudmonitor.aliyuncs.com"
          ]
        }
      }
    }
  ]
}

PassRole authorization path

When you grant ram:PassRole, first confirm the RoleArn bound to the Digital Employee, and then add the RoleArn to a RAM custom policy.

Create or edit a Digital Employee in STAROps to confirm the RAM role bound to the Digital Employee.
- If you select the service role ServiceRoleForCloudMonitor, set Resource to acs:ram::*:role/aliyunserviceroleforcloudmonitor.
- If you select a custom RAM role, set Resource to the RoleArn of that role, for example, acs:ram::*:role/starops-production-sre.
Create a custom policy in the RAM console and attach the policy to the RAM users or user groups that need to use the Digital Employee.

The following example shows the PassRole policy for the service role ServiceRoleForCloudMonitor:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ram:PassRole",
      "Resource": "acs:ram::*:role/aliyunserviceroleforcloudmonitor",
      "Condition": {
        "StringEquals": {
          "acs:Service": [
            "operation-platform.aliyuncs.com",
            "cloudmonitor.aliyuncs.com"
          ]
        }
      }
    }
  ]
}

If you use a custom RAM role, replace the Resource value with the RoleArn of the custom role.

Digital Employee access permissions (RAM role permissions)

Digital Employee access permissions are granted to RAM roles to control which data, cloud resources, and tool capabilities the Digital Employee can access at runtime. This permission layer is not granted to RAM users.

Built-in employees are not configured with customer-side RAM roles and typically inherit the current RAM user permissions at runtime. Custom Digital Employees must be bound to a RAM role. The RoleArn is the identity used by the Digital Employee to access cloud resources at runtime.

Quick configuration with service roles

When you create a custom Digital Employee, you can select Service Role as the RAM role type. If you select ServiceRoleForCloudMonitor, the Digital Employee uses the corresponding RAM role AliyunServiceRoleForCloudMonitor to access data. The RoleArn of this role is typically:

acs:ram::<account-id>:role/aliyunserviceroleforcloudmonitor

This service role is suitable for querying CloudMonitor 2.0, SLS logs, ARMS application monitoring, and other diagnostic data. It is commonly used for read-only inspections, alert analysis, and report generation. When you use a service role, you typically do not need to manually configure the role trust policy and data read permission policy. However, you still need to grant the user Digital Employee operation permissions and ram:PassRole for the service role.

This service role does not include permissions for modifying cloud service configurations or changing resource states. If the Digital Employee needs to perform cloud service updates, resource changes, or other write operations, use a custom RAM role instead and configure the corresponding cloud service permissions based on the principle of least privilege.

Use a custom RAM role

If you select a custom RAM role, you need to configure the trust policy and permission policy separately. The trust policy declares which Alibaba Cloud services can assume the role. The permission policy determines which data and resources the role can access after being assumed.

Configure the trust policy

If you select the service role ServiceRoleForCloudMonitor, you typically do not need to manually configure the trust policy. If you select a custom role, configure the following trust policy.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": [
          "operation-platform.aliyuncs.com",
          "cloudmonitor.aliyuncs.com"
        ]
      }
    }
  ]
}

Configure data access permissions

If you select the service role ServiceRoleForCloudMonitor, the role already includes data read permissions for CloudMonitor 2.0 scenarios. If you select a custom role, you can copy the following policy as a starting point for read-only data access.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "log:Get*",
        "log:List*"
      ],
      "Resource": "acs:log:*:*:*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:Get*",
        "cms:List*"
      ],
      "Resource": [
        "acs:cms:*:*:workspace/*",
        "acs:cms:*:*:cloudresource"
      ]
    }
  ]
}

Full permissions (development and testing environments)

The following policy is intended only for quick validation in development and testing environments. In production environments, grant permissions based on specific data sources, workspaces, log projects, and cloud service resource scopes. For tool calls that may cause resource changes, we recommend that you use manual confirmation, auditing, and rollback mechanisms.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "cms:*",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "arms:*",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "sls:*",
      "Resource": "*"
    }
  ]
}

Permission verification

After you complete the configuration, we recommend that you verify the permissions in the following order:

Log on to STAROps as a RAM user.
Open the Digital Employee list and verify that you can see the target Digital Employee.
If it is a custom Digital Employee, verify that the page shows the correct RoleArn.
Initiate a read-only query session, for example, querying a specific workspace or log.
If the session fails, first check the permission policy and trust policy of the RAM role.
If creating or updating a Digital Employee fails, check whether the RAM user has Digital Employee operation permissions and ram:PassRole.
Open the raw data in the corresponding console as the RAM user to verify that you have manual verification permissions.

FAQ

A RAM user can create a Digital Employee but receives an insufficient permissions error when saving a RoleArn

This error typically occurs because the RAM user lacks ram:PassRole for the target RAM role, or the Resource in the PassRole policy does not cover the RoleArn. Grant the RAM user ram:PassRole for the target role, and restrict the policy to STAROps-related services by using acs:Service.

A Digital Employee session displays an insufficient data permissions error

Check the RAM role bound to the Digital Employee instead of only checking the RAM user permissions. Custom Digital Employees use the RAM role identity to access data at runtime. The RAM role must have the required SLS, CMS, ARMS, or cloud resource permissions.

A RAM role has data permissions but the user cannot view data in the console

RAM role permissions are only granted to the Digital Employee for runtime use and are not automatically granted to the RAM user. If the user needs to verify data in the console, grant the RAM user read-only permissions for the data source separately.

Why can I not perform update operations after selecting ServiceRoleForCloudMonitor?

The AliyunServiceRoleForCloudMonitor role associated with ServiceRoleForCloudMonitor is designed for CloudMonitor 2.0 data read scenarios and is suitable for queries, diagnostics, inspections, and report generation. It does not include permissions for updating cloud service configurations or changing resource states. To perform update operations, create a custom role and grant the required write permissions.

A RAM user has data source permissions but the Digital Employee still cannot query data

Custom Digital Employees do not automatically inherit the data permissions of the RAM user. Check whether the RAM role bound to the Digital Employee has the corresponding data source permissions.

Does a read-only user need PassRole?

If the user only views Digital Employees, sessions, long-term missions, and reports, ram:PassRole is typically not required. If you use the read-only permissions template described earlier and allow the user to initiate conversations with custom Digital Employees, you need to keep ram:PassRole and restrict the Resource to the service role or a specific custom role RoleArn.

Can I set the PassRole Resource to an asterisk (*)?

Technically yes, but this is not recommended for long-term use in production environments. We recommend that you restrict the Resource to the service role or a custom role dedicated to STAROps, and use acs:Service to limit the pass-through to STAROps-related services only.