All Products
Search

This Product

    Compute Nest:Izin O&M yang dihosting

    Document Center

    Compute Nest:Izin O&M yang dihosting

    Last Updated:Apr 26, 2026

    Saat membuat layanan O&M yang dihosting, Anda harus menetapkan kebijakan izin. Setelah pengguna membuat instans layanan, Compute Nest membuat kebijakan izin yang sesuai untuk pengguna tersebut dan dipercayai oleh akun pengguna. Compute Nest kemudian memberikan izin yang diperlukan kepada Anda atas resource dalam instans layanan tersebut sehingga Anda dapat melakukan operasi O&M yang dihosting pada resource tersebut.

    Cakupan resource

    1. Untuk layanan deployment privat dengan O&M yang dihosting diaktifkan, izin hanya berlaku untuk resource dalam instans layanan yang dideploy oleh pengguna.

    2. Untuk layanan O&M yang dihosting murni, izin hanya berlaku untuk resource dalam instans ECS atau instans layanan Compute Nest yang ditentukan pengguna. Anda dapat melihat resource yang diotorisasi pada halaman detail instans layanan. Pilih tab Resources untuk melihat daftar resource dengan kolom seperti Resource ID, Product, Resource type, Status, Availability zone, dan Public IP.

    Batasan izin

    Izin O&M yang dihosting dibatasi oleh kebijakan sistem AliyunComputeNestPolicyForSupplierRole, yang mencakup seluruh izin yang tersedia. Izin efektif untuk layanan tertentu merupakan irisan antara himpunan lengkap ini dan kebijakan izin yang Anda pilih.

    AliyunComputeNestPolicyForSupplierRole

    {
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "ecs:StartInstance",
                "ecs:DescribeInstances",
                "ecs:RebootInstance",
                "ecs:StopInstance",
                "ecs:RunCommand",
                "ecs:DescribeInvocations",
                "ecs:DescribeInvocationResults",
                "ecs:StartTerminalSession",
                "ecs:DescribeTerminalSessions",
                "ecs:CloseTerminalSession",
                "ecs:DescribeInstanceHistoryEvents",
                "ecs:DescribeDiagnosticReports",
                "ecs:CreateDiagnosticReport",
                "ecs:DescribeSecurityGroups",
                "ecs:DescribeDisks",
                "ecs:DescribeImages",
                "cms:DescribeMetricData",
                "cms:DescribeMetricList",
                "cms:QueryMetricList",
                "cms:DescribeMetricRuleList",
                "cms:DescribeAlertHistoryList",
                "cms:DescribeAlertLogList",
                "cms:DescribeLogHistogram",
                "cms:DescribeLogCount",
                "cms:DescribeDynamicTagRuleList",
                "cms:DescribeMonitorGroups",
                "tag:ListTagResources",
                "vpc:DescribeVpcs",
                "vpc:DescribeVSwitches",
                "vpc:DescribeVSwitchAttributes",
                "vpc:DescribeVpcAttribute",
                "vpc:DescribeRouteEntryList",
                "vpc:DescribeRouteTableList",
                "vpc:DescribeRouteTables",
                "vpc:DescribeRouterInterfaces",
                "vpc:DescribeRouterInterfaceAttribute",
                "slb:DescribeLoadBalancers",
                "slb:DescribeLoadBalancerListeners",
                "slb:DescribeLoadBalancerAttribute",
                "slb:DescribeVServerGroups",
                "rds:DescribeDBInstances",
                "rds:DescribeDBInstanceAttribute",
                "rds:RestartDBInstance",
                "actiontrail:LookupEvents"
            ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

    Kebijakan izin O&M yang dihosting

    Saat mengonfigurasi layanan, Anda dapat memilih salah satu kebijakan izin berikut:

    Name

    Policy

    Description

    All permissions

    AliyunComputeNestPolicyForFullAccess

    Memberikan izin penuh atas resource Alibaba Cloud dalam instans ECS atau instans layanan Compute Nest yang ditentukan.

    Read-only permissions

    AliyunComputeNestPolicyForReadOnly

    Memberikan izin read-only atas resource Alibaba Cloud dalam instans ECS atau instans layanan Compute Nest yang ditentukan, termasuk akses ke log audit ActionTrail untuk resource tersebut.

    Remote connection permissions

    AliyunComputeNestPolicyForTerminalLogin

    Memberikan izin koneksi jarak jauh ke instans ECS yang ditentukan, atau ke instans dalam instans layanan Compute Nest yang ditentukan.

    Operation audit permissions

    AliyunComputeNestPolicyForTrails

    Memberikan izin untuk melihat log audit ActionTrail untuk resource Alibaba Cloud dalam instans ECS atau instans layanan Compute Nest yang ditentukan.

    Monitoring permissions

    AliyunComputeNestPolicyForAlarm

    Memberikan izin untuk mengelola aturan alert berbasis ambang batas dan berbasis event untuk resource Alibaba Cloud dalam instans ECS atau instans layanan Compute Nest yang ditentukan.

    Upgrade permissions

    AliyunComputeNestPolicyForUpgrade

    Memberikan izin untuk melakukan upgrade dan rollback aplikasi serta konfigurasi layanan dalam instans layanan Compute Nest yang ditentukan.

    Operation permissions

    AliyunComputeNestPolicyForOperation

    Memberikan izin untuk melakukan operasi O&M pada instans layanan yang ditentukan.

    Kebijakan izin ini merupakan kebijakan Resource Access Management (RAM). Untuk informasi lebih lanjut tentang elemen kebijakan, lihat Elemen kebijakan.

    AliyunComputeNestPolicyForFullAccess

    All permissions

    Kebijakan izin O&M yang dihosting

    {
  "Action": [
    "*"
  ],
  "Effect": "Allow",
  "Resource": [
    "*"
  ]
}

    Izin efektif

    {
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "ecs:StartInstance",
                "ecs:DescribeInstances",
                "ecs:RebootInstance",
                "ecs:StopInstance",
                "ecs:RunCommand",
                "ecs:DescribeInvocations",
                "ecs:DescribeInvocationResults",
                "ecs:StartTerminalSession",
                "ecs:DescribeTerminalSessions",
                "ecs:CloseTerminalSession",
                "ecs:DescribeInstanceHistoryEvents",
                "ecs:DescribeDiagnosticReports",
                "ecs:CreateDiagnosticReport",
                "ecs:DescribeSecurityGroups",
                "ecs:DescribeDisks",
                "ecs:DescribeImages",
                "cms:DescribeMetricData",
                "cms:DescribeMetricList",
                "cms:QueryMetricList",
                "cms:DescribeMetricRuleList",
                "cms:DescribeAlertHistoryList",
                "cms:DescribeAlertLogList",
                "cms:DescribeLogHistogram",
                "cms:DescribeLogCount",
                "cms:DescribeDynamicTagRuleList",
                "cms:DescribeMonitorGroups",
                "tag:ListTagResources",
                "vpc:DescribeVpcs",
                "vpc:DescribeVSwitches",
                "vpc:DescribeVSwitchAttributes",
                "vpc:DescribeVpcAttribute",
                "vpc:DescribeRouteEntryList",
                "vpc:DescribeRouteTableList",
                "vpc:DescribeRouteTables",
                "vpc:DescribeRouterInterfaces",
                "vpc:DescribeRouterInterfaceAttribute",
                "slb:DescribeLoadBalancers",
                "slb:DescribeLoadBalancerListeners",
                "slb:DescribeLoadBalancerAttribute",
                "slb:DescribeVServerGroups",
                "rds:DescribeDBInstances",
                "rds:DescribeDBInstanceAttribute",
                "rds:RestartDBInstance",
                "actiontrail:LookupEvents"
            ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

    AliyunComputeNestPolicyForReadOnly

    Read-only permissions

    Kebijakan izin O&M yang dihosting

    {
  "Action": [
    "*:Describe*",
    "*:List*",
    "*:Get*",
    "*:BatchGet*",
    "*:Query*",
    "*:BatchQuery*",
    "actiontrail:LookupEvents"
  ],
  "Resource": [
    "*"
  ],
  "Effect": "Allow"
}

    Izin efektif

    {
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "ecs:DescribeInstances",
                "ecs:DescribeInvocations",
                "ecs:DescribeInvocationResults",
                "ecs:DescribeTerminalSessions",
                "ecs:DescribeInstanceHistoryEvents",
                "ecs:DescribeDiagnosticReports",
                "ecs:DescribeSecurityGroups",
                "ecs:DescribeDisks",
                "ecs:DescribeImages",
                "cms:DescribeMetricData",
                "cms:DescribeMetricList",
                "cms:QueryMetricList",
                "cms:DescribeMetricRuleList",
                "cms:DescribeAlertHistoryList",
                "cms:DescribeAlertLogList",
                "cms:DescribeLogHistogram",
                "cms:DescribeLogCount",
                "cms:DescribeDynamicTagRuleList",
                "cms:DescribeMonitorGroups",
                "tag:ListTagResources",
                "vpc:DescribeVpcs",
                "vpc:DescribeVSwitches",
                "vpc:DescribeVSwitchAttributes",
                "vpc:DescribeVpcAttribute",
                "vpc:DescribeRouteEntryList",
                "vpc:DescribeRouteTableList",
                "vpc:DescribeRouteTables",
                "vpc:DescribeRouterInterfaces",
                "vpc:DescribeRouterInterfaceAttribute",
                "slb:DescribeLoadBalancers",
                "slb:DescribeLoadBalancerListeners",
                "slb:DescribeLoadBalancerAttribute",
                "slb:DescribeVServerGroups",
                "rds:DescribeDBInstances",
                "rds:DescribeDBInstanceAttribute",
                "actiontrail:LookupEvents"
            ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

    AliyunComputeNestPolicyForTerminalLogin

    Remote connection permissions

    Kebijakan izin O&M yang dihosting

    {
  "Action": [
    "ecs:*TerminalSession*",
    "tag:List*",
    "tag:DescribeRegions",
    "ecs:Describe*Instance*",
    "cs:Describe*Cluster*",
    "cs:GetClusters",
    "eci:DescribeContainerGroups",
    "eci:ExecContainerCommand"
  ],
  "Resource": [
    "*"
  ],
  "Effect": "Allow"
}

    Izin efektif

    {
  "Action": [
    "ecs:StartTerminalSession",
    "ecs:DescribeTerminalSessions",
    "ecs:CloseTerminalSession",
    "tag:ListSupportResourceTypes",
    "tag:ListTagResources",
    "tag:DescribeRegions",
    "ecs:DescribeInstances",
    "ecs:DescribeInstanceTypes",
    "ecs:DescribeInstanceHistoryEvents",
    "ecs:DescribeInstanceVncUrl",
    "cs:DescribeClusterUserKubeconfig",
    "cs:DescribeClusterDetail",
    "cs:GetClusters",
    "cs:DescribeClusterEndpoints",
    "cs:DescribeEdasClusterToken",
    "eci:DescribeContainerGroups",
    "eci:ExecContainerCommand"
  ],
  "Resource": [
    "*"
  ],
  "Effect": "Allow"
}

    AliyunComputeNestPolicyForTrails

    Operation audit permissions

    Kebijakan izin O&M yang dihosting

    {
  "Action": [
    "actiontrail:LookupEvents",
    "tag:ListTagResources",
    "tag:ListSupportResourceTypes",
    "tag:DescribeRegions"
  ],
  "Resource": [
    "*"
  ],
  "Effect": "Allow"
}

    Izin efektif

    {
  "Action": [
    "actiontrail:LookupEvents",
    "tag:ListTagResources",
    "tag:ListSupportResourceTypes",
    "tag:DescribeRegions"
  ],
  "Resource": [
    "*"
  ],
  "Effect": "Allow"
}

    AliyunComputeNestPolicyForAlarm

    Monitoring permissions

    Kebijakan izin O&M yang dihosting

    {
  "Action": [
    "cms:Describe*",
    "cms:CheckRamRoleForCloudMonitor",
    "cms:QueryMetricList",
    "cms:*MetricRule*",
    "cms:*EventRule*",
    "cms:*HostAvailability",
    "tag:List*",
    "tag:DescribeRegions"
  ],
  "Resource": [
    "*"
  ],
  "Effect": "Allow"
}

    Izin efektif

    {
  "Action": [
    "cms:DescribeMetricData",
    "cms:DescribeMetricList",
    "cms:QueryMetricList",
    "cms:DescribeMetricRuleList",
    "cms:DescribeAlertHistoryList",
    "cms:DescribeAlertLogList",
    "cms:DescribeLogHistogram",
    "cms:DescribeLogCount",
    "cms:DescribeDynamicTagRuleList",
    "cms:DescribeMonitorGroups",
    "cms:DescribeMonitorGroupInstances",
    "cms:DescribeMonitorGroupCategories",
    "cms:DescribeMonitorGroupDynamicRules",
    "cms:DescribeMetricRuleTemplateList",
    "cms:DescribeAlertingMetricRuleResources",
    "cms:DescribeContactGroupList",
    "cms:DescribeMonitorGroupInstanceAttribute",
    "cms:DescribeMetricListFromProxy",
    "cms:DescribeMetricLastFromProxy",
    "cms:DescribeMonitoringAgentHosts",
    "cms:DescribeMetricTopFromProxy",
    "cms:DescribeRegions",
    "cms:DescribeDashboardGroupList",
    "cms:DescribeHostAvailabilityList",
    "cms:DescribeUnhealthyHostAvailability",
    "cms:DescribeGroupMonitoringAgentProcess",
    "cms:DescribeSystemEventMetaList",
    "cms:CheckRamRoleForCloudMonitor",
    "cms:DescribeSystemEventHistogram",
    "cms:DescribeSystemEventAttribute",
    "cms:DescribeEventRuleList",
    "cms:DescribeEventRuleTargetList",
    "cms:DescribeCustomEventAttribute",
    "cms:DescribeCustomEventHistogram",
    "cms:DescribeContactListByContactGroup",
    "cms:DescribeAlertLogList",
    "cms:DescribeCustomMetricList",
    "cms:DescribeAlertLogCount",
    "cms:DescribeMetricMetaList",
    "cms:DescribeConsoleViews",
    "cms:DescribeProjectMeta",
    "cms:DescribeAlertLogHistogram",
    "cms:CreateHostAvailability",
    "cms:ModifyHostAvailability",
    "tag:DescribeRegions",
    "tag:ListSupportResourceTypes",
    "tag:ListTagResources"
  ],
  "Resource": [
    "*"
  ],
  "Effect": "Allow"
}

    AliyunComputeNestPolicyForUpgrade

    Upgrade permissions

    Kebijakan izin O&M yang dihosting

    {
  "Effect": "Allow",
  "Action": [
    "ros:*Stack",
    "ros:ListStack*",
    "tag:List*Resource*",
    "tag:DescribeRegions",
    "vpc:Describe*",
    "slb:Describe*",
    "slb:ListTagResources",
    "slb:*AccessControlListEntry",
    "slb:ModifyLoadBalancer*",
    "ecs:*Instance*",
    "ecs:Describe*",
    "ecs:RunCommand",
    "ecs:*SecurityGroup*",
    "ecs:*Disk*",
    "ess:ListTagResources",
    "ess:DescribeScaling*",
    "ess:*ScalingRule",
    "ess:*Instances",
    "cs:GetUserPermissions",
    "cs:Describe*Cluster*",
    "cs:GetClusters",
    "cs:CreateEdasClusterRole*"
  ],
  "Resource": [
    "*"
  ]
}

    Izin efektif

    {
  "Action": [
    "ros:UpdateStack",
    "ros:GetStack",
    "ros:ListStackEvents",
    "ros:ListStackResources",
    "tag:DescribeRegions",
    "tag:ListSupportResourceTypes",
    "tag:ListTagResources",
    "vpc:DescribeVpcs",
    "vpc:DescribeVSwitches",
    "vpc:DescribeVSwitchAttributes",
    "vpc:DescribeVpcAttribute",
    "vpc:DescribeEipAddresses",
    "slb:DescribeLoadBalancers",
    "slb:DescribeLoadBalancerListeners",
    "slb:DescribeLoadBalancerAttribute",
    "slb:DescribeVServerGroups",
    "slb:ListTagResources",
    "slb:DescribeAccessControlLists",
    "slb:DescribeAccessControlListAttribute",
    "slb:AddAccessControlListEntry",
    "slb:RemoveAccessControlListEntry",
    "slb:ModifyLoadBalancerInternetSpec",
    "slb:ModifyLoadBalancerInstanceSpec",
    "ecs:ModifyInstanceAttribute",
    "ecs:ReplaceSystemDisk",
    "ecs:RunInstances",
    "ecs:ModifySecurityGroupAttribute",
    "ecs:StartInstance",
    "ecs:DescribeInstances",
    "ecs:RebootInstance",
    "ecs:StopInstance",
    "ecs:ModifyInstanceSpec",
    "ecs:DescribeInstanceTypes",
    "ecs:ModifyPrepayInstanceSpec",
    "ecs:ModifyInstanceNetworkSpec",
    "ecs:RunCommand",
    "ecs:DescribeInvocations",
    "ecs:DescribeInvocationResults",
    "ecs:StartTerminalSession",
    "ecs:DescribeTerminalSessions",
    "ecs:CloseTerminalSession",
    "ecs:DescribeInstanceHistoryEvents",
    "ecs:DescribeDiagnosticReports",
    "ecs:CreateDiagnosticReport",
    "ecs:DescribeSecurityGroups",
    "ecs:DescribeSecurityGroupAttribute",
    "ecs:AuthorizeSecurityGroup",
    "ecs:RevokeSecurityGroup",
    "ecs:DescribeDisks",
    "ecs:ResizeDisk",
    "ecs:ModifyDiskSpec",
    "ecs:DescribeImages",
    "ecs:DescribeInstanceVncUrl",
    "ecs:DescribeManagedInstances",
    "ecs:CreateSnapshot",
    "ecs:CreateAutoSnapshotPolicy",
    "ecs:ApplyAutoSnapshotPolicy",
    "ecs:StopInstances",
    "ecs:ResetDisk",
    "ecs:DescribeSnapshots",
    "ess:ListTagResources",
    "ess:DescribeScalingGroups",
    "ess:CreateScalingRule",
    "ess:DeleteScalingRule",
    "ess:DescribeScalingActivityDetail",
    "ess:DescribeScalingActivities",
    "ess:ExecuteScalingRule",
    "ess:RemoveInstances",
    "ess:DetachInstances",
    "cs:DescribeClusterUserKubeconfig",
    "cs:DescribeClusterDetail",
    "cs:GetClusters",
    "cs:DescribeClusterEndpoints",
    "cs:DescribeEdasClusterToken",
    "cs:GetUserPermissions",
    "cs:CreateEdasClusterRole",
    "cs:CreateEdasClusterRoleBinding"
  ],
  "Resource": [
    "*"
  ],
  "Effect": "Allow"
}

    AliyunComputeNestPolicyForOperation

    Operation permissions

    Kebijakan izin O&M yang dihosting

    {
  "Action": [
    "ros:*Stack",
    "ros:ListStack*",
    "cs:Get*",
    "cs:Describe*Cluster*",
    "oos:StartExecution",
    "oos:ListExecutions",
    "ecs:*Instance*"
  ],
  "Resource": [
    "*"
  ],
  "Effect": "Allow"
}

    Izin efektif

    {
  "Action": [
    "ros:UpdateStack",
    "ros:GetStack",
    "ros:ListStackEvents",
    "ros:ListStackResources",
    "cs:GetClusters",
    "cs:GetUserPermissions",
    "cs:DescribeClusterUserKubeconfig",
    "cs:DescribeClusterDetail",
    "cs:DescribeClusterEndpoints",
    "cs:DescribeEdasClusterToken",
    "oos:StartExecution",
    "oos:ListExecutions",
    "ecs:StartInstance",
    "ecs:DescribeInstances",
    "ecs:RebootInstance",
    "ecs:StopInstance",
    "ecs:ModifyInstanceSpec",
    "ecs:DescribeInstanceTypes",
    "ecs:ModifyPrepayInstanceSpec",
    "ecs:ModifyInstanceNetworkSpec",
    "ecs:DescribeInstanceHistoryEvents",
    "ecs:DescribeInstanceVncUrl",
    "ecs:DescribeManagedInstances",
    "ecs:StopInstances"
  ],
  "Resource": [
    "*"
  ],
  "Effect": "Allow"
}