A AliyunCSManagedCsiRolePolicy é uma política de sistema destinada a funções de serviço. O serviço correspondente do Alibaba Cloud anexa essa política à função de serviço durante a criação para permitir o acesso a outros serviços em nuvem em seu nome. Esse serviço também mantém a política. Não anexe esta política a identidades RAM que não sejam funções de serviço.
Detalhes da política
Tipo: política de sistema de serviço
Data de criação: 18 de outubro de 2024 às 11:13:24
Última atualização: 06 de janeiro de 2026 às 09:57:42
Versão atual: v18
Conteúdo da política
{
"Version": "1",
"Statement": [{
"Action": [
"ecs:AttachDisk",
"ecs:DetachDisk",
"ecs:DescribeDisks",
"ecs:CreateDisk",
"ecs:ResizeDisk",
"ecs:CreateSnapshot",
"ecs:DeleteSnapshot",
"ecs:CreateAutoSnapshotPolicy",
"ecs:ApplyAutoSnapshotPolicy",
"ecs:CancelAutoSnapshotPolicy",
"ecs:DeleteAutoSnapshotPolicy",
"ecs:DescribeAutoSnapshotPolicyEX",
"ecs:ModifyAutoSnapshotPolicyEx",
"ecs:AddTags",
"ecs:RemoveTags",
"ecs:DescribeTags",
"ecs:DescribeSnapshots",
"ecs:ListTagResources",
"ecs:TagResources",
"ecs:UntagResources",
"ecs:ModifyDiskSpec",
"ecs:CreateSnapshot",
"ecs:DescribeSnapshotGroups",
"ecs:CreateSnapshotGroup",
"ecs:DeleteSnapshotGroup",
"ecs:CopySnapshot",
"ecs:DeleteDisk",
"ecs:DescribeInstanceAttribute",
"ecs:DescribeInstanceHistoryEvents",
"ecs:DescribeTaskAttribute",
"ecs:DescribeInstances"
],
"Resource": [
"*"
],
"Effect": "Allow"
},
{
"Action": [
"nas:DescribeFileSystems",
"nas:DescribeMountTargets",
"nas:AddTags",
"nas:DescribeTags",
"nas:RemoveTags",
"nas:CreateFileSystem",
"nas:DeleteFileSystem",
"nas:ModifyFileSystem",
"nas:CreateMountTarget",
"nas:DeleteMountTarget",
"nas:ModifyMountTarget",
"nas:TagResources",
"nas:SetDirQuota",
"nas:EnableRecycleBin",
"nas:GetRecycleBinAttribute",
"nas:DescribeProtocolMountTarget",
"nas:CancelDirQuota",
"nas:CreateDir",
"nas:DescribeDirQuotas",
"nas:CancelDataFlowTask",
"nas:CreateDataFlow",
"nas:DeleteDataFlow",
"nas:CreateDataFlowTask",
"nas:DescribeDataFlows",
"nas:DescribeDataFlowTasks"
],
"Resource": [
"*"
],
"Effect": "Allow"
},
{
"Action": [
"cs:CreateResourcesSystemTags",
"cs:DescribeTemplateAttribute",
"cs:DescribeTemplates"
],
"Resource": [
"*"
],
"Effect": "Allow"
},
{
"Action": [
"oss:PutBucket",
"oss:GetObjectTagging",
"oss:ListBuckets",
"oss:PutBucketTagging",
"oss:GetBucketTagging",
"oss:PutBucketEncryption",
"oss:GetBucketStat",
"oss:PutBucketVersioning",
"oss:GetBucketInfo"
],
"Resource": [
"*"
],
"Effect": "Allow"
},
{
"Action": [
"ens:DescribeInstances",
"ens:DescribeDisks",
"ens:ModifyDiskAttribute",
"ens:CreateDisk",
"ens:DetachDisk",
"ens:AttachDisk",
"ens:DeleteDisk"
],
"Resource": [
"*"
],
"Effect": "Allow"
},
{
"Action": [
"kms:ListAliases"
],
"Resource": [
"*"
],
"Effect": "Allow"
},
{
"Effect": "Allow",
"Action": [
"hbr:CreateVault",
"hbr:CreateBackupJob",
"hbr:DescribeVaults",
"hbr:DescribeBackupJobs2",
"hbr:DescribeRestoreJobs",
"hbr:SearchHistoricalSnapshots",
"hbr:CreateRestoreJob",
"hbr:AddContainerCluster",
"hbr:DescribeContainerCluster",
"hbr:DescribeRestoreJobs2"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"oss:PutObject",
"oss:IsObjectExist",
"oss:ListObjects",
"oss:GetObject",
"oss:DeleteObject",
"oss:GetBucket"
],
"Resource": "acs:oss:*:*:cnfs-oss*"
},
{
"Effect": "Allow",
"Action": "ram:CreateServiceLinkedRole",
"Resource": "*",
"Condition": {
"StringEquals": {
"ram:ServiceName": [
"oss-dataflow.nas.aliyuncs.com",
"event-notification.nas.aliyuncs.com"
]
}
}
}
]
}