Mission permission configuration - STAROps - Alibaba Cloud Documentation Center

This topic describes the permission configuration methods for STAROps Long-Term Missions.

RAM users are responsible for creating and managing Long-Term Missions, and custom Digital Employees are responsible for asynchronously running tasks. The data a task can access and the actions it can perform depend on the RAM role bound to the Digital Employee.

Target audience

This topic applies to administrators who need to configure Long-Term Mission permissions for RAM users. Alibaba Cloud accounts (primary accounts) have Long-Term Mission management permissions by default and do not require additional configuration.

Permission model

Long-Term Missions are used for periodic inspections, alert analysis, report generation, and other asynchronous scenarios. Users are responsible for creating and managing Long-Term Missions, and Digital Employees are responsible for running them.

Long-Term Missions do not support built-in employees. Only custom Digital Employees are supported. This is because Long-Term Missions continue to run after the user leaves the current session. Asynchronous execution requires a stable runtime identity, which is the RAM role bound to the custom Digital Employee.

When you configure Long-Term Missions, you only need to address three things:

Whether the RAM user has operation permissions for Long-Term Missions, sessions, and artifacts.
Whether the RAM user has ram:PassRole permission for the selected Digital Employee's RAM role.
Whether the RAM role bound to the Digital Employee has the data access or resource operation permissions required for task execution.

Long-Term Missions do not expand Digital Employee permissions. The data a task can access and the actions it can perform still depend on the RAM role bound to the selected Digital Employee.

RAM policy examples

The following policies can be directly copied to RAM custom permission policies. The examples follow the online help documentation configuration for easy copying. In production environments, we recommend that you restrict the scope based on tasks, custom Digital Employees, sessions, and artifacts. If a policy contains ram:PassRole with Resource set to *, we recommend that you replace it with the service role or custom role ARN used by the Long-Term Mission's Digital Employee.

Full management permissions

Grant the RAM user full management permissions for Long-Term Missions, including creating, viewing, modifying, and deleting Long-Term Missions, and viewing issues and artifacts.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "starops:CreateDigitalEmployee",
        "starops:GetDigitalEmployee",
        "starops:ListDigitalEmployees",
        "starops:UpdateDigitalEmployee",
        "starops:DeleteDigitalEmployee"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:CreateArtifactUploadToken",
        "starops:GetArtifactDownloadUrl",
        "starops:CreateChat",
        "starops:CreateThread",
        "starops:GetThread",
        "starops:GetThreadData",
        "starops:ListThreads",
        "starops:UpdateThread",
        "starops:DeleteThread"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*",
        "acs:starops:*:*:digitalemployee/*/thread/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:CreateDigitalEmployeeSkill",
        "starops:GetDigitalEmployeeSkill",
        "starops:ListDigitalEmployeeSkills",
        "starops:UpdateDigitalEmployeeSkill",
        "starops:DeleteDigitalEmployeeSkill",
        "starops:ListDigitalEmployeeSkillVersions"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*/skill/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:CreateMission",
        "starops:GetMission",
        "starops:ListMissions",
        "starops:ListTasks",
        "starops:UpdateMission",
        "starops:DeleteMission"
      ],
      "Resource": [
        "acs:starops:*:*:mission/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:CreateMcpService",
        "starops:GetMcpService",
        "starops:ListMcpServices",
        "starops:UpdateMcpService",
        "starops:DeleteMcpService",
        "starops:FetchRemoteMcpTools"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*/mcpservice/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetArtifact",
        "starops:ListArtifacts"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*/artifact/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetCreditQuota",
        "starops:SetCreditQuota"
      ],
      "Resource": [
        "acs:starops:*:*:quota/credit"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:CreateDigitalEmployee",
        "cms:GetDigitalEmployee",
        "cms:ListDigitalEmployees",
        "cms:UpdateDigitalEmployee",
        "cms:DeleteDigitalEmployee"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:CreateChat",
        "cms:CreateThread",
        "cms:GetThread",
        "cms:GetThreadData",
        "cms:ListThreads",
        "cms:UpdateThread",
        "cms:DeleteThread"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*",
        "acs:cms:*:*:digitalemployee/*/thread/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:CreateDigitalEmployeeSkill",
        "cms:GetDigitalEmployeeSkill",
        "cms:ListDigitalEmployeeSkills",
        "cms:UpdateDigitalEmployeeSkill",
        "cms:DeleteDigitalEmployeeSkill",
        "cms:ListDigitalEmployeeSkillVersions"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*/skill/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:CreateMission",
        "cms:GetMission",
        "cms:ListMissions",
        "cms:ListTasks",
        "cms:UpdateMission",
        "cms:DeleteMission"
      ],
      "Resource": [
        "acs:cms:*:*:mission/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:CreateMcpService",
        "cms:GetMcpService",
        "cms:ListMcpServices",
        "cms:UpdateMcpService",
        "cms:DeleteMcpService",
        "cms:FetchRemoteMcpTools"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*/mcpservice/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetArtifact",
        "cms:ListArtifacts"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*/artifact/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:ListWorkspaces",
        "cms:GetWorkspace",
        "cms:GetEntityStore",
        "cms:GetEntityStoreData"
      ],
      "Resource": [
        "acs:cms:*:*:workspace/*",
        "acs:cms:*:*:entitystore/*",
        "acs:cms:*:*:entitystoredata/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetCloudResourceData"
      ],
      "Resource": [
        "acs:cms:*:*:cloudresource"
      ]
    },
    {
      "Action": [
        "log:Get*",
        "log:List*",
        "log:Query*"
      ],
      "Resource": "acs:log:*:*:*",
      "Effect": "Allow"
    },
    {
      "Effect": "Allow",
      "Action": "ram:PassRole",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "acs:Service": "operation-platform.aliyuncs.com"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": "ram:PassRole",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "acs:Service": "cloudmonitor.aliyuncs.com"
        }
      }
    }
  ]
}

Read-only permissions

Grant the RAM user read-only permissions for Long-Term Missions, allowing only viewing of the task list, details, issues, and artifacts, without permission to create, modify, or delete Long-Term Missions.

The online read-only template includes session and ram:PassRole configurations. If the user only performs audit viewing without initiating sessions or passing roles, you can remove the CreateChat, CreateThread, and ram:PassRole related statements.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetDigitalEmployee",
        "starops:ListDigitalEmployees"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:CreateArtifactUploadToken",
        "starops:GetArtifactDownloadUrl",
        "starops:CreateChat",
        "starops:CreateThread",
        "starops:GetThread",
        "starops:GetThreadData",
        "starops:ListThreads"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*",
        "acs:starops:*:*:digitalemployee/*/thread/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetDigitalEmployeeSkill",
        "starops:ListDigitalEmployeeSkills",
        "starops:ListDigitalEmployeeSkillVersions"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*/skill/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetMission",
        "starops:ListMissions",
        "starops:ListTasks"
      ],
      "Resource": [
        "acs:starops:*:*:mission/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetMcpService",
        "starops:ListMcpServices",
        "starops:FetchRemoteMcpTools"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*/mcpservice/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetArtifact",
        "starops:ListArtifacts"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*/artifact/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetCreditQuota"
      ],
      "Resource": [
        "acs:starops:*:*:quota/credit"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetDigitalEmployee",
        "cms:ListDigitalEmployees"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:CreateChat",
        "cms:CreateThread",
        "cms:GetThread",
        "cms:GetThreadData",
        "cms:ListThreads"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*",
        "acs:cms:*:*:digitalemployee/*/thread/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetDigitalEmployeeSkill",
        "cms:ListDigitalEmployeeSkills",
        "cms:ListDigitalEmployeeSkillVersions"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*/skill/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetMission",
        "cms:ListMissions",
        "cms:ListTasks"
      ],
      "Resource": [
        "acs:cms:*:*:mission/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetMcpService",
        "cms:ListMcpServices",
        "cms:FetchRemoteMcpTools"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*/mcpservice/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetArtifact",
        "cms:ListArtifacts"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*/artifact/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:ListWorkspaces",
        "cms:GetWorkspace",
        "cms:GetEntityStore",
        "cms:GetEntityStoreData"
      ],
      "Resource": [
        "acs:cms:*:*:workspace/*",
        "acs:cms:*:*:entitystore/*",
        "acs:cms:*:*:entitystoredata/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetCloudResourceData"
      ],
      "Resource": [
        "acs:cms:*:*:cloudresource"
      ]
    },
    {
      "Action": [
        "log:Get*",
        "log:List*",
        "log:Query*"
      ],
      "Resource": "acs:log:*:*:*",
      "Effect": "Allow"
    },
    {
      "Effect": "Allow",
      "Action": "ram:PassRole",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "acs:Service": "operation-platform.aliyuncs.com"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": "ram:PassRole",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "acs:Service": "cloudmonitor.aliyuncs.com"
        }
      }
    }
  ]
}

Digital Employee + Long-Term Mission combined permissions

Grant the RAM user full operation permissions for both Digital Employees and Long-Term Missions. This policy is suitable for O&M administrators who need to manage custom Digital Employees and Long-Term Missions simultaneously.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "starops:CreateDigitalEmployee",
        "starops:GetDigitalEmployee",
        "starops:ListDigitalEmployees",
        "starops:UpdateDigitalEmployee",
        "starops:DeleteDigitalEmployee"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:CreateArtifactUploadToken",
        "starops:GetArtifactDownloadUrl",
        "starops:CreateChat",
        "starops:CreateThread",
        "starops:GetThread",
        "starops:GetThreadData",
        "starops:ListThreads",
        "starops:UpdateThread",
        "starops:DeleteThread"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*",
        "acs:starops:*:*:digitalemployee/*/thread/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:CreateDigitalEmployeeSkill",
        "starops:GetDigitalEmployeeSkill",
        "starops:ListDigitalEmployeeSkills",
        "starops:UpdateDigitalEmployeeSkill",
        "starops:DeleteDigitalEmployeeSkill",
        "starops:ListDigitalEmployeeSkillVersions"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*/skill/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:CreateMission",
        "starops:GetMission",
        "starops:ListMissions",
        "starops:ListTasks",
        "starops:UpdateMission",
        "starops:DeleteMission"
      ],
      "Resource": [
        "acs:starops:*:*:mission/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:CreateMcpService",
        "starops:GetMcpService",
        "starops:ListMcpServices",
        "starops:UpdateMcpService",
        "starops:DeleteMcpService",
        "starops:FetchRemoteMcpTools"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*/mcpservice/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetArtifact",
        "starops:ListArtifacts"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*/artifact/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetCreditQuota",
        "starops:SetCreditQuota"
      ],
      "Resource": [
        "acs:starops:*:*:quota/credit"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:CreateDigitalEmployee",
        "cms:GetDigitalEmployee",
        "cms:ListDigitalEmployees",
        "cms:UpdateDigitalEmployee",
        "cms:DeleteDigitalEmployee"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:CreateChat",
        "cms:CreateThread",
        "cms:GetThread",
        "cms:GetThreadData",
        "cms:ListThreads",
        "cms:UpdateThread",
        "cms:DeleteThread"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*",
        "acs:cms:*:*:digitalemployee/*/thread/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:CreateDigitalEmployeeSkill",
        "cms:GetDigitalEmployeeSkill",
        "cms:ListDigitalEmployeeSkills",
        "cms:UpdateDigitalEmployeeSkill",
        "cms:DeleteDigitalEmployeeSkill",
        "cms:ListDigitalEmployeeSkillVersions"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*/skill/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:CreateMission",
        "cms:GetMission",
        "cms:ListMissions",
        "cms:ListTasks",
        "cms:UpdateMission",
        "cms:DeleteMission"
      ],
      "Resource": [
        "acs:cms:*:*:mission/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:CreateMcpService",
        "cms:GetMcpService",
        "cms:ListMcpServices",
        "cms:UpdateMcpService",
        "cms:DeleteMcpService",
        "cms:FetchRemoteMcpTools"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*/mcpservice/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetArtifact",
        "cms:ListArtifacts"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*/artifact/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:ListWorkspaces",
        "cms:GetWorkspace",
        "cms:GetEntityStore",
        "cms:GetEntityStoreData"
      ],
      "Resource": [
        "acs:cms:*:*:workspace/*",
        "acs:cms:*:*:entitystore/*",
        "acs:cms:*:*:entitystoredata/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetCloudResourceData"
      ],
      "Resource": [
        "acs:cms:*:*:cloudresource"
      ]
    },
    {
      "Action": [
        "log:Get*",
        "log:List*",
        "log:Query*"
      ],
      "Resource": "acs:log:*:*:*",
      "Effect": "Allow"
    },
    {
      "Effect": "Allow",
      "Action": "ram:PassRole",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "acs:Service": "operation-platform.aliyuncs.com"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": "ram:PassRole",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "acs:Service": "cloudmonitor.aliyuncs.com"
        }
      }
    }
  ]
}

Permission verification

After the configuration is complete, verify in the following order:

Whether the RAM user can access the Long-Term Mission page.
Whether the RAM user can view the task list and task details.
Whether the RAM user can create a test Long-Term Mission.
Whether the RAM user can select the target custom Digital Employee.
Whether the selected custom Digital Employee has a bound RAM role.
Whether a PassRole-related error occurs when creating or running a task.
Whether the task can read the target workspace, logs, or cloud resource data.
Whether the RAM user can view reports and artifacts after the task finishes.
If manual verification is required, whether the RAM user can view the raw data in the corresponding console.

FAQ

Can create a mission but execution fails

Mission creation permission only means the user can create a Long-Term Mission. Execution failure is usually related to the runtime permissions of the custom Digital Employee. Check whether the task has selected a custom Digital Employee, and whether the RAM role bound to that employee has the required data and resource permissions.

Can view tasks but cannot see reports

Check whether the RAM user has Get/List permissions for reports and artifacts. Long-Term Missions, sessions, and reports are different STAROps resources. Being able to view tasks does not mean being able to view reports.

Task can run but cannot query logs

Check whether the custom Digital Employee executing the task has SLS query permissions. Long-Term Missions use the RAM role bound to the custom Digital Employee at runtime. That RAM role must have the corresponding log permissions.

Why can't I select a built-in employee to create a Long-Term Mission

Built-in employees do not have customer-configurable RAM roles and are only suitable for synchronous sessions initiated by the current user. Long-Term Missions require asynchronous execution, which requires a stable runtime identity. Therefore, only custom Digital Employees with bound RAM roles can be selected.

PassRole error when creating a task with a custom Digital Employee

Check whether the RAM user has ram:PassRole permission for the RAM role bound to that Digital Employee. We recommend that you specify the Resource to the target RoleArn and restrict it to STAROps-related services through acs:Service.

Can read-only users create Long-Term Missions

No. Read-only users should only have permissions for Mission Get/List, task status viewing, and report viewing. They should not be granted Mission Create/Update/Delete or ram:PassRole.