AliyunCloudMonitorFullAccess otorga acceso total a Cloud Monitor desde la consola de administración. Asigne esta directiva a un usuario, grupo de usuarios o rol de RAM para concederle todos los permisos de Cloud Monitor a dicha identidad.
Detalles de la directiva
Tipo: directiva de sistema de servicio
Fecha de creación: 27 de enero de 2016 a las 02:50:27
Fecha de actualización: 18 de mayo de 2026 a las 08:49:19
Versión actual: v22 (versión activa; es la que RAM evalúa en las solicitudes de las identidades asociadas)
Contenido de la directiva
Esta directiva concede permisos en varios servicios. A continuación se resume cada grupo de permisos.
|
Servicio |
Acciones concedidas |
Efecto |
|
Cloud Monitor (cms) |
Todas las acciones |
Allow |
|
Application Real-Time Monitoring Service (arms) |
Todas las acciones |
Allow |
|
Starops |
Todas las acciones, además de |
Allow |
|
ECS, RDS, SLB, VPC, OSS, Log Service, CDN, MNS, ESS, OCS, KVStore, HBase, HiTSDB, DDS, PetaData, GPDB, EMR, OpenSearch, Elasticsearch, MongoDB, API Gateway, DDoS, Live, CEN, Kafka, SCDN, DCDN, PolarDB, Container Service, Resource Manager, Tag |
Acciones Describe/List de solo lectura para descubrir recursos |
Allow |
|
Quotas |
|
Allow |
|
RAM |
|
Allow |
|
Log Service (logstores de Prometheus) |
|
Allow |
|
Log Service (logstores de puerta de enlace de Prometheus) |
|
Allow |
{
"Version": "1",
"Statement": [
{
"Action": "cms:*",
"Resource": "*",
"Effect": "Allow"
},
{
"Action": "arms:*",
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"ecs:DescribeInstances",
"rds:DescribeDBInstances",
"slb:DescribeLoadBalancer*",
"vpc:DescribeEipAddresses",
"vpc:DescribeRouterInterfaces",
"vpc:DescribeGlobalAccelerationInstances",
"vpc:DescribeVpnGateways",
"vpc:DescribeNatGateways",
"vpc:DescribeBandwidthPackages",
"vpc:DescribeCommonBandwidthPackages",
"oss:ListBuckets",
"log:ListProject",
"log:EnableService",
"log:GetMLServiceResults",
"cdn:DescribeUserDomains",
"mns:ListQueue",
"mns:ListTopic",
"ess:DescribeScalingGroups",
"ocs:DescribeInstances",
"kvstore:DescribeInstances",
"kvstore:DescribeLogicInstanceTopology",
"hbase:DescribeClusterList",
"hitsdb:DescribeHiTSDBInstanceList",
"dds:DescribeDBInstances",
"petadata:DescribeInstances",
"petadata:DescribeDatabases",
"gpdb:DescribeDBInstances",
"emr:ListClusters",
"opensearch:ListApps",
"elasticsearch:ListInstance",
"mongodb:DescribeDBInstances",
"rds:DescribeReplicas",
"CloudAPI:DescribeApis",
"netgateway:DescribeNatGateways",
"ddos:DescribeInstancePage",
"live:DescribeLiveUserDomains",
"cen:DescribeCens",
"cen:DescribeCenAttachedChildInstances",
"kafka:GetKafkaInstanceList",
"scdn:DescribeScdnUserDomains",
"dcdn:DescribeDcdnUserDomains",
"polardb:DescribeDBInstances",
"polardb:DescribeRegions",
"polardb:DescribeDBClusters",
"cs:DescribeClusters",
"resourcemanager:GetAccount",
"resourcemanager:ListAccountsForParent",
"resourcemanager:ListAccounts",
"resourcemanager:GetFolder",
"resourcemanager:ListFoldersForParent",
"resourcemanager:ListAncestors",
"resourcemanager:GetResourceDirectory",
"tag:ListTagKeys",
"tag:ListTagValues"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"quotas:ListProductQuotas",
"quotas:GetProductQuota",
"quotas:ListProducts",
"quotas:ListProductQuotaDimensions",
"quotas:ListProductDimensionGroups"
],
"Resource": "acs:quotas:*:*:*",
"Effect": "Allow"
},
{
"Action": "ram:CreateServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": [
"cloudmonitor.aliyuncs.com",
"audit.log.aliyuncs.com"
]
}
}
},
{
"Action": [
"log:GetLogStoreLogs",
"log:GetLogStoreHistogram",
"log:QueryPrometheusMetrics",
"log:PostLogStoreLogs",
"log:RemoteWritePrometheus"
],
"Resource": [
"acs:log:*:*:project/*/logstore/aliyun-prom-*",
"acs:log:*:*:project/*/storeview/aliyun_prom_*",
"acs:log:*:*:project/proj-xtrace-*/logstore/*"
],
"Effect": "Allow"
},
{
"Action": [
"log:PostLogStoreLogs",
"log:RemoteWritePrometheus"
],
"Resource": [
"acs:log:*:*:project/prom-*/logstore/*-gateway"
],
"Effect": "Allow"
},
{
"Effect": "Allow",
"Action": [
"starops:CreateChat",
"starops:CreateThread"
],
"Resource": "acs:starops:*:*:digitalemployee/apsara-*"
},
{
"Action": "starops:*",
"Resource": "*",
"Effect": "Allow"
},
{
"Action": "ram:CreateServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": [
"operation-platform.aliyuncs.com"
]
}
}
}
]
}