STAROps 自定义权限策略最佳实践 - 全域智能运维平台 STAROps

本文介绍如何基于最小权限原则，为不同角色的团队成员创建 STAROps 的自定义权限策略。通过本文提供的策略示例，您可以快速为运维管理员、普通运维人员、技能开发人员等角色配置精准的访问权限，避免过度授权带来的安全风险。

方案概述

适用场景

本方案适用于以下场景：

多人协作：团队中多名成员共同使用 STAROps，需要按职责分配不同的操作权限。
安全合规：需要遵循最小权限原则，确保每个 RAM 用户仅具备完成工作所需的最少权限。
资源隔离：多个数字员工服务于不同业务线，需要按数字员工粒度隔离操作权限。

前提条件

已了解如何在 RAM 控制台创建自定义权限策略。具体操作，请参见创建自定义权限策略。
已了解如何为 RAM 用户授权。具体操作，请参见管理RAM用户的权限。

典型场景的最小权限策略示例

本节针对常见的团队角色，提供经过验证的最小权限策略示例。您可以直接复制使用，也可以根据实际需求进行调整。

STAROps 的权限策略需要同时授予 cms: 和 starops: 两种前缀的 Action：关于完整的 Action 列表和资源 ARN 格式，请参见数字员工权限配置和授权信息。

运维管理员（数字员工 + 会话 + 技能全部权限）

场景说明：运维管理员负责数字员工的全生命周期管理，包括创建、配置、删除数字员工，管理技能和会话，以及与数字员工对话。

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "cms:CreateDigitalEmployee",
        "cms:GetDigitalEmployee",
        "cms:ListDigitalEmployees",
        "cms:UpdateDigitalEmployee",
        "cms:DeleteDigitalEmployee",
        "cms:CreateDigitalEmployeeSkill",
        "cms:GetDigitalEmployeeSkill",
        "cms:ListDigitalEmployeeSkills",
        "cms:UpdateDigitalEmployeeSkill",
        "cms:DeleteDigitalEmployeeSkill",
        "cms:ListDigitalEmployeeSkillVersions",
        "cms:CreateThread",
        "cms:GetThread",
        "cms:GetThreadData",
        "cms:ListThreads",
        "cms:UpdateThread",
        "cms:DeleteThread",
        "cms:GetArtifact",
        "cms:ListArtifacts",
        "cms:CreateChat"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*",
        "acs:cms:*:*:digitalemployee/*/skill/*",
        "acs:cms:*:*:digitalemployee/*/thread/*",
        "acs:cms:*:*:digitalemployee/*/artifact/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": "ram:PassRole",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "acs:Service": "cloudmonitor.aliyuncs.com"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:ListWorkspaces",
        "cms:GetWorkspace",
        "cms:GetEntityStore",
        "cms:GetEntityStoreData"
      ],
      "Resource": [
        "acs:cms:*:*:workspace/*",
        "acs:cms:*:*:workspace/*/entitystore"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:CreateDigitalEmployee",
        "starops:GetDigitalEmployee",
        "starops:ListDigitalEmployees",
        "starops:UpdateDigitalEmployee",
        "starops:DeleteDigitalEmployee",
        "starops:CreateDigitalEmployeeSkill",
        "starops:GetDigitalEmployeeSkill",
        "starops:ListDigitalEmployeeSkills",
        "starops:UpdateDigitalEmployeeSkill",
        "starops:DeleteDigitalEmployeeSkill",
        "starops:ListDigitalEmployeeSkillVersions",
        "starops:CreateThread",
        "starops:GetThread",
        "starops:GetThreadData",
        "starops:ListThreads",
        "starops:UpdateThread",
        "starops:DeleteThread",
        "starops:GetArtifact",
        "starops:ListArtifacts",
        "starops:CreateChat"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*",
        "acs:starops:*:*:digitalemployee/*/skill/*",
        "acs:starops:*:*:digitalemployee/*/thread/*",
        "acs:starops:*:*:digitalemployee/*/artifact/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": "ram:PassRole",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "acs:Service": "operation-platform.aliyuncs.com"
        }
      }
    }
  ]
}

普通运维人员（仅对话和查看，不可管理）

场景说明：普通运维人员日常使用数字员工进行智能会话（如故障诊断、日志分析），但不需要创建或修改数字员工和技能配置。

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetDigitalEmployee",
        "cms:ListDigitalEmployees",
        "cms:CreateChat",
        "cms:CreateThread",
        "cms:GetThread",
        "cms:GetThreadData",
        "cms:ListThreads",
        "cms:GetArtifact",
        "cms:ListArtifacts"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*",
        "acs:cms:*:*:digitalemployee/*/thread/*",
        "acs:cms:*:*:digitalemployee/*/artifact/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:ListWorkspaces",
        "cms:GetWorkspace",
        "cms:GetEntityStore",
        "cms:GetEntityStoreData"
      ],
      "Resource": [
        "acs:cms:*:*:workspace/*",
        "acs:cms:*:*:workspace/*/entitystore"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetDigitalEmployee",
        "starops:ListDigitalEmployees",
        "starops:CreateThread",
        "starops:GetThread",
        "starops:GetThreadData",
        "starops:ListThreads",
        "starops:GetArtifact",
        "starops:ListArtifacts",
        "starops:CreateChat"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*",
        "acs:starops:*:*:digitalemployee/*/thread/*",
        "acs:starops:*:*:digitalemployee/*/artifact/*"
      ]
    }
  ]
}

说明该策略允许用户查看数字员工列表、发起对话和查看会话记录，但不允许创建、修改或删除数字员工、技能和会话。starops: 权限确保用户能够登录 STAROps 控制台。

按数字员工粒度授权（仅允许操作指定数字员工）

场景说明：不同业务线各自拥有专属的数字员工。例如，A 团队仅允许操作名为 ops-agent-a 的数字员工，不可访问其他团队的数字员工。

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetDigitalEmployee",
        "cms:UpdateDigitalEmployee",
        "cms:CreateChat",
        "cms:CreateThread",
        "cms:GetThread",
        "cms:GetThreadData",
        "cms:ListThreads",
        "cms:UpdateThread",
        "cms:DeleteThread",
        "cms:GetDigitalEmployeeSkill",
        "cms:ListDigitalEmployeeSkills",
        "cms:ListDigitalEmployeeSkillVersions",
        "cms:GetArtifact",
        "cms:ListArtifacts"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/ops-agent-a",
        "acs:cms:*:*:digitalemployee/ops-agent-a/skill/*",
        "acs:cms:*:*:digitalemployee/ops-agent-a/thread/*",
        "acs:cms:*:*:digitalemployee/ops-agent-a/artifact/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:ListDigitalEmployees",
        "cms:ListWorkspaces",
        "cms:GetWorkspace",
        "cms:GetEntityStore",
        "cms:GetEntityStoreData"
      ],
      "Resource": [
        "acs:cms:*:*:workspace/*",
        "acs:cms:*:*:workspace/*/entitystore"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetDigitalEmployeeSkill",
        "starops:ListDigitalEmployeeSkills",
        "starops:ListDigitalEmployeeSkillVersions",
        "starops:CreateThread",
        "starops:GetThread",
        "starops:GetThreadData",
        "starops:ListThreads",
        "starops:UpdateThread",
        "starops:DeleteThread",
        "starops:GetArtifact",
        "starops:ListArtifacts",
        "starops:CreateChat"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/ops-agent-a",
        "acs:starops:*:*:digitalemployee/ops-agent-a/skill/*",
        "acs:starops:*:*:digitalemployee/ops-agent-a/thread/*",
        "acs:starops:*:*:digitalemployee/ops-agent-a/artifact/*"
      ]
    }
  ]
}

Resource 字段中将通配符 * 替换为具体的数字员工名称（如 ops-agent-a），即可实现资源级别的隔离。cms: 和 starops: 的 Resource 都需要指定相同的数字员工名称。ListDigitalEmployees 操作需要对所有数字员工资源授权，否则用户无法在控制台看到数字员工列表。

长期任务运营人员（Mission 管理）

场景说明：运营人员负责创建和管理长期任务（Mission）。

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "starops:CreateMission",
        "starops:GetMission",
        "starops:ListMissions",
        "starops:UpdateMission",
        "starops:DeleteMission",
        "starops:ListTasks",
        "starops:ListDigitalEmployees",
        "starops:ListThreads"
      ],
      "Resource": [
        "acs:starops:*:*:mission/*",
        "acs:starops:*:*:digitalemployee/*",
        "acs:starops:*:*:digitalemployee/*/thread/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetArtifact",
        "starops:ListArtifacts"
      ],
      "Resource": "acs:starops:*:*:digitalemployee/*/artifact/*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:CreateMission",
        "cms:GetMission",
        "cms:ListMissions",
        "cms:UpdateMission",
        "cms:DeleteMission",
        "cms:ListTasks",
        "cms:ListDigitalEmployees",
        "cms:ListThreads"
      ],
      "Resource": [
        "acs:cms:*:*:mission/*",
        "acs:cms:*:*:digitalemployee/*",
        "acs:cms:*:*:digitalemployee/*/thread/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetArtifact",
        "cms:ListArtifacts"
      ],
      "Resource": "acs:cms:*:*:digitalemployee/*/artifact/*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:ListWorkspaces",
        "cms:GetWorkspace"
      ],
      "Resource": "acs:cms:*:*:workspace/*"
    }
  ]
}

长期任务只读（仅查看，不可创建或修改）

场景说明：团队成员需要查看长期任务的执行进度、事项详情和产物报告，但不允许创建、修改或删除任何任务和事项。

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetMission",
        "starops:ListMissions",
        "starops:ListTasks",
        "starops:ListDigitalEmployees",
        "starops:GetDigitalEmployee",
        "starops:ListThreads"
      ],
      "Resource": [
        "acs:starops:*:*:mission/*",
        "acs:starops:*:*:digitalemployee/*",
        "acs:starops:*:*:digitalemployee/*/thread/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetArtifact",
        "starops:ListArtifacts"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*/artifact/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetMission",
        "cms:ListMissions",
        "cms:ListTasks",
        "cms:ListDigitalEmployees",
        "cms:GetDigitalEmployee",
        "cms:ListThreads"
      ],
      "Resource": [
        "acs:cms:*:*:mission/*",
        "acs:cms:*:*:digitalemployee/*",
        "acs:cms:*:*:digitalemployee/*/thread/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetArtifact",
        "cms:ListArtifacts"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*/artifact/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:ListWorkspaces",
        "cms:GetWorkspace"
      ],
      "Resource": [
        "acs:cms:*:*:workspace/*"
      ]
    }
  ]
}

安全加固建议

本节提供权限策略的安全加固建议，帮助您降低过度授权带来的安全风险。

避免使用通配符授权

在 Action 和 Resource 字段中使用 * 通配符会授予过于宽泛的权限。建议始终明确列出所需的 Action，并在 Resource 中指定具体的资源 ARN。

做法	示例	风险等级
❌ 不推荐	`"Action": "cms:*"`	高风险：授予 CMS 下所有操作权限，包括非 STAROps 的云监控操作。
❌ 不推荐	`"Action": "cms:DigitalEmployee"`	中风险：通配符可能匹配到未来新增的未知 Action。
✅ 推荐	明确列出每个 Action	低风险：精确控制，权限范围清晰可审计。

使用 Deny 策略限制高危操作

对于 DeleteDigitalEmployee、DeleteMission 等不可逆的删除操作，建议通过显式 Deny 策略进行限制，即使用户被授予了其他宽泛的权限策略，也无法执行删除操作。

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": [
        "cms:DeleteDigitalEmployee",
        "cms:DeleteDigitalEmployeeSkill",
        "cms:DeleteThread",
        "cms:DeleteMission"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Deny",
      "Action": [
        "starops:DeleteDigitalEmployeeSkill",
        "starops:DeleteThread",
        "starops:DeleteDigitalEmployeeSkill",
        "starops:DeleteMission"
      ],
      "Resource": "*"
    }
  ]
}

将此 Deny 策略作为独立的权限策略创建（如命名为 starops-deny-delete-policy），附加给需要限制的 RAM 用户或用户组。Deny 的优先级始终高于 Allow，可作为安全兜底。注意需要同时 Deny cms: 和 starops: 两种前缀的删除操作，避免通过任一路径执行删除。

定期审计权限策略

建议定期检查已创建的自定义权限策略，确保权限分配与团队成员的实际职责一致。

审查频率：建议每季度审查一次，或在团队人员变动时立即审查。
关注重点：
- 是否有已离职或转岗人员仍持有写入权限。
- 是否有策略使用了 * 通配符且未设置 Deny 兜底。
- 是否有 RAM 用户同时持有多个权限策略导致权限叠加过大。
审计工具：您可以通过操作审计查看 STAROps 资源的实际操作记录，辅助判断权限是否合理。