AliyunCSAIAssistantRolePolicy is the authorization policy dedicated to a service role. In most cases, when a service role is created, the policy is attached to the service role. Then, the service role is authorized to access other cloud services. This policy is updated by the relevant Alibaba Cloud service. Do not attach this policy to a RAM identity other than a service role.
Policy details
Type: service system policy
Creation time: 09:43:29 on August 16, 2024
Update time: 23:04:08 on July 06, 2026
Current version: v9
Policy content
{
"Version": "1",
"Statement": [
{
"Action": [
"cs:DescribeClusterVuls",
"cs:DescribeKubernetesVersionMetadata",
"cs:DescribeClusterEndpoints",
"cs:DescribePolicyInstancesStatus",
"cs:GetClusterCheckResult",
"cs:GetCostCheckItem",
"cs:CheckControlPlaneLogEnable",
"cs:GetClusterAuditProject",
"cs:DescribeClusterDetail",
"cs:CreateClusterDiagnosis",
"cs:CreateClusterInspectConfig",
"cs:GetClusterDiagnosisResult",
"cs:RunClusterInspect",
"cs:RunClusterCheck",
"cs:ListClusterInspectReports",
"cs:GetClusterInspectReportDetail",
"cs:ListClusterChecks",
"cs:DescribeClusterNodes",
"cs:DescribeClusterNodePools",
"cs:DescribeClusterNodePoolDetail",
"cs:DescribeClusterTasks",
"cs:DescribeTaskInfo",
"cs:ListAddons",
"cs:ListClusterAddonInstances",
"cs:GetClusters",
"cs:DescribeClustersV1",
"cs:DescribeClustersForRegion",
"cs:DescribeClusterResources",
"cs:DescribeClusterLogs",
"cs:DescribeClusterEvents",
"cs:DescribeEventsForRegion",
"cs:DescribeUserQuota",
"cs:DescribeRegions",
"cs:DescribeTemplates",
"cs:DescribeTemplateAttribute",
"cs:DescribeUserClusterNamespaces",
"cs:GetClusterCheck",
"cs:ListAutoRepairPolicies",
"cs:DescribeAutoRepairPolicy",
"cs:DescribeAddon",
"cs:GetClusterAddonInstance",
"cs:ListClusterAddonInstanceResources",
"cs:ListOperationPlansForRegion",
"cs:GetClusterInspectConfig",
"cs:GetClusterDiagnosisCheckItems",
"cs:DescribeNodePoolVuls",
"cs:DescribePolicies",
"cs:DescribePolicyDetails",
"cs:DescribePolicyInstances",
"cs:DescribePolicyGovernanceInCluster",
"cs:CheckControlPlaneLogEnable",
"cs:ListTagResources",
"cs:DescribeResourcesDeleteProtection"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Effect": "Allow",
"Action": [
"ecs:DescribeInvocationResults",
"ecs:DescribeCommands",
"ecs:DescribeInstanceAttribute",
"ecs:DescribeInstanceHealthStatus",
"ecs:DescribeInstanceHistoryEvents",
"ecs:DescribeInstanceMonitorData",
"ecs:DescribeInvocations",
"ecs:DescribePrice",
"ecs:DescribeResourceByTags",
"ecs:DescribeSecurityGroupAttribute",
"ecs:DescribeSecurityGroupReferences",
"ecs:DescribeSecurityGroups",
"ecs:DescribeTasks",
"ecs:DescribeTags",
"ecs:DescribeTagKeys",
"vpc:DescribeEipAddresses",
"vpc:DescribeEipMonitorData",
"vpc:DescribeRouteTables",
"vpc:DescribeVpcs",
"vpc:DescribeVSwitches",
"vpc:DescribeVRouters",
"vpc:DescribeVSwitchAttributes",
"ecs:DescribeDisks",
"ecs:DescribeDisksFullStatus",
"ecs:DescribeInstances",
"ecs:DescribeInstancesFullStatus",
"ecs:DescribeInstanceStatus",
"ecs:DescribeInstanceTypeResource",
"ecs:DescribeVolumes"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"cms:QueryMetricList",
"cms:QueryMetricLast",
"cms:DescribeMetricList",
"cms:DescribeMetricMetaList",
"cms:DescribeProjectMeta",
"cms:ListPrometheusInstances",
"cms:GetPrometheusInstance",
"cms:ListPrometheusViews"
],
"Resource": "*"
},
{
"Action": [
"yundun-sas:DescribeSuspEvents",
"yundun-sas:DescribeVulDetails"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"cr:CreateClusterImageAnalysisTask",
"cr:GetClusterImageAnalysisTask"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"arms:GetPrometheusInstance",
"arms:GetCloudClusterAllUrl"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Effect": "Allow",
"Action": [
"log:ListProject",
"log:ListTagResources",
"log:ListLogStores",
"log:ListConsumerGroup",
"log:GetProject",
"log:GetAlert",
"log:GetIndex",
"log:GetLogStore",
"log:GetLogStoreLogs",
"log:ListShards"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"sysom:InvokeDiagnosis",
"sysom:GetDiagnosisResult",
"sysom:GetDiagnosisResult",
"sysom:ListDiagnosis",
"sysom:InitialSysom"
],
"Resource": "*"
},
{
"Action": "ram:CreateServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": [
"selfservice.ecs.aliyuncs.com",
"sysom.aliyuncs.com"
]
}
}
},
{
"Sid": "AcrInstanceAndImageReadOnly",
"Effect": "Allow",
"Action": [
"cr:ListInstance",
"cr:GetInstance",
"cr:GetInstanceCount",
"cr:GetInstanceEndpoint",
"cr:GetInstanceVpcEndpoint",
"cr:GetInstanceUsage",
"cr:ListInstanceEndpoint",
"cr:ListNamespace",
"cr:GetNamespace",
"cr:ListRepository",
"cr:GetRepository",
"cr:ListRepositoryTag",
"cr:GetAuthorizationToken"
],
"Resource": "*"
},
{
"Sid": "AcrImageScanReadOnly_Optional",
"Effect": "Allow",
"Action": [
"cr:GetScan",
"cr:GetScanCount"
],
"Resource": "*"
}
]
}