AliyunCISDefaultRolePolicy es la política de autorización dedicada a un service role. En la mayoría de los casos, cuando se crea un service role, esta política se adjunta al service role. De este modo, el service role obtiene autorización para acceder a otros servicios en la nube. El servicio correspondiente de Alibaba Cloud actualice esta política. No adjunte esta política a ninguna identidad de RAM que no sea un service role.
Detalles de la política
Tipo: política de sistema de servicio
Fecha de creación: 18 de octubre de 2024 a las 11:13:15
Fecha de actualización: 08 de septiembre de 2026 a las 19:36:29
Versión actual: v16
Contenido de la política
{
"Version": "1",
"Statement": [
{
"Action": [
"ecs:DescribeInstances",
"ecs:DescribeInstanceStatus",
"ecs:DescribeInstanceTypes",
"ecs:DescribeInstanceTypeFamilies",
"ecs:DescribeInstanceAttribute",
"ecs:DescribeDiagnosticReports",
"ecs:DescribeDiagnosticReportAttributes",
"ecs:DescribeDiagnosticMetricSets",
"ecs:DescribeDiagnosticMetrics",
"ecs:DescribeSecurityGroupAttribute",
"ecs:DescribeSecurityGroups",
"ecs:DescribeSecurityGroupReferences",
"ecs:DescribeBandwidthLimitation",
"ecs:DescribeCloudAssistantStatus",
"ecs:DescribeCommands",
"ecs:DescribeInvocationResults",
"ecs:CreateCommand",
"ecs:InvokeCommand",
"ecs:StopInvocation",
"ecs:CreateDiagnosticReport",
"ecs:DescribeNetworkInterfaces",
"ecs:DescribeDisks",
"ecs:DescribeDeploymentSets",
"ecs:DescribeCapacityReservations",
"ecs:RunCommand"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"vpc:DescribeVpcs",
"vpc:DescribeVpcAttribute",
"vpc:DescribeVSwitches",
"vpc:DescribeVSwitchAttributes",
"vpc:DescribeRouteTableList",
"vpc:DescribeRouteEntryList",
"vpc:DescribeNatGateways",
"vpc:DescribeRouteTables",
"vpc:DescribeSnatTableEntries",
"vpc:DescribeNetworkAcls",
"vpc:DescribeNetworkAclAttributes",
"vpc:DescribeEipAddresses"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"sls:GetLogStore"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"oss:GetBucketInfo"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"slb:DescribeLoadBalancers",
"slb:DescribeLoadBalancerAttribute",
"slb:DescribeVServerGroups",
"slb:DescribeVServerGroupAttribute",
"slb:DescribeLoadBalancerTCPListenerAttribute",
"slb:DescribeLoadBalancerUDPListenerAttribute",
"slb:DescribeAccessControlLists",
"slb:DescribeAccessControlListAttribute",
"slb:DescribeLoadBalancerListeners",
"slb:DescribeHealthStatus"
],
"Resource": [
"*"
],
"Effect": "Allow"
},
{
"Action": [
"grace:GetFile",
"grace:AnalyzeFile",
"grace:UploadFileByOSS",
"grace:UploadFileByURL"
],
"Resource": "acs:grace:*:*:*",
"Effect": "Allow"
},
{
"Effect": "Allow",
"Action": "arms:GetPrometheusInstance",
"Resource": "*"
},
{
"Action": [
"ram:GetRole",
"ram:ListPoliciesForRole"
],
"Resource": [
"acs:ram:*:*:role/kubernetesworkerrole*",
"acs:ram:*:*:role/aliyuncsmanagedautoscalerrole",
"acs:ram:*:*:role/aliyunooslifecyclehook4csrole"
],
"Effect": "Allow"
},
{
"Action": [
"cms:DescribeMetricData",
"cms:DescribeMetricLast",
"cms:DescribeMetricMetaList",
"cms:DescribeMetricTop",
"cms:QueryMetricMeta",
"cms:QueryMetricTop",
"cms:ListMetricMeta",
"cms:ListMetricMetaProject",
"cms:QueryMetricData",
"cms:QueryMetricLast",
"cms:DescribeMetricList",
"cms:QueryMetricList",
"cms:MetricMeta",
"cms:DescribeAlertLogList",
"cms:DescribeSystemEventAttribute",
"cms:GetMetricStreamMeta"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"eflo:DescribeNode",
"eflo:RunCommand",
"eflo:DescribeInvocations"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"eci:DescribeContainerGroups",
"eci:RunCommand",
"eci:DescribeCommandResult",
"eci:ListUsage"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"ess:DescribeScalingGroups",
"ess:DescribeScalingInstances",
"ess:DescribeScalingActivities",
"ess:DescribeScalingConfigurations",
"ess:DescribeScalingRules",
"ess:DescribeScheduledTasks",
"ess:DescribeLifecycleHooks",
"ess:DescribeNotificationConfigurations",
"ess:DescribeNotificationTypes",
"ess:DescribeRegions",
"ess:DescribeDiagnoseReports",
"ess:CreateDiagnoseReport",
"ess:DescribeElasticStrength",
"ess:DescribeScalingGroupDetail",
"ess:DescribePatternTypes"
],
"Resource": [
"*"
],
"Effect": "Allow"
},
{
"Action": [
"cs:DescribeClusterDetail",
"cs:DescribeClusterResources",
"cs:DescribeTasks",
"cs:DescribeTaskInfo",
"cs:DescribeClusterNodePools",
"cs:DescribeNodePoolVuls",
"cs:DescribeKubernetesVersionMetadata",
"cs:DescribeClusterNodes",
"cs:ListClusterAddonInstances",
"cs:DescribeAddon",
"cs:DescribeClusterNodePoolDetail",
"cs:DescribeClusterAddonsUpgradeStatus"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"slb:ListTagResources"
],
"Resource": [
"*"
],
"Effect": "Allow"
},
{
"Effect": "Allow",
"Action": [
"nlb:ListLoadBalancers",
"nlb:GetLoadBalancerAttribute",
"nlb:ListListeners",
"nlb:GetListenerAttribute",
"nlb:GetListenerHealthStatus",
"nlb:ListServerGroups",
"nlb:ListServerGroupServers"
],
"Resource": "*"
},
{
"Action": [
"quotas:ListProducts",
"quotas:ListProductQuotas",
"quotas:ListProductQuotas",
"quotas:ListProductQuotaDimensions",
"quotas:GetProductQuota",
"quotas:GetProductQuotaDimension"
],
"Resource": "acs:quotas:*:*:*",
"Effect": "Allow"
},
{
"Effect": "Allow",
"Action": [
"sysom:GetAIQueryResult",
"sysom:InitialSysom"
],
"Resource": "*"
},
{
"Action": "ram:CreateServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": [
"selfservice.ecs.aliyuncs.com",
"sysom.aliyuncs.com"
]
}
}
}
]
}