STAROps 自訂權限原則最佳實務 - STAROps

本文介紹如何基於最小許可權原則，為不同角色的團隊成員建立 STAROps 的自訂權限原則。通過本文提供的策略樣本，您可以快速為營運管理員、普通營運人員、技能開發人員等角色配置精準的存取權限，避免過度授權帶來的安全風險。

方案概述

適用情境

本方案適用於以下情境：

多人協作：團隊中多名成員共同使用 STAROps，需要按職責分配不同的操作許可權。
安全合規：需要遵循最小許可權原則，確保每個 RAM 使用者僅具備完成工作所需的最少許可權。
資源隔離：多個數字員工服務於不同業務線，需要按數字員工粒度隔離操作許可權。

前提條件

已瞭解如何在 RAM 控制台建立自訂權限原則。具體操作，請參見建立自訂權限原則。
已瞭解如何為 RAM 使用者授權。具體操作，請參見管理RAM使用者的許可權。

典型情境的最小權限原則樣本

本節針對常見的團隊角色，提供經過驗證的最小權限原則樣本。您可以直接複製使用，也可以根據實際需求進行調整。

STAROps 的權限原則需要同時授予 cms: 和 starops: 兩種首碼的 Action：關於完整的 Action 列表和資源 ARN 格式，請參見數字員工許可權配置和授權資訊。

營運管理員（數字員工 + 會話 + 技能全部許可權）

情境說明：營運管理員負責數字員工的全生命週期管理，包括建立、配置、刪除數字員工，管理技能和會話，以及與數字員工對話。

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "cms:CreateDigitalEmployee",
        "cms:GetDigitalEmployee",
        "cms:ListDigitalEmployees",
        "cms:UpdateDigitalEmployee",
        "cms:DeleteDigitalEmployee",
        "cms:CreateDigitalEmployeeSkill",
        "cms:GetDigitalEmployeeSkill",
        "cms:ListDigitalEmployeeSkills",
        "cms:UpdateDigitalEmployeeSkill",
        "cms:DeleteDigitalEmployeeSkill",
        "cms:ListDigitalEmployeeSkillVersions",
        "cms:CreateThread",
        "cms:GetThread",
        "cms:GetThreadData",
        "cms:ListThreads",
        "cms:UpdateThread",
        "cms:DeleteThread",
        "cms:GetArtifact",
        "cms:ListArtifacts",
        "cms:CreateChat"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*",
        "acs:cms:*:*:digitalemployee/*/skill/*",
        "acs:cms:*:*:digitalemployee/*/thread/*",
        "acs:cms:*:*:digitalemployee/*/artifact/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": "ram:PassRole",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "acs:Service": "cloudmonitor.aliyuncs.com"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:ListWorkspaces",
        "cms:GetWorkspace",
        "cms:GetEntityStore",
        "cms:GetEntityStoreData"
      ],
      "Resource": [
        "acs:cms:*:*:workspace/*",
        "acs:cms:*:*:workspace/*/entitystore"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:CreateDigitalEmployee",
        "starops:GetDigitalEmployee",
        "starops:ListDigitalEmployees",
        "starops:UpdateDigitalEmployee",
        "starops:DeleteDigitalEmployee",
        "starops:CreateDigitalEmployeeSkill",
        "starops:GetDigitalEmployeeSkill",
        "starops:ListDigitalEmployeeSkills",
        "starops:UpdateDigitalEmployeeSkill",
        "starops:DeleteDigitalEmployeeSkill",
        "starops:ListDigitalEmployeeSkillVersions",
        "starops:CreateThread",
        "starops:GetThread",
        "starops:GetThreadData",
        "starops:ListThreads",
        "starops:UpdateThread",
        "starops:DeleteThread",
        "starops:GetArtifact",
        "starops:ListArtifacts",
        "starops:CreateChat"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*",
        "acs:starops:*:*:digitalemployee/*/skill/*",
        "acs:starops:*:*:digitalemployee/*/thread/*",
        "acs:starops:*:*:digitalemployee/*/artifact/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": "ram:PassRole",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "acs:Service": "operation-platform.aliyuncs.com"
        }
      }
    }
  ]
}

普通營運人員（僅對話和查看，不可管理）

情境說明：普通營運人員日常使用數字員工進行智能會話（如故障診斷、日誌分析），但不需要建立或修改數字員工和技能配置。

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetDigitalEmployee",
        "cms:ListDigitalEmployees",
        "cms:CreateChat",
        "cms:CreateThread",
        "cms:GetThread",
        "cms:GetThreadData",
        "cms:ListThreads",
        "cms:GetArtifact",
        "cms:ListArtifacts"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*",
        "acs:cms:*:*:digitalemployee/*/thread/*",
        "acs:cms:*:*:digitalemployee/*/artifact/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:ListWorkspaces",
        "cms:GetWorkspace",
        "cms:GetEntityStore",
        "cms:GetEntityStoreData"
      ],
      "Resource": [
        "acs:cms:*:*:workspace/*",
        "acs:cms:*:*:workspace/*/entitystore"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetDigitalEmployee",
        "starops:ListDigitalEmployees",
        "starops:CreateThread",
        "starops:GetThread",
        "starops:GetThreadData",
        "starops:ListThreads",
        "starops:GetArtifact",
        "starops:ListArtifacts",
        "starops:CreateChat"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*",
        "acs:starops:*:*:digitalemployee/*/thread/*",
        "acs:starops:*:*:digitalemployee/*/artifact/*"
      ]
    }
  ]
}

說明該策略允許使用者查看數字員工列表、發起對話和查看會話記錄，但不允許建立、修改或刪除數字員工、技能和會話。starops: 許可權確保使用者能夠登入 STAROps 控制台。

按數字員工粒度授權（僅允許操作指定數字員工）

情境說明：不同業務線各自擁有專屬的數字員工。例如，A 團隊僅允許操作名為 ops-agent-a 的數字員工，不可訪問其他團隊的數字員工。

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetDigitalEmployee",
        "cms:UpdateDigitalEmployee",
        "cms:CreateChat",
        "cms:CreateThread",
        "cms:GetThread",
        "cms:GetThreadData",
        "cms:ListThreads",
        "cms:UpdateThread",
        "cms:DeleteThread",
        "cms:GetDigitalEmployeeSkill",
        "cms:ListDigitalEmployeeSkills",
        "cms:ListDigitalEmployeeSkillVersions",
        "cms:GetArtifact",
        "cms:ListArtifacts"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/ops-agent-a",
        "acs:cms:*:*:digitalemployee/ops-agent-a/skill/*",
        "acs:cms:*:*:digitalemployee/ops-agent-a/thread/*",
        "acs:cms:*:*:digitalemployee/ops-agent-a/artifact/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:ListDigitalEmployees",
        "cms:ListWorkspaces",
        "cms:GetWorkspace",
        "cms:GetEntityStore",
        "cms:GetEntityStoreData"
      ],
      "Resource": [
        "acs:cms:*:*:workspace/*",
        "acs:cms:*:*:workspace/*/entitystore"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetDigitalEmployeeSkill",
        "starops:ListDigitalEmployeeSkills",
        "starops:ListDigitalEmployeeSkillVersions",
        "starops:CreateThread",
        "starops:GetThread",
        "starops:GetThreadData",
        "starops:ListThreads",
        "starops:UpdateThread",
        "starops:DeleteThread",
        "starops:GetArtifact",
        "starops:ListArtifacts",
        "starops:CreateChat"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/ops-agent-a",
        "acs:starops:*:*:digitalemployee/ops-agent-a/skill/*",
        "acs:starops:*:*:digitalemployee/ops-agent-a/thread/*",
        "acs:starops:*:*:digitalemployee/ops-agent-a/artifact/*"
      ]
    }
  ]
}

Resource 欄位中將萬用字元 * 替換為具體的數字員工名稱（如 ops-agent-a），即可實現資源層級的隔離。cms: 和 starops: 的 Resource 都需要指定相同的數字員工名稱。ListDigitalEmployees 操作需要對所有數字員工資源授權，否則使用者無法在控制台看到數字員工列表。

長期任務營運人員（Mission 管理）

情境說明：營運人員負責建立和管理長期任務（Mission）。

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "starops:CreateMission",
        "starops:GetMission",
        "starops:ListMissions",
        "starops:UpdateMission",
        "starops:DeleteMission",
        "starops:ListTasks",
        "starops:ListDigitalEmployees",
        "starops:ListThreads"
      ],
      "Resource": [
        "acs:starops:*:*:mission/*",
        "acs:starops:*:*:digitalemployee/*",
        "acs:starops:*:*:digitalemployee/*/thread/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetArtifact",
        "starops:ListArtifacts"
      ],
      "Resource": "acs:starops:*:*:digitalemployee/*/artifact/*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:CreateMission",
        "cms:GetMission",
        "cms:ListMissions",
        "cms:UpdateMission",
        "cms:DeleteMission",
        "cms:ListTasks",
        "cms:ListDigitalEmployees",
        "cms:ListThreads"
      ],
      "Resource": [
        "acs:cms:*:*:mission/*",
        "acs:cms:*:*:digitalemployee/*",
        "acs:cms:*:*:digitalemployee/*/thread/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetArtifact",
        "cms:ListArtifacts"
      ],
      "Resource": "acs:cms:*:*:digitalemployee/*/artifact/*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:ListWorkspaces",
        "cms:GetWorkspace"
      ],
      "Resource": "acs:cms:*:*:workspace/*"
    }
  ]
}

長期任務唯讀（僅查看，不可建立或修改）

情境說明：團隊成員需要查看長期任務的執行進度、事項詳情和產物報告，但不允許建立、修改或刪除任何任務和事項。

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetMission",
        "starops:ListMissions",
        "starops:ListTasks",
        "starops:ListDigitalEmployees",
        "starops:GetDigitalEmployee",
        "starops:ListThreads"
      ],
      "Resource": [
        "acs:starops:*:*:mission/*",
        "acs:starops:*:*:digitalemployee/*",
        "acs:starops:*:*:digitalemployee/*/thread/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetArtifact",
        "starops:ListArtifacts"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*/artifact/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetMission",
        "cms:ListMissions",
        "cms:ListTasks",
        "cms:ListDigitalEmployees",
        "cms:GetDigitalEmployee",
        "cms:ListThreads"
      ],
      "Resource": [
        "acs:cms:*:*:mission/*",
        "acs:cms:*:*:digitalemployee/*",
        "acs:cms:*:*:digitalemployee/*/thread/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetArtifact",
        "cms:ListArtifacts"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*/artifact/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:ListWorkspaces",
        "cms:GetWorkspace"
      ],
      "Resource": [
        "acs:cms:*:*:workspace/*"
      ]
    }
  ]
}

安全強化建議

本節提供權限原則的安全強化建議，協助您降低過度授權帶來的安全風險。

避免使用萬用字元授權

在 Action 和 Resource 欄位中使用 * 萬用字元會授予過於寬泛的許可權。建議始終明確列出所需的 Action，並在 Resource 中指定具體的資源 ARN。

做法	樣本	風險等級
❌ 不推薦	`"Action": "cms:*"`	高風險：授予 CMS 下所有操作許可權，包括非 STAROps 的CloudMonitor操作。
❌ 不推薦	`"Action": "cms:DigitalEmployee"`	中風險：萬用字元可能匹配到未來新增的未知 Action。
✅ 推薦	明確列出每個 Action	低風險：精確控制，許可權範圍清晰可審計。

使用 Deny 策略限制高危操作

對於 DeleteDigitalEmployee、DeleteMission 等無法復原的刪除操作，建議通過顯式 Deny 策略進行限制，即使使用者被授予了其他寬泛的權限原則，也無法執行刪除操作。

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": [
        "cms:DeleteDigitalEmployee",
        "cms:DeleteDigitalEmployeeSkill",
        "cms:DeleteThread",
        "cms:DeleteMission"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Deny",
      "Action": [
        "starops:DeleteDigitalEmployeeSkill",
        "starops:DeleteThread",
        "starops:DeleteDigitalEmployeeSkill",
        "starops:DeleteMission"
      ],
      "Resource": "*"
    }
  ]
}

將此 Deny 策略作為獨立的權限原則建立（如命名為 starops-deny-delete-policy），附加給需要限制的 RAM 使用者或使用者組。Deny 的優先順序始終高於 Allow，可作為安全兜底。注意需要同時 Deny cms: 和 starops: 兩種首碼的刪除操作，避免通過任一路徑執行刪除。

定期審計權限原則

建議定期檢查已建立的自訂權限原則，確保許可權分配與團隊成員的實際職責一致。

審查頻率：建議每季度審查一次，或在團隊人員變動時立即審查。
關注重點：
- 是否有已離職或轉崗人員仍持有寫入許可權。
- 是否有策略使用了 * 萬用字元且未設定 Deny 兜底。
- 是否有 RAM 使用者同時持有多個權限原則導致許可權疊加過大。
審計工具：您可以通過Action Trail查看 STAROps 資源的實際操作記錄，輔助判斷許可權是否合理。