本文介绍 STAROps 长期任务的权限配置方法。
RAM 用户负责创建和管理长期任务，自定义数字员工负责异步执行任务；任务执行时能访问什么数据、能执行什么动作，取决于数字员工绑定的 RAM Role。
适用对象
本文适用于需要为 RAM 用户配置长期任务权限的管理员。阿里云主账号默认具备长期任务管理权限，无需额外配置。
权限模型
长期任务用于周期性巡检、告警分析、报告生成等异步场景。用户负责创建和管理长期任务，数字员工负责执行长期任务。
长期任务不支持系统内置员工，只支持自定义数字员工。原因是长期任务会在用户离开当前会话后继续运行，异步执行必须有稳定运行主体；这个主体就是自定义数字员工绑定的 RAM Role。
配置长期任务时，只需要关注三件事：
-
RAM 用户是否具备长期任务、会话和产物的操作权限。
-
RAM 用户是否具备所选数字员工 RAM Role 的
ram:PassRole权限。 -
数字员工绑定的 RAM Role 是否具备任务执行所需的数据访问或资源操作权限。
长期任务本身不会扩大数字员工权限。任务能访问什么数据、能执行什么动作，仍取决于所选数字员工绑定的 RAM Role。
RAM Policy 示例
以下策略可直接复制到 RAM 自定义权限策略中。示例沿用线上帮助文档配置，便于复制使用；生产环境建议按任务、自定义数字员工、会话和产物范围收敛。若策略中包含 ram:PassRole 且 Resource 为 *，建议替换为长期任务所使用数字员工的服务角色或自定义角色 RoleArn。
完整管理权限
授予 RAM 用户长期任务的完整管理权限，包括创建、查看、修改、删除长期任务，以及查看事项和产物。
{
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"starops:CreateDigitalEmployee",
"starops:GetDigitalEmployee",
"starops:ListDigitalEmployees",
"starops:UpdateDigitalEmployee",
"starops:DeleteDigitalEmployee"
],
"Resource": [
"acs:starops:*:*:digitalemployee/*"
]
},
{
"Effect": "Allow",
"Action": [
"starops:CreateArtifactUploadToken",
"starops:GetArtifactDownloadUrl",
"starops:CreateChat",
"starops:CreateThread",
"starops:GetThread",
"starops:GetThreadData",
"starops:ListThreads",
"starops:UpdateThread",
"starops:DeleteThread"
],
"Resource": [
"acs:starops:*:*:digitalemployee/*",
"acs:starops:*:*:digitalemployee/*/thread/*"
]
},
{
"Effect": "Allow",
"Action": [
"starops:CreateDigitalEmployeeSkill",
"starops:GetDigitalEmployeeSkill",
"starops:ListDigitalEmployeeSkills",
"starops:UpdateDigitalEmployeeSkill",
"starops:DeleteDigitalEmployeeSkill",
"starops:ListDigitalEmployeeSkillVersions"
],
"Resource": [
"acs:starops:*:*:digitalemployee/*/skill/*"
]
},
{
"Effect": "Allow",
"Action": [
"starops:CreateMission",
"starops:GetMission",
"starops:ListMissions",
"starops:ListTasks",
"starops:UpdateMission",
"starops:DeleteMission"
],
"Resource": [
"acs:starops:*:*:mission/*"
]
},
{
"Effect": "Allow",
"Action": [
"starops:CreateMcpService",
"starops:GetMcpService",
"starops:ListMcpServices",
"starops:UpdateMcpService",
"starops:DeleteMcpService",
"starops:FetchRemoteMcpTools"
],
"Resource": [
"acs:starops:*:*:digitalemployee/*/mcpservice/*"
]
},
{
"Effect": "Allow",
"Action": [
"starops:GetArtifact",
"starops:ListArtifacts"
],
"Resource": [
"acs:starops:*:*:digitalemployee/*/artifact/*"
]
},
{
"Effect": "Allow",
"Action": [
"starops:GetCreditQuota",
"starops:SetCreditQuota"
],
"Resource": [
"acs:starops:*:*:quota/credit"
]
},
{
"Effect": "Allow",
"Action": [
"cms:CreateDigitalEmployee",
"cms:GetDigitalEmployee",
"cms:ListDigitalEmployees",
"cms:UpdateDigitalEmployee",
"cms:DeleteDigitalEmployee"
],
"Resource": [
"acs:cms:*:*:digitalemployee/*"
]
},
{
"Effect": "Allow",
"Action": [
"cms:CreateChat",
"cms:CreateThread",
"cms:GetThread",
"cms:GetThreadData",
"cms:ListThreads",
"cms:UpdateThread",
"cms:DeleteThread"
],
"Resource": [
"acs:cms:*:*:digitalemployee/*",
"acs:cms:*:*:digitalemployee/*/thread/*"
]
},
{
"Effect": "Allow",
"Action": [
"cms:CreateDigitalEmployeeSkill",
"cms:GetDigitalEmployeeSkill",
"cms:ListDigitalEmployeeSkills",
"cms:UpdateDigitalEmployeeSkill",
"cms:DeleteDigitalEmployeeSkill",
"cms:ListDigitalEmployeeSkillVersions"
],
"Resource": [
"acs:cms:*:*:digitalemployee/*/skill/*"
]
},
{
"Effect": "Allow",
"Action": [
"cms:CreateMission",
"cms:GetMission",
"cms:ListMissions",
"cms:ListTasks",
"cms:UpdateMission",
"cms:DeleteMission"
],
"Resource": [
"acs:cms:*:*:mission/*"
]
},
{
"Effect": "Allow",
"Action": [
"cms:CreateMcpService",
"cms:GetMcpService",
"cms:ListMcpServices",
"cms:UpdateMcpService",
"cms:DeleteMcpService",
"cms:FetchRemoteMcpTools"
],
"Resource": [
"acs:cms:*:*:digitalemployee/*/mcpservice/*"
]
},
{
"Effect": "Allow",
"Action": [
"cms:GetArtifact",
"cms:ListArtifacts"
],
"Resource": [
"acs:cms:*:*:digitalemployee/*/artifact/*"
]
},
{
"Effect": "Allow",
"Action": [
"cms:ListWorkspaces",
"cms:GetWorkspace",
"cms:GetEntityStore",
"cms:GetEntityStoreData"
],
"Resource": [
"acs:cms:*:*:workspace/*",
"acs:cms:*:*:entitystore/*",
"acs:cms:*:*:entitystoredata/*"
]
},
{
"Effect": "Allow",
"Action": [
"cms:GetCloudResourceData"
],
"Resource": [
"acs:cms:*:*:cloudresource"
]
},
{
"Action": [
"log:Get*",
"log:List*",
"log:Query*"
],
"Resource": "acs:log:*:*:*",
"Effect": "Allow"
},
{
"Effect": "Allow",
"Action": "ram:PassRole",
"Resource": "*",
"Condition": {
"StringEquals": {
"acs:Service": "operation-platform.aliyuncs.com"
}
}
},
{
"Effect": "Allow",
"Action": "ram:PassRole",
"Resource": "*",
"Condition": {
"StringEquals": {
"acs:Service": "cloudmonitor.aliyuncs.com"
}
}
}
]
}只读权限
授予 RAM 用户长期任务的只读权限，仅允许查看任务列表、详情、事项和产物，不允许创建、修改或删除长期任务。
线上只读模板中包含会话和 ram:PassRole 配置。如果用户只做审计查看，不需要发起会话或传递角色，可以删除 CreateChat、CreateThread 和 ram:PassRole 相关语句。
{
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"starops:GetDigitalEmployee",
"starops:ListDigitalEmployees"
],
"Resource": [
"acs:starops:*:*:digitalemployee/*"
]
},
{
"Effect": "Allow",
"Action": [
"starops:CreateArtifactUploadToken",
"starops:GetArtifactDownloadUrl",
"starops:CreateChat",
"starops:CreateThread",
"starops:GetThread",
"starops:GetThreadData",
"starops:ListThreads"
],
"Resource": [
"acs:starops:*:*:digitalemployee/*",
"acs:starops:*:*:digitalemployee/*/thread/*"
]
},
{
"Effect": "Allow",
"Action": [
"starops:GetDigitalEmployeeSkill",
"starops:ListDigitalEmployeeSkills",
"starops:ListDigitalEmployeeSkillVersions"
],
"Resource": [
"acs:starops:*:*:digitalemployee/*/skill/*"
]
},
{
"Effect": "Allow",
"Action": [
"starops:GetMission",
"starops:ListMissions",
"starops:ListTasks"
],
"Resource": [
"acs:starops:*:*:mission/*"
]
},
{
"Effect": "Allow",
"Action": [
"starops:GetMcpService",
"starops:ListMcpServices",
"starops:FetchRemoteMcpTools"
],
"Resource": [
"acs:starops:*:*:digitalemployee/*/mcpservice/*"
]
},
{
"Effect": "Allow",
"Action": [
"starops:GetArtifact",
"starops:ListArtifacts"
],
"Resource": [
"acs:starops:*:*:digitalemployee/*/artifact/*"
]
},
{
"Effect": "Allow",
"Action": [
"starops:GetCreditQuota"
],
"Resource": [
"acs:starops:*:*:quota/credit"
]
},
{
"Effect": "Allow",
"Action": [
"cms:GetDigitalEmployee",
"cms:ListDigitalEmployees"
],
"Resource": [
"acs:cms:*:*:digitalemployee/*"
]
},
{
"Effect": "Allow",
"Action": [
"cms:CreateChat",
"cms:CreateThread",
"cms:GetThread",
"cms:GetThreadData",
"cms:ListThreads"
],
"Resource": [
"acs:cms:*:*:digitalemployee/*",
"acs:cms:*:*:digitalemployee/*/thread/*"
]
},
{
"Effect": "Allow",
"Action": [
"cms:GetDigitalEmployeeSkill",
"cms:ListDigitalEmployeeSkills",
"cms:ListDigitalEmployeeSkillVersions"
],
"Resource": [
"acs:cms:*:*:digitalemployee/*/skill/*"
]
},
{
"Effect": "Allow",
"Action": [
"cms:GetMission",
"cms:ListMissions",
"cms:ListTasks"
],
"Resource": [
"acs:cms:*:*:mission/*"
]
},
{
"Effect": "Allow",
"Action": [
"cms:GetMcpService",
"cms:ListMcpServices",
"cms:FetchRemoteMcpTools"
],
"Resource": [
"acs:cms:*:*:digitalemployee/*/mcpservice/*"
]
},
{
"Effect": "Allow",
"Action": [
"cms:GetArtifact",
"cms:ListArtifacts"
],
"Resource": [
"acs:cms:*:*:digitalemployee/*/artifact/*"
]
},
{
"Effect": "Allow",
"Action": [
"cms:ListWorkspaces",
"cms:GetWorkspace",
"cms:GetEntityStore",
"cms:GetEntityStoreData"
],
"Resource": [
"acs:cms:*:*:workspace/*",
"acs:cms:*:*:entitystore/*",
"acs:cms:*:*:entitystoredata/*"
]
},
{
"Effect": "Allow",
"Action": [
"cms:GetCloudResourceData"
],
"Resource": [
"acs:cms:*:*:cloudresource"
]
},
{
"Action": [
"log:Get*",
"log:List*",
"log:Query*"
],
"Resource": "acs:log:*:*:*",
"Effect": "Allow"
},
{
"Effect": "Allow",
"Action": "ram:PassRole",
"Resource": "*",
"Condition": {
"StringEquals": {
"acs:Service": "operation-platform.aliyuncs.com"
}
}
},
{
"Effect": "Allow",
"Action": "ram:PassRole",
"Resource": "*",
"Condition": {
"StringEquals": {
"acs:Service": "cloudmonitor.aliyuncs.com"
}
}
}
]
}数字员工 + 长期任务组合权限
授予 RAM 用户数字员工和长期任务的完整操作权限。适用于需要同时管理自定义数字员工和长期任务的运维管理员。
{
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"starops:CreateDigitalEmployee",
"starops:GetDigitalEmployee",
"starops:ListDigitalEmployees",
"starops:UpdateDigitalEmployee",
"starops:DeleteDigitalEmployee"
],
"Resource": [
"acs:starops:*:*:digitalemployee/*"
]
},
{
"Effect": "Allow",
"Action": [
"starops:CreateArtifactUploadToken",
"starops:GetArtifactDownloadUrl",
"starops:CreateChat",
"starops:CreateThread",
"starops:GetThread",
"starops:GetThreadData",
"starops:ListThreads",
"starops:UpdateThread",
"starops:DeleteThread"
],
"Resource": [
"acs:starops:*:*:digitalemployee/*",
"acs:starops:*:*:digitalemployee/*/thread/*"
]
},
{
"Effect": "Allow",
"Action": [
"starops:CreateDigitalEmployeeSkill",
"starops:GetDigitalEmployeeSkill",
"starops:ListDigitalEmployeeSkills",
"starops:UpdateDigitalEmployeeSkill",
"starops:DeleteDigitalEmployeeSkill",
"starops:ListDigitalEmployeeSkillVersions"
],
"Resource": [
"acs:starops:*:*:digitalemployee/*/skill/*"
]
},
{
"Effect": "Allow",
"Action": [
"starops:CreateMission",
"starops:GetMission",
"starops:ListMissions",
"starops:ListTasks",
"starops:UpdateMission",
"starops:DeleteMission"
],
"Resource": [
"acs:starops:*:*:mission/*"
]
},
{
"Effect": "Allow",
"Action": [
"starops:CreateMcpService",
"starops:GetMcpService",
"starops:ListMcpServices",
"starops:UpdateMcpService",
"starops:DeleteMcpService",
"starops:FetchRemoteMcpTools"
],
"Resource": [
"acs:starops:*:*:digitalemployee/*/mcpservice/*"
]
},
{
"Effect": "Allow",
"Action": [
"starops:GetArtifact",
"starops:ListArtifacts"
],
"Resource": [
"acs:starops:*:*:digitalemployee/*/artifact/*"
]
},
{
"Effect": "Allow",
"Action": [
"starops:GetCreditQuota",
"starops:SetCreditQuota"
],
"Resource": [
"acs:starops:*:*:quota/credit"
]
},
{
"Effect": "Allow",
"Action": [
"cms:CreateDigitalEmployee",
"cms:GetDigitalEmployee",
"cms:ListDigitalEmployees",
"cms:UpdateDigitalEmployee",
"cms:DeleteDigitalEmployee"
],
"Resource": [
"acs:cms:*:*:digitalemployee/*"
]
},
{
"Effect": "Allow",
"Action": [
"cms:CreateChat",
"cms:CreateThread",
"cms:GetThread",
"cms:GetThreadData",
"cms:ListThreads",
"cms:UpdateThread",
"cms:DeleteThread"
],
"Resource": [
"acs:cms:*:*:digitalemployee/*",
"acs:cms:*:*:digitalemployee/*/thread/*"
]
},
{
"Effect": "Allow",
"Action": [
"cms:CreateDigitalEmployeeSkill",
"cms:GetDigitalEmployeeSkill",
"cms:ListDigitalEmployeeSkills",
"cms:UpdateDigitalEmployeeSkill",
"cms:DeleteDigitalEmployeeSkill",
"cms:ListDigitalEmployeeSkillVersions"
],
"Resource": [
"acs:cms:*:*:digitalemployee/*/skill/*"
]
},
{
"Effect": "Allow",
"Action": [
"cms:CreateMission",
"cms:GetMission",
"cms:ListMissions",
"cms:ListTasks",
"cms:UpdateMission",
"cms:DeleteMission"
],
"Resource": [
"acs:cms:*:*:mission/*"
]
},
{
"Effect": "Allow",
"Action": [
"cms:CreateMcpService",
"cms:GetMcpService",
"cms:ListMcpServices",
"cms:UpdateMcpService",
"cms:DeleteMcpService",
"cms:FetchRemoteMcpTools"
],
"Resource": [
"acs:cms:*:*:digitalemployee/*/mcpservice/*"
]
},
{
"Effect": "Allow",
"Action": [
"cms:GetArtifact",
"cms:ListArtifacts"
],
"Resource": [
"acs:cms:*:*:digitalemployee/*/artifact/*"
]
},
{
"Effect": "Allow",
"Action": [
"cms:ListWorkspaces",
"cms:GetWorkspace",
"cms:GetEntityStore",
"cms:GetEntityStoreData"
],
"Resource": [
"acs:cms:*:*:workspace/*",
"acs:cms:*:*:entitystore/*",
"acs:cms:*:*:entitystoredata/*"
]
},
{
"Effect": "Allow",
"Action": [
"cms:GetCloudResourceData"
],
"Resource": [
"acs:cms:*:*:cloudresource"
]
},
{
"Action": [
"log:Get*",
"log:List*",
"log:Query*"
],
"Resource": "acs:log:*:*:*",
"Effect": "Allow"
},
{
"Effect": "Allow",
"Action": "ram:PassRole",
"Resource": "*",
"Condition": {
"StringEquals": {
"acs:Service": "operation-platform.aliyuncs.com"
}
}
},
{
"Effect": "Allow",
"Action": "ram:PassRole",
"Resource": "*",
"Condition": {
"StringEquals": {
"acs:Service": "cloudmonitor.aliyuncs.com"
}
}
}
]
}权限验证
完成配置后，按以下顺序验证：
-
RAM 用户能否进入长期任务页面。
-
RAM 用户能否查看任务列表和任务详情。
-
RAM 用户能否创建一个测试长期任务。
-
RAM 用户能否选择目标自定义数字员工。
-
所选自定义数字员工是否已绑定 RAM Role。
-
创建或运行任务时是否出现 PassRole 相关错误。
-
任务是否能读取目标 Workspace、日志或云资源数据。
-
任务执行结束后，RAM 用户能否查看报告和产物。
-
如果需要人工核验，RAM 用户能否在对应控制台查看原始数据。
常见问题
能创建 Mission 但执行失败
Mission 创建权限只表示用户能创建长期任务。长期任务执行失败通常与自定义数字员工运行权限有关。请检查任务是否选择了自定义数字员工，以及该员工绑定的 RAM Role 是否具备目标数据和资源权限。
能看任务但看不到报告
请检查 RAM 用户是否具备报告和产物的 Get/List 权限。长期任务、会话和报告是不同 STAROps 资源，能看任务不等于能看报告。
任务能运行但查不到日志
请检查执行任务的自定义数字员工是否具备 SLS 查询权限。长期任务运行时使用自定义数字员工绑定的 RAM Role，该 RAM Role 必须具备对应日志权限。
为什么不能选择系统内置员工创建长期任务
系统内置员工没有客户侧可配置的 RAM Role，只适合当前用户发起的同步会话。长期任务需要异步执行，异步执行必须有稳定运行主体，因此只能选择绑定 RAM Role 的自定义数字员工。
使用自定义数字员工创建任务时报 PassRole 错误
请检查 RAM 用户是否对该数字员工绑定的 RAM Role 具备 ram:PassRole。建议将 Resource 指定到目标 RoleArn，并通过 acs:Service 限定 STAROps 相关服务。
只读用户是否可以创建长期任务
不可以。只读用户只应具备 Mission Get/List、任务状态查看、报告查看等权限，不应授予 Mission Create/Update/Delete，也不应授予 ram:PassRole。