AliyunServiceRolePolicyForKMSKeyStore es la política de autorización específica para un rol vinculado al servicio. Esta política se adjunta automáticamente al rol de servicio durante su creación. Posteriormente, el rol vinculado al servicio obtiene autorización para acceder a otros servicios en la nube. El servicio correspondiente de Alibaba Cloud actualice esta política. No adjunte esta política a ninguna identidad de RAM que no sea un rol vinculado al servicio.
Detalles de la política
Tipo: política de sistema de servicio
Fecha de creación: 17 de septiembre de 2025, 10:58:54
Fecha de actualización: 05 de agosto de 2026, 13:45:35
Versión actual: v17
Contenido de la política
{
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ecs:DescribeInstances",
"ecs:InvokeCommand",
"ecs:DescribeInvocationResults",
"ecs:ListPluginStatus",
"ecs:DescribeCloudAssistantStatus"
],
"Resource": [
"acs:ecs:*:*:instance/*",
"acs:ecs:*:*:command/ACS-ECS-ExecuteLocalPlugin-for-linux.sh",
"acs:ecs:*:*:command/ACS-ECS-ExecutePlugin-for-linux.sh",
"acs:ecs:*:*:command/ACS-ECS-RemovePlugin-for-linux.sh"
]
},
{
"Action": [
"ecs:CreateNetworkInterfacePermission",
"ecs:DeleteNetworkInterfacePermission",
"ecs:CreateNetworkInterface",
"ecs:DeleteNetworkInterface",
"ecs:DescribeNetworkInterfaces",
"ecs:AttachNetworkInterface",
"ecs:DetachNetworkInterface",
"ecs:AssignPrivateIpAddresses",
"ecs:UnassignPrivateIpAddresses",
"ecs:DescribeInstanceAttribute",
"ecs:ModifyNetworkInterfaceAttribute",
"ecs:DescribeNetworkInterfaceAttribute",
"ecs:DescribeInstances",
"ecs:AssignIpv6Addresses",
"ecs:UnassignIpv6Addresses",
"ecs:DescribeSecurityGroups",
"ecs:CreateSecurityGroup",
"ecs:DeleteSecurityGroup",
"ecs:AuthorizeSecurityGroup",
"ecs:AuthorizeSecurityGroupEgress",
"ecs:RevokeSecurityGroup",
"ecs:RevokeSecurityGroupEgress",
"ecs:DescribeSecurityGroupAttribute"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"vpc:DescribeVSwitches",
"vpc:DescribeVpcs",
"vpc:AllocateEipAddress",
"vpc:AssociateEipAddress",
"vpc:ReleaseEipAddress",
"vpc:UnassociateEipAddress",
"vpc:DescribeVSwitchAttributes"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"polardb:CreateDBCluster",
"polardb:DescribeDBClusters",
"polardb:CreateDatabase",
"polardb:DescribeDatabases",
"polardb:CreateAccount",
"polardb:DescribeAccounts",
"polardb:DescribeDBClusterEndpoints"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"yundun-hsm:DescribeInstances",
"yundun-hsm:DescribeClusters",
"yundun-hsm:GetCluster",
"yundun-hsm:GetInstance",
"yundun-hsm:ListClusters",
"yundun-hsm:ListInstances",
"yundun-hsm:GetJob",
"yundun-hsm:GetImage",
"yundun-hsm:DownloadClusterManagedCert"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"oss:GetObject",
"oss:PutObject"
],
"Resource": "acs:oss:*:*:*/AliyunDkmsLogs/*",
"Effect": "Allow"
},
{
"Action": [
"oss:GetBucketInfo"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": "pvtz:DescribeUserServiceStatus",
"Resource": "*",
"Effect": "Allow"
},
{
"Action": "bssapi:CreateInstance",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"bssapi:ProductCode": "pvtz",
"bssapi:ProductType": [
"pvtzpost"
]
}
}
},
{
"Action": [
"log:CreateProject",
"log:DeleteProject",
"log:GetProject",
"log:ListProject",
"log:ListLogStores",
"log:GetLogStore",
"log:CreateIndex",
"log:UpdateIndex",
"log:GetIndex",
"log:CreateDashboard",
"log:UpdateDashboard",
"log:ListDashboard",
"log:CreateLogStore",
"log:DeleteLogStore",
"log:UpdateLogStore",
"log:CreateSavedSearch",
"log:UpdateSavedSearch",
"log:ClearLogStoreStorage",
"log:OpenProductDataCollection",
"log:CloseProductDataCollection",
"log:GetProductDataCollection"
],
"Resource": [
"acs:log:*:*:project/kms-log-*",
"acs:kms:*:*:*"
],
"Effect": "Allow"
},
{
"Action": [
"log:DescribeService",
"log:EnableService"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"privatelink:ListVpcEndpointServiceUsers",
"privatelink:GetVpcEndpointServiceAttribute"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Effect": "Allow",
"Action": [
"eiam:CreateInstance",
"eiam:DeleteInstance",
"eiam:GetInstance",
"eiam:ListInstances",
"eiam:CreateApplication",
"eiam:DeleteApplication",
"eiam:SetApplicationResourceServerIdentifier",
"eiam:EnableApplicationResourceServer",
"eiam:CreateResourceServerScope",
"eiam:AuthorizeResourceServerToClient",
"eiam:AuthorizeResourceServerScopesToClient",
"eiam:CreateFederatedCredentialProvider",
"eiam:DisableFederatedCredentialProvider",
"eiam:GetAuthorizationServer",
"eiam:DeleteFederatedCredentialProvider",
"eiam:CreateApplicationFederatedCredential",
"eiam:UpdateApplicationFederatedCredential",
"eiam:DeleteApplicationFederatedCredential",
"eiam:ListAuthorizationServerCredentials"
],
"Resource": "*"
},
{
"Action": "ram:CreateServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": [
"securitylens.log.aliyuncs.com"
]
}
}
},
{
"Action": "ram:DeleteServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": "keystore.kms.aliyuncs.com"
}
}
},
{
"Action": "ram:CreateServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": [
"middlewarelens.log.aliyuncs.com",
"ai-lens.log.aliyuncs.com",
"storagelens.log.aliyuncs.com"
]
}
}
}
]
}