数字员工权限配置 - 全域智能运维平台 STAROps

本文介绍系统内置员工和自定义数字员工的权限配置方法。

STAROps 权限模型和授权对象说明，请先阅读《权限配置》。本文不重复展开权限原理，只提供按场景可复制的权限策略。

配置数字员工前，请先判断使用的是系统内置员工还是自定义数字员工。

用户操作权限（RAM 用户权限）

用户操作权限配置给 RAM 用户，决定这个用户能不能查看、创建、管理或使用数字员工。无论使用系统内置员工还是自定义数字员工，都需要先配置这一层。

使用系统内置员工时，只需要给 RAM 用户配置 STAROps 使用权限和必要的数据读取权限。系统内置员工不绑定客户侧 RAM Role，因此不需要配置 ram:PassRole。

使用自定义数字员工时，RAM 用户除了需要数字员工操作权限，还需要具备目标 RAM Role 的 ram:PassRole。否则用户可以看到或创建数字员工，但不能把该角色传递给 STAROps 使用。

使用系统内置员工

以下策略适用于使用系统内置员工进行对话、查看会话、查看产物和读取诊断数据的场景。系统内置员工不支持 MCP、AliyunCLI 等扩展配置；如果需要这些能力，请使用自定义数字员工。

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetDigitalEmployee",
        "starops:ListDigitalEmployees"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:CreateArtifactUploadToken",
        "starops:GetArtifactDownloadUrl",
        "starops:CreateChat",
        "starops:CreateThread",
        "starops:GetThread",
        "starops:GetThreadData",
        "starops:ListThreads"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*",
        "acs:starops:*:*:digitalemployee/*/thread/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetDigitalEmployeeSkill",
        "starops:ListDigitalEmployeeSkills",
        "starops:ListDigitalEmployeeSkillVersions"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*/skill/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetMission",
        "starops:ListMissions",
        "starops:ListTasks"
      ],
      "Resource": [
        "acs:starops:*:*:mission/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetMcpService",
        "starops:ListMcpServices",
        "starops:FetchRemoteMcpTools"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*/mcpservice/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetArtifact",
        "starops:ListArtifacts"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*/artifact/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetCreditQuota"
      ],
      "Resource": [
        "acs:starops:*:*:quota/credit"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetDigitalEmployee",
        "cms:ListDigitalEmployees"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:CreateChat",
        "cms:CreateThread",
        "cms:GetThread",
        "cms:GetThreadData",
        "cms:ListThreads"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*",
        "acs:cms:*:*:digitalemployee/*/thread/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetDigitalEmployeeSkill",
        "cms:ListDigitalEmployeeSkills",
        "cms:ListDigitalEmployeeSkillVersions"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*/skill/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetMission",
        "cms:ListMissions",
        "cms:ListTasks"
      ],
      "Resource": [
        "acs:cms:*:*:mission/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetMcpService",
        "cms:ListMcpServices",
        "cms:FetchRemoteMcpTools"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*/mcpservice/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetArtifact",
        "cms:ListArtifacts"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*/artifact/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:ListWorkspaces",
        "cms:GetWorkspace",
        "cms:GetEntityStore",
        "cms:GetEntityStoreData"
      ],
      "Resource": [
        "acs:cms:*:*:workspace/*",
        "acs:cms:*:*:entitystore/*",
        "acs:cms:*:*:entitystoredata/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetCloudResourceData"
      ],
      "Resource": [
        "acs:cms:*:*:cloudresource"
      ]
    },
    {
      "Action": [
        "log:Get*",
        "log:List*",
        "log:Query*"
      ],
      "Resource": "acs:log:*:*:*",
      "Effect": "Allow"
    }
  ]
}

创建和管理自定义数字员工

以下策略允许 RAM 用户创建、修改、删除、查看数字员工，管理 Skill/MCP、会话、长期任务和产物，并与数字员工对话。示例中的 ram:PassRole 默认收敛到服务角色 AliyunServiceRoleForCloudMonitor；如果数字员工绑定自定义 RAM Role，请将 Resource 替换为对应 RoleArn。

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "starops:CreateDigitalEmployee",
        "starops:GetDigitalEmployee",
        "starops:ListDigitalEmployees",
        "starops:UpdateDigitalEmployee",
        "starops:DeleteDigitalEmployee"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:CreateArtifactUploadToken",
        "starops:GetArtifactDownloadUrl",
        "starops:CreateChat",
        "starops:CreateThread",
        "starops:GetThread",
        "starops:GetThreadData",
        "starops:ListThreads",
        "starops:UpdateThread",
        "starops:DeleteThread"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*",
        "acs:starops:*:*:digitalemployee/*/thread/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:CreateDigitalEmployeeSkill",
        "starops:GetDigitalEmployeeSkill",
        "starops:ListDigitalEmployeeSkills",
        "starops:UpdateDigitalEmployeeSkill",
        "starops:DeleteDigitalEmployeeSkill",
        "starops:ListDigitalEmployeeSkillVersions"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*/skill/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:CreateMission",
        "starops:GetMission",
        "starops:ListMissions",
        "starops:ListTasks",
        "starops:UpdateMission",
        "starops:DeleteMission"
      ],
      "Resource": [
        "acs:starops:*:*:mission/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:CreateMcpService",
        "starops:GetMcpService",
        "starops:ListMcpServices",
        "starops:UpdateMcpService",
        "starops:DeleteMcpService",
        "starops:FetchRemoteMcpTools"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*/mcpservice/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetArtifact",
        "starops:ListArtifacts"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*/artifact/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetCreditQuota",
        "starops:SetCreditQuota"
      ],
      "Resource": [
        "acs:starops:*:*:quota/credit"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:CreateDigitalEmployee",
        "cms:GetDigitalEmployee",
        "cms:ListDigitalEmployees",
        "cms:UpdateDigitalEmployee",
        "cms:DeleteDigitalEmployee"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:CreateChat",
        "cms:CreateThread",
        "cms:GetThread",
        "cms:GetThreadData",
        "cms:ListThreads",
        "cms:UpdateThread",
        "cms:DeleteThread"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*",
        "acs:cms:*:*:digitalemployee/*/thread/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:CreateDigitalEmployeeSkill",
        "cms:GetDigitalEmployeeSkill",
        "cms:ListDigitalEmployeeSkills",
        "cms:UpdateDigitalEmployeeSkill",
        "cms:DeleteDigitalEmployeeSkill",
        "cms:ListDigitalEmployeeSkillVersions"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*/skill/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:CreateMission",
        "cms:GetMission",
        "cms:ListMissions",
        "cms:ListTasks",
        "cms:UpdateMission",
        "cms:DeleteMission"
      ],
      "Resource": [
        "acs:cms:*:*:mission/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:CreateMcpService",
        "cms:GetMcpService",
        "cms:ListMcpServices",
        "cms:UpdateMcpService",
        "cms:DeleteMcpService",
        "cms:FetchRemoteMcpTools"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*/mcpservice/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetArtifact",
        "cms:ListArtifacts"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*/artifact/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:ListWorkspaces",
        "cms:GetWorkspace",
        "cms:GetEntityStore",
        "cms:GetEntityStoreData"
      ],
      "Resource": [
        "acs:cms:*:*:workspace/*",
        "acs:cms:*:*:entitystore/*",
        "acs:cms:*:*:entitystoredata/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetCloudResourceData"
      ],
      "Resource": [
        "acs:cms:*:*:cloudresource"
      ]
    },
    {
      "Action": [
        "log:Get*",
        "log:List*",
        "log:Query*"
      ],
      "Resource": "acs:log:*:*:*",
      "Effect": "Allow"
    },
    {
      "Effect": "Allow",
      "Action": "ram:PassRole",
      "Resource": "acs:ram::*:role/aliyunserviceroleforcloudmonitor",
      "Condition": {
        "StringEquals": {
          "acs:Service": [
            "operation-platform.aliyuncs.com",
            "cloudmonitor.aliyuncs.com"
          ]
        }
      }
    }
  ]
}

仅对话权限

以下策略适用于只允许用户与自定义数字员工对话、查看自己的会话和产物的场景，不允许创建、修改或删除数字员工和 Skill。由于对话时需要使用数字员工绑定的 RAM Role，因此需要同时授予 ram:PassRole。

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetDigitalEmployee",
        "starops:ListDigitalEmployees"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:CreateArtifactUploadToken",
        "starops:GetArtifactDownloadUrl",
        "starops:CreateChat",
        "starops:CreateThread",
        "starops:GetThread",
        "starops:GetThreadData",
        "starops:ListThreads",
        "starops:UpdateThread"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*",
        "acs:starops:*:*:digitalemployee/*/thread/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetDigitalEmployeeSkill",
        "starops:ListDigitalEmployeeSkills",
        "starops:ListDigitalEmployeeSkillVersions"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*/skill/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:CreateMission",
        "starops:GetMission",
        "starops:ListMissions",
        "starops:ListTasks",
        "starops:UpdateMission"
      ],
      "Resource": [
        "acs:starops:*:*:mission/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetMcpService",
        "starops:ListMcpServices",
        "starops:FetchRemoteMcpTools"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*/mcpservice/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetArtifact",
        "starops:ListArtifacts"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*/artifact/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetCreditQuota"
      ],
      "Resource": [
        "acs:starops:*:*:quota/credit"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetDigitalEmployee",
        "cms:ListDigitalEmployees"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:CreateChat",
        "cms:CreateThread",
        "cms:GetThread",
        "cms:GetThreadData",
        "cms:ListThreads",
        "cms:UpdateThread"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*",
        "acs:cms:*:*:digitalemployee/*/thread/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetDigitalEmployeeSkill",
        "cms:ListDigitalEmployeeSkills",
        "cms:ListDigitalEmployeeSkillVersions"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*/skill/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:CreateMission",
        "cms:GetMission",
        "cms:ListMissions",
        "cms:ListTasks",
        "cms:UpdateMission"
      ],
      "Resource": [
        "acs:cms:*:*:mission/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetMcpService",
        "cms:ListMcpServices",
        "cms:FetchRemoteMcpTools"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*/mcpservice/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetArtifact",
        "cms:ListArtifacts"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*/artifact/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:ListWorkspaces",
        "cms:GetWorkspace",
        "cms:GetEntityStore",
        "cms:GetEntityStoreData"
      ],
      "Resource": [
        "acs:cms:*:*:workspace/*",
        "acs:cms:*:*:entitystore/*",
        "acs:cms:*:*:entitystoredata/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetCloudResourceData"
      ],
      "Resource": [
        "acs:cms:*:*:cloudresource"
      ]
    },
    {
      "Action": [
        "log:Get*",
        "log:List*",
        "log:Query*"
      ],
      "Resource": "acs:log:*:*:*",
      "Effect": "Allow"
    },
    {
      "Effect": "Allow",
      "Action": "ram:PassRole",
      "Resource": "acs:ram::*:role/aliyunserviceroleforcloudmonitor",
      "Condition": {
        "StringEquals": {
          "acs:Service": [
            "operation-platform.aliyuncs.com",
            "cloudmonitor.aliyuncs.com"
          ]
        }
      }
    }
  ]
}

只读权限

以下策略适用于查看数字员工、会话、产物和相关诊断数据的场景，并允许用户使用绑定服务角色的自定义数字员工发起会话。如果用户只做审计查看，不需要发起会话或传递角色，可以删除 CreateChat、CreateThread 和 ram:PassRole 相关语句。

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetDigitalEmployee",
        "starops:ListDigitalEmployees"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:CreateArtifactUploadToken",
        "starops:GetArtifactDownloadUrl",
        "starops:CreateChat",
        "starops:CreateThread",
        "starops:GetThread",
        "starops:GetThreadData",
        "starops:ListThreads"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*",
        "acs:starops:*:*:digitalemployee/*/thread/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetDigitalEmployeeSkill",
        "starops:ListDigitalEmployeeSkills",
        "starops:ListDigitalEmployeeSkillVersions"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*/skill/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetMission",
        "starops:ListMissions",
        "starops:ListTasks"
      ],
      "Resource": [
        "acs:starops:*:*:mission/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetMcpService",
        "starops:ListMcpServices",
        "starops:FetchRemoteMcpTools"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*/mcpservice/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetArtifact",
        "starops:ListArtifacts"
      ],
      "Resource": [
        "acs:starops:*:*:digitalemployee/*/artifact/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "starops:GetCreditQuota"
      ],
      "Resource": [
        "acs:starops:*:*:quota/credit"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetDigitalEmployee",
        "cms:ListDigitalEmployees"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:CreateChat",
        "cms:CreateThread",
        "cms:GetThread",
        "cms:GetThreadData",
        "cms:ListThreads"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*",
        "acs:cms:*:*:digitalemployee/*/thread/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetDigitalEmployeeSkill",
        "cms:ListDigitalEmployeeSkills",
        "cms:ListDigitalEmployeeSkillVersions"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*/skill/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetMission",
        "cms:ListMissions",
        "cms:ListTasks"
      ],
      "Resource": [
        "acs:cms:*:*:mission/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetMcpService",
        "cms:ListMcpServices",
        "cms:FetchRemoteMcpTools"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*/mcpservice/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetArtifact",
        "cms:ListArtifacts"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*/artifact/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:ListWorkspaces",
        "cms:GetWorkspace",
        "cms:GetEntityStore",
        "cms:GetEntityStoreData"
      ],
      "Resource": [
        "acs:cms:*:*:workspace/*",
        "acs:cms:*:*:entitystore/*",
        "acs:cms:*:*:entitystoredata/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:GetCloudResourceData"
      ],
      "Resource": [
        "acs:cms:*:*:cloudresource"
      ]
    },
    {
      "Action": [
        "log:Get*",
        "log:List*",
        "log:Query*"
      ],
      "Resource": "acs:log:*:*:*",
      "Effect": "Allow"
    },
    {
      "Effect": "Allow",
      "Action": "ram:PassRole",
      "Resource": "acs:ram::*:role/aliyunserviceroleforcloudmonitor",
      "Condition": {
        "StringEquals": {
          "acs:Service": [
            "operation-platform.aliyuncs.com",
            "cloudmonitor.aliyuncs.com"
          ]
        }
      }
    }
  ]
}

PassRole 授权路径

授予 ram:PassRole 时，先确认数字员工绑定的 RoleArn，再把该 RoleArn 写入 RAM 自定义权限策略。

在 STAROps 创建或编辑数字员工，确认数字员工绑定的 RAM Role。
- 如果选择服务角色 ServiceRoleForCloudMonitor，Resource 使用 acs:ram::*:role/aliyunserviceroleforcloudmonitor。
- 如果选择自定义 RAM Role，Resource 使用该角色的 RoleArn，例如 acs:ram::*:role/starops-production-sre。
在 RAM 控制台创建自定义权限策略，并将策略授权给需要使用该数字员工的 RAM 用户或用户组。

服务角色 ServiceRoleForCloudMonitor 的 PassRole 示例：

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ram:PassRole",
      "Resource": "acs:ram::*:role/aliyunserviceroleforcloudmonitor",
      "Condition": {
        "StringEquals": {
          "acs:Service": [
            "operation-platform.aliyuncs.com",
            "cloudmonitor.aliyuncs.com"
          ]
        }
      }
    }
  ]
}

如果使用自定义 RAM Role，请将以上 Resource 替换为该自定义角色的 RoleArn。

数字员工访问权限（RAM 角色权限）

数字员工访问权限配置给 RAM Role，决定数字员工运行时能访问哪些数据、云资源和工具能力。这一层不是配置给 RAM 用户的权限。

系统内置员工不配置客户侧 RAM Role，运行时通常继承当前 RAM 用户权限。自定义数字员工必须绑定 RAM Role，RoleArn 就是该数字员工运行时访问云资源的身份。

使用服务角色快速配置

创建自定义数字员工时，RAM 角色类型可以选择"服务角色"。如果选择 ServiceRoleForCloudMonitor，数字员工会使用对应 RAM 角色 AliyunServiceRoleForCloudMonitor 访问数据。该角色的 RoleArn 通常为：

acs:ram::<account-id>:role/aliyunserviceroleforcloudmonitor

该服务角色适合查询云监控 2.0、SLS 日志、ARMS 应用监控等诊断数据，常用于只读巡检、告警分析和报告生成。使用服务角色时，通常不需要手动配置角色信任策略和数据读取权限策略，但仍需要给使用者授予数字员工操作权限和对该服务角色的 ram:PassRole 权限。

该服务角色不包含修改云产品配置、变更资源状态等权限。如果数字员工需要执行云产品更新、资源变更或其他写操作，请改用自定义 RAM Role，并按最小权限原则配置对应云产品权限。

使用自定义 RAM Role

如果选择自定义 RAM Role，需要分别配置信任策略和权限策略。信任策略声明哪些阿里云服务可以扮演该角色；权限策略决定角色被扮演后可以访问哪些数据和资源。

配置信任策略

如果选择服务角色 ServiceRoleForCloudMonitor，通常不需要手动配置该信任策略。如果选择自定义角色，请配置以下信任策略。

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": [
          "operation-platform.aliyuncs.com",
          "cloudmonitor.aliyuncs.com"
        ]
      }
    }
  ]
}

配置数据访问权限

如果选择服务角色 ServiceRoleForCloudMonitor，该角色已包含云监控 2.0 场景的数据读取权限。如果选择自定义角色，可复制以下策略作为只读数据访问起点。

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "log:Get*",
        "log:List*"
      ],
      "Resource": "acs:log:*:*:*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:Get*",
        "cms:List*"
      ],
      "Resource": [
        "acs:cms:*:*:workspace/*",
        "acs:cms:*:*:cloudresource"
      ]
    }
  ]
}

全量权限（开发测试环境）

以下策略仅用于开发测试环境快速验证。生产环境请改为按数据源、Workspace、日志项目和云产品资源范围精细化授权。对会产生资源变更的工具调用，建议配合人工确认、审计和回滚机制。

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "cms:*",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "arms:*",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "sls:*",
      "Resource": "*"
    }
  ]
}

权限验证

完成配置后，建议按以下顺序验证：

使用 RAM 用户登录 STAROps。
打开数字员工列表，确认能看到目标数字员工。
如果是自定义数字员工，确认页面已绑定正确 RoleArn。
发起一个只读查询会话，例如查询指定 Workspace 或日志。
如果会话失败，先检查 RAM Role 的权限策略和信任策略。
如果创建或更新数字员工失败，检查 RAM 用户是否具备数字员工操作权限和 ram:PassRole。
使用 RAM 用户在对应控制台打开原始数据，确认是否具备人工核验权限。

常见问题

RAM 用户能创建数字员工，但保存 RoleArn 时报权限不足

通常是缺少目标 RAM Role 的 ram:PassRole 权限，或 PassRole 的 Resource 没有覆盖该 RoleArn。请为该 RAM 用户授予目标 Role 的 ram:PassRole，并通过 acs:Service 限定 STAROps 相关服务。

数字员工会话提示数据权限不足

请检查数字员工绑定的 RAM Role，而不是只检查 RAM 用户权限。自定义数字员工运行时访问数据使用 RAM Role 身份，RAM Role 必须具备目标 SLS、CMS、ARMS 或云资源权限。

RAM Role 有数据权限，但用户控制台看不到数据

RAM Role 权限只授予数字员工运行时使用，不会自动授予 RAM 用户。若用户需要在控制台核验数据，请为该 RAM 用户单独授予数据源只读权限。

选择 ServiceRoleForCloudMonitor 后，为什么不能执行更新操作

ServiceRoleForCloudMonitor 对应的 AliyunServiceRoleForCloudMonitor 面向云监控 2.0 数据读取场景，适合查询、诊断、巡检和报告生成。它不包含云产品配置更新、资源变更等权限。需要执行更新操作时，请创建自定义角色并按需授予写操作权限。

RAM 用户有数据源权限，但数字员工还是查不到数据

自定义数字员工不会自动继承 RAM 用户的数据权限。请检查数字员工绑定的 RAM Role 是否具备对应数据源权限。

只读用户是否需要 PassRole

如果用户只查看数字员工、会话、长期任务和报告，通常不需要 ram:PassRole。如果复制上文"只读权限"模板，并且允许用户基于自定义数字员工发起会话，则需要保留 ram:PassRole，同时把 Resource 收敛到服务角色或指定自定义角色的 RoleArn。

可以把 PassRole 的 Resource 设置为星号吗

技术上可以，但不建议在生产环境长期使用。建议将 Resource 收敛到服务角色或 STAROps 专用自定义角色，并通过 acs:Service 限定只允许传递给 STAROps 相关服务。