Список стандартных ролей и политик

Policy/Role Name	Type	Description
AOM Admin { "Version": "1.1", "Statement": [ { "Action": [ "aom:*:*", "apm:*:*" ], "Effect": "Allow" } ] }	System-defined policy	All permissions of Application Operations Monitor service
AOM Viewer { "Version": "1.1", "Statement": [ { "Action": [ "aom:*:list", "aom:*:get", "apm:*:list", "apm:*:get" ], "Effect": "Allow" } ] }	System-defined policy	The read-only permissions to Application Operations Monitor service
APIG Administrator { "Version": "1.0", "Statement": [ { "Action": [ "*" ], "Effect": "Allow" } ] }	System-defined policy	APIG Administrator
APIG FullAccess { "Version": "1.1", "Statement": [ { "Action": [ "apig:*:*", "vpc:*:get*", "vpc:*:list*", "vpc:ports:create", "vpc:ports:update", "vpc:ports:delete", "vpc:publicIps:update", "FunctionGraph:function:listVersion", "FunctionGraph:function:list", "FunctionGraph:function:getConfig", "ecs:servers:list", "lts:groups:list", "lts:logs:list", "lts:topics:list" ], "Effect": "Allow" } ] }	System-defined policy	All permissions for API Gateway
APIG ReadOnlyAccess { "Version": "1.1", "Statement": [ { "Action": [ "apig:*:get*", "apig:*:list*", "vpc:*:get*", "vpc:*:list*", "lts:groups:list", "lts:topics:list" ], "Effect": "Allow" } ] }	System-defined policy	Read-only permissions for viewing API Gateway
APM Admin { "Version": "1.1", "Statement": [ { "Action": [ "aom:*:*", "apm:*:*" ], "Effect": "Allow" } ] }	System-defined policy	All permissions of Application Performance Monitor service.
APM Administrator { "Version": "1.0", "Statement": [ { "Action": [ "APM:monitordata:*" ], "Effect": "Allow" } ] }	System-defined role	Application Performance Monitor Administrator
APM Viewer { "Version": "1.1", "Statement": [ { "Action": [ "aom:*:list", "aom:*:get", "apm:*:list", "apm:*:get" ], "Effect": "Allow" } ] }	System-defined policy	The read-only permissions to Application Performance Monitor service
Agent Operator { "Version": "1.0", "Statement": [ { "Action": [ "iam:tokens:assume" ], "Effect": "Allow" } ] }	System-defined role	Permissions for switching roles to access services of a delegating account
AutoScaling Admin { "Version": "1.1", "Statement": [ { "Action": [ "as:*:*", "evs:*:get", "evs:*:list", "vpc:*:get", "vpc:*:list", "ims:*:get*", "ims:*:list*", "ecs:*:get", "ecs:*:list", "eps:*:list" ], "Effect": "Allow" } ] }	System-defined policy	All permissions template of AutoScaling Service
AutoScaling Administrator { "Version": "1.0", "Statement": [ { "Action": [ "as:*:*", "evs:*:get", "evs:*:list", "vpc:*:get", "vpc:*:list", "ims:*:get*", "ims:*:list*", "ecs:*:get", "ecs:*:list", "eps:*:list" ], "Effect": "Allow" } ], "Depends": [ { "catalog": "ELB", "display_name": "ELB Administrator" }, { "catalog": "CES", "display_name": "CES Administrator" } ] }	System-defined role	AutoScaling Administrator
AutoScaling FullAccess { "Version": "1.1", "Statement": [ { "Action": [ "as:*:*", "evs:*:get", "evs:*:list", "vpc:*:get", "vpc:*:list", "ims:*:get*", "ims:*:list*", "ecs:*:get", "ecs:*:list", "ecs:serverVolumes:use", "ecs:serverGroups:manage", "ecs:serverKeypairs:*", "eps:*:list", "elb:*:get", "elb:*:list", "ces:*:*", "smn:*:list", "kps:domainKeypairs:*", "deh:*:list", "deh:*:get" ], "Effect": "Allow" } ] }	System-defined policy	Full permissions for Auto Scaling
AutoScaling Viewer { "Version": "1.1", "Statement": [ { "Action": [ "as:*:list", "as:*:get", "dss:*:get", "dss:*:list", "evs:*:get*", "evs:*:list", "vpc:*:get*", "vpc:*:list*", "ims:*:get*", "ims:*:list*", "vpc:*:get", "vpc:*:list", "ecs:*:get*", "ecs:*:list*", "eps:*:list" ], "Effect": "Allow" } ] }	System-defined policy	The read-only permissions to all AutoScaling resources, which can be used for statistics and survey
BMS Admin { "Version": "1.1", "Statement": [ { "Action": [ "bms:*:*", "ecs:*:get*", "ecs:*:list*", "evs:*:get", "evs:*:list", "evs:volumes:use", "evs:snapshots:create", "evs:volumes:update", "vpc:*:get", "vpc:*:list", "vpc:networks:create", "vpc:networks:update", "vpc:subnets:update", "vpc:subnets:create", "vpc:ports:*", "vpc:pulicIps:*", "vpc:routers:get", "vpc:routers:update", "vpc:securityGroups:*", "vpc:securityGroupRules:*", "vpc:floatingIps:*", "ims:images:create", "ims:images:delete", "ims:images:get", "ims:images:list", "ims:images:update", "ims:images:upload" ], "Effect": "Allow" } ] }	System-defined policy	All permissions of BMS service
BMS CommonOperations { "Version": "1.1", "Statement": [ { "Action": [ "bms:*:get*", "bms:*:list*", "bms:*:start", "bms:*:stop", "bms:*:reboot", "bms:servers:resetServerPwd", "bms:servers:attachVolume", "bms:servers:detachVolume", "ecs:*:get*", "ecs:*:list*", "evs:*:get", "evs:*:list", "evs:volumes:get", "evs:volumes:use", "evs:snapshots:create", "evs:volumes:update", "vpc:*:get", "vpc:*:list", "vpc:networks:create", "vpc:networks:update", "vpc:subnets:update", "vpc:subnets:create", "vpc:ports:*", "vpc:routers:get", "vpc:routers:update", "vpc:securityGroups:*", "vpc:securityGroupRules:*", "vpc:floatingIps:*", "ims:images:get", "ims:images:list", "ecs:serverVolumes:use" ], "Effect": "Allow" } ] }	System-defined policy	Permissions for basic BMS operations, such as starting, stopping, restarting a BMS, querying BMS details, and attaching data disks to or detaching data disks from a BMS
BMS FullAccess { "Version": "1.1", "Statement": [ { "Action": [ "bms:*:*", "ecs:*:get*", "ecs:*:list*", "evs:*:get", "evs:*:list", "evs:volumes:use", "evs:snapshots:create", "evs:volumes:update", "ecs:serverVolumes:use", "vpc:*:get", "vpc:*:list", "vpc:networks:create", "vpc:networks:update", "vpc:subnets:update", "vpc:subnets:create", "vpc:ports:*", "vpc:publicIps:*", "vpc:routers:get", "vpc:routers:update", "vpc:securityGroups:*", "vpc:securityGroupRules:*", "vpc:floatingIps:*", "ims:images:create", "ims:images:delete", "ims:images:get", "ims:images:list", "ims:images:update", "ims:images:upload", "ecs:serverVolumes:use" ], "Effect": "Allow" } ] }	System-defined policy	All permissions of BMS service
BMS ReadOnlyAccess { "Version": "1.1", "Statement": [ { "Action": [ "bms:*:get*", "bms:*:list*", "ecs:*:get*", "ecs:*:list*", "evs:*:get*", "evs:*:list*", "vpc:*:get*", "vpc:*:list*", "ims:*:get*", "ims:*:list*", "ecs:serverGroups:manage", "ecs:serverVolumes:use" ], "Effect": "Allow" } ] }	System-defined policy	The read-only permissions to all BMS resources, which can be used for statistics and survey.
BMS User { "Version": "1.1", "Statement": [ { "Action": [ "bms:*:get*", "bms:*:list*", "bms:*:start", "bms:*:stop", "bms:*:reboot", "bms:servers:resetServerPwd", "bms:servers:attachVolume", "bms:servers:detachVolume", "ecs:*:get*", "ecs:*:list*", "evs:*:get", "evs:*:list", "evs:volumes:use", "evs:snapshots:create", "evs:volumes:update", "vpc:*:get", "vpc:*:list", "vpc:networks:create", "vpc:networks:update", "vpc:subnets:update", "vpc:subnets:create", "vpc:ports:*", "vpc:routers:get", "vpc:routers:update", "vpc:securityGroups:*", "vpc:securityGroupRules:*", "vpc:floatingIps:*", "ims:images:get", "ims:images:list" ], "Effect": "Allow" } ] }	System-defined policy	Common permissions of BMS service, except installation, delete, reinstallation and so on.
BMS Viewer { "Version": "1.1", "Statement": [ { "Action": [ "bms:*:get*", "bms:*:list*", "ecs:*:get*", "ecs:*:list*", "evs:*:get*", "evs:*:list*", "vpc:*:get*", "vpc:*:list*", "ims:*:get*", "ims:*:list*" ], "Effect": "Allow" } ] }	System-defined policy	The read-only permissions to all BMS resources, which can be used for statistics and survey
CBH FullAccess { "Version": "1.1", "Statement": [ { "Action": [ "cbh:*:*", "vpc:subnets:get", "vpc:publicIps:list", "vpc:vpcs:list", "vpc:securityGroups:get", "vpc:firewallGroups:get", "vpc:firewallPolicies:get", "vpc:firewallRules:get", "vpc:ports:get", "vpc:publicips:update", "vpc:securityGroups:create", "vpc:firewallRules:create", "vpc:firewallPolicies:addRule", "ecs:cloudServerFlavors:get", "evs:types:get" ], "Effect": "Allow" } ] }	System-defined policy	All permissions for all CBH instances
CBH ReadOnlyAccess { "Version": "1.1", "Statement": [ { "Action": [ "cbh:*:list*", "vpc:publicIps:list", "vpc:vpcs:list", "vpc:securityGroups:get", "vpc:subnets:get" ], "Effect": "Allow" } ] }	System-defined policy	Read-only permissions for CBH instances. Users granted with read-only permissions can only view but not configure the CBH service
CBR Admin { "Version": "1.1", "Statement": [ { "Action": [ "cbr:*:get*", "cbr:*:list*", "cbr:backups:queryReplicationCapability", "cbr:vaults:associatePolicy", "cbr:vaults:update", "cbr:vaults:delete", "cbr:vaults:removeResources", "cbr:vaults:addResources", "cbr:vaults:create", "cbr:vaults:dissociatePolicy", "cbr:vaults:sync", "cbr:vaults:replicate", "cbr:vaults:backup", "cbr:vaults:updateOrder", "cbr:vaults:migrateResources", "cbr:backups:checkAgent", "cbr:backups:delete", "cbr:backups:update", "cbr:backups:restore", "cbr:backups:replicate", "cbr:backups:sync", "cbr:member:create", "cbr:member:delete", "cbr:member:update", "cbr:policies:create", "cbr:policies:update", "cbr:policies:delete", "cbr:vaults:bulkCreateOrDeleteTags", "cbr:vaults:deleteTags", "cbr:vaults:setTags", "ecs:*:get*", "ecs:*:list*", "evs:*:get*", "evs:*:list*", "ims:*:get*", "ims:*:list*", "ces:*:get*", "ces:*:list*", "sfsturbo:*:get*", "sfsturbo:*:list*" ], "Effect": "Allow" } ] }	System-defined policy	All permissions of Cloud Backup and Recovery service
CBR User { "Version": "1.1", "Statement": [ { "Action": [ "cbr:*:get*", "cbr:*:list*", "cbr:backups:queryReplicationCapability", "cbr:vaults:associatePolicy", "cbr:vaults:update", "cbr:vaults:delete", "cbr:vaults:removeResources", "cbr:vaults:addResources", "cbr:vaults:create", "cbr:vaults:dissociatePolicy", "cbr:vaults:sync", "cbr:vaults:replicate", "cbr:vaults:backup", "cbr:vaults:updateOrder", "cbr:vaults:migrateResources", "cbr:backups:checkAgent", "cbr:backups:delete", "cbr:backups:update", "cbr:backups:restore", "cbr:backups:replicate", "cbr:backups:sync", "cbr:member:create", "cbr:member:delete", "cbr:member:update", "cbr:vaults:bulkCreateOrDeleteTags", "cbr:vaults:deleteTags", "cbr:vaults:setTags", "ecs:*:get*", "ecs:*:list*", "evs:*:get*", "evs:*:list*", "ims:*:get*", "ims:*:list*", "ces:*:get*", "ces:*:list*", "sfsturbo:*:get*", "sfsturbo:*:list*" ], "Effect": "Allow" } ] }	System-defined policy	General permissions of Cloud Backup and Recovery service (exclude policy create, update, and delete permission)
CBR Viewer { "Version": "1.1", "Statement": [ { "Action": [ "cbr:*:get*", "cbr:*:list*", "ecs:*:get*", "ecs:*:list*", "evs:*:get*", "evs:*:list*", "ims:*:get*", "ims:*:list*", "ces:*:get*", "ces:*:list*", "sfsturbo:*:get*", "sfsturbo:*:list*" ], "Effect": "Allow" } ] }	System-defined policy	The read-only permissions to all Cloud Backup and Recovery resources
CCE Administrator { "Version": "1.0", "Statement": [ { "Action": [ "CCE:cluster:*", "CCE:app:*", "CCE:container_registry:*", "CCE:storage:*", "CCE:application_template:*" ], "Effect": "Allow" } ], "Depends": [ { "catalog": "BASE", "display_name": "Tenant Guest" }, { "catalog": "BASE", "display_name": "Server Administrator" }, { "catalog": "ELB", "display_name": "ELB Administrator" }, { "catalog": "OBS", "display_name": "OBS Administrator" }, { "catalog": "SFS", "display_name": "SFS Administrator" }, { "catalog": "SWR", "display_name": "SWR Admin" }, { "catalog": "APM", "display_name": "APM FullAccess" } ] }	System-defined role	CCE Administrator
CCE FullAccess { "Version": "1.1", "Statement": [ { "Action": [ "cce:*:*", "ecs:*:*", "evs:*:*", "vpc:*:*", "sfs:*:get*", "sfs:shares:ShareAction", "aom:*:get", "aom:*:list", "aom:autoScalingRule:*", "apm:icmgr:*", "sfsturbo:*:get*", "sfsturbo:shares:ShareAction" ], "Effect": "Allow" } ] }	System-defined policy	Common operation permissions on CCE cluster resources, excluding the namespace-level permissions for the clusters (with Kubernetes RBAC enabled) and the privileged administrator operations, such as agency configuration and cluster certificate generation
CCE ReadOnlyAccess { "Version": "1.1", "Statement": [ { "Action": [ "cce:*:get", "cce:*:list", "cce:kubernetes:*", "ecs:*:get*", "ecs:*:list*", "bms:*:get*", "bms:*:list*", "evs:*:get*", "evs:*:list", "evs:*:count", "vpc:*:get", "vpc:*:list", "sfs:*:get*", "sfs:shares:ShareAction", "aom:*:get", "aom:*:list", "aom:autoScalingRule:*", "sfsturbo:*:get*", "sfsturbo:shares:ShareAction" ], "Effect": "Allow" } ] }	System-defined policy	Permissions to view CCE cluster resources, excluding the namespace-level permissions of the clusters (with Kubernetes RBAC enabled)
CDM CommonOperations { "Version": "1.1", "Statement": [ { "Action": [ "cdm:cluster:list", "cdm:cluster:get", "cdm:job:*", "cdm:link:*", "ecs:*:get*", "ecs:*:list*", "vpc:*:get*", "vpc:*:list*", "evs:*:get*", "evs:*:list*", "bss:*:view*", "ces:*:get*", "ces:*:list*" ], "Effect": "Allow" } ] }	System-defined policy	Operation permissions on Cloud Data Migration jobs and links
CDM FullAccess { "Version": "1.1", "Statement": [ { "Action": [ "cdm:*:*", "ecs:*:*", "vpc:*:get*", "vpc:*:list*", "vpc:ports:*", "vpc:publicIps:update", "evs:*:*", "bss:*:view*", "bss:order:update", "bss:order:pay", "ces:*:get*", "ces:*:list*" ], "Effect": "Allow" } ] }	System-defined policy	All permissions on Cloud Data Migration
CDM FullAccessExceptEIPUpdating { "Version": "1.1", "Statement": [ { "Action": [ "cdm:cluster:get", "cdm:cluster:list", "cdm:cluster:create", "cdm:cluster:modify", "cdm:cluster:delete", "cdm:cluster:operate", "cdm:job:operate", "cdm:link:operate", "ecs:*:*", "vpc:*:get*", "vpc:*:list*", "vpc:ports:*", "evs:*:*", "bss:*:view*", "bss:order:update", "bss:order:pay", "ces:*:get*", "ces:*:list*" ], "Effect": "Allow" } ] }	System-defined policy	All permissions on Cloud Data Migration except elastic IP address binding and unbinding
CDM ReadOnlyAccess { "Version": "1.1", "Statement": [ { "Action": [ "cdm:cluster:list", "cdm:cluster:get", "ecs:*:get*", "ecs:*:list*", "vpc:*:get*", "vpc:*:list*", "evs:*:get*", "evs:*:list*", "bss:*:view*", "ces:*:get*", "ces:*:list*" ], "Effect": "Allow" } ] }	System-defined policy	Read-only permission on Cloud Data Migration
CES Admin { "Version": "1.1", "Statement": [ { "Action": [ "ces:*:*", "*:*:get*", "*:*:list*" ], "Effect": "Allow" } ] }	System-defined policy	All permissions of Cloud Eye service
CES Administrator { "Version": "1.0", "Statement": [ { "Action": [ "ces:Alarm:*", "ces:Metrics:*", "ces:Notification:*", "ces:Generic:*" ], "Effect": "Allow" } ], "Depends": [ { "catalog": "BASE", "display_name": "Tenant Guest" }, { "catalog": "OBS", "display_name": "Tenant Administrator" } ] }	System-defined role	CloudEye Service Administrator
CES Viewer { "Version": "1.1", "Statement": [ { "Action": [ "ces:*:get*", "ces:*:list*", "*:*:get*", "*:*:list*" ], "Effect": "Allow" } ] }	System-defined policy	The read-only permissions to all Cloud Eye service
CGS FullAccess { "Version": "1.1", "Statement": [ { "Action": [ "cgs:*:*", "cce:cluster:list*", "cce:node:list*", "cce:kubernetes:*" ], "Effect": "Allow" } ] }	System-defined policy	Full permissions of Container Guard Service
CGS ReadOnlyAccess { "Version": "1.1", "Statement": [ { "Action": [ "cgs:*:get*", "cgs:*:list*", "cce:cluster:list*", "cce:node:list*", "cce:kubernetes:*" ], "Effect": "Allow" } ] }	System-defined policy	Read-only permissions for Container Guard Service
CSE Admin { "Version": "1.1", "Statement": [ { "Action": [ "cse:*:*", "ecs:*:*", "evs:*:*", "vpc:*:*" ], "Effect": "Allow" } ] }	System-defined policy	All permissions of CSE service
CSE Viewer { "Version": "1.1", "Statement": [ { "Action": [ "cse:*:get", "cse:*:list", "ecs:*:get", "ecs:*:list", "evs:*:get", "evs:*:list", "vpc:*:get", "vpc:*:list" ], "Effect": "Allow" } ] }	System-defined policy	The read-only permissions to all CSE resources
CSS Administrator { "Version": "1.1", "Statement": [ { "Action": [ "css:*:*" ], "Effect": "Allow" } ] }	System-defined role	Cloud Search Service Administrator
CSS FullAccess { "Version": "1.1", "Statement": [ { "Action": [ "css:*:*", "vpc:securityGroups:get", "vpc:securityGroups:create", "vpc:securityGroups:delete", "vpc:securityGroupRules:get", "vpc:securityGroupRules:create", "vpc:securityGroupRules:delete", "vpc:vpcs:list", "vpc:privateIps:list", "vpc:ports:get", "vpc:ports:create", "vpc:ports:update", "vpc:ports:delete", "vpc:quotas:list", "vpc:subnets:get", "ecs:cloudServerFlavors:get", "ecs:serverInterfaces:use", "ecs:cloudServers:addNics", "ecs:quotas:get", "evs:types:get", "evs:quotas:get" ], "Effect": "Allow" } ] }	System-defined policy	All permissions for Cloud Search Service
CSS ReadOnlyAccess { "Version": "1.1", "Statement": [ { "Action": [ "css:*:get*", "css:*:list*", "vpc:securityGroups:get", "vpc:securityGroupRules:get", "vpc:vpcs:list", "vpc:privateIps:list", "vpc:ports:get", "vpc:quotas:list", "vpc:subnets:get", "ecs:cloudServerFlavors:get", "ecs:quotas:get", "evs:types:get", "evs:quotas:get" ], "Effect": "Allow" } ] }	System-defined policy	Read-only permissions for viewing Cloud Search Service
CTS Administrator { "Version": "1.0", "Statement": [ { "Action": [ "CTS:Tracker:*", "CTS:Trace:*" ], "Effect": "Allow" } ], "Depends": [ { "catalog": "BASE", "display_name": "Tenant Guest" }, { "catalog": "OBS", "display_name": "Tenant Administrator" } ] }	System-defined role	CloudTrace Service Administrator
CTS FullAccess { "Version": "1.1", "Statement": [ { "Action": [ "cts:*:*", "kms:cmk:list", "kms:cmk:get", "lts:groups:create", "lts:groups:get", "lts:groups:list", "lts:topics:create", "lts:topics:get", "lts:topics:list", "lts:logstreams:list", "smn:topic:list", "obs:bucket:GetLifecycleConfiguration", "obs:bucket:GetBucketAcl", "obs:bucket:PutBucketAcl", "obs:bucket:HeadBucket", "obs:bucket:PutLifecycleConfiguration", "obs:bucket:CreateBucket", "obs:bucket:ListAllMyBuckets" ], "Effect": "Allow" } ] }	System-defined policy	Full permissions for Cloud Trace Service
CTS ReadOnlyAccess { "Version": "1.1", "Statement": [ { "Action": [ "cts:*:get*", "cts:*:list*", "kms:cmk:list", "kms:cmk:get", "lts:groups:get", "lts:groups:list", "lts:topics:get", "lts:topics:list", "lts:logstreams:list", "smn:topic:list", "obs:bucket:GetBucketAcl", "obs:bucket:HeadBucket", "obs:bucket:ListAllMyBuckets" ], "Effect": "Allow" } ] }	System-defined policy	Read-only permissions for Cloud Trace Service
DAS FullAccess { "Version": "1.1", "Statement": [ { "Action": [ "das:*:*", "ecs:cloudServers:list", "rds:instance:list", "dds:instance:list", "taurus:instance:list", "nosql:instance:list", "gaussdb:instance:list", "ddm:instance:list", "ddm:instance:get" ], "Effect": "Allow" } ] }	System-defined policy	Full permissions for Data Admin Service
DAYU Administrator { "Version": "1.0", "Statement": [ { "Action": [ "DAYU:*:*" ], "Effect": "Allow" } ], "Depends": [ { "catalog": "VPC", "display_name": "VPC Administrator" }, { "catalog": "DWS", "display_name": "DWS Administrator" }, { "catalog": "KMS", "display_name": "KMS Administrator" }, { "catalog": "DLI", "display_name": "DLI Service Admin" }, { "catalog": "MRS", "display_name": "MRS Administrator" }, { "catalog": "CLOUDTABLE", "display_name": "CLOUDTABLE Administrator" }, { "catalog": "CS", "display_name": "CS Tenant Admin" }, { "catalog": "GES", "display_name": "GES Administrator" }, { "catalog": "RDS", "display_name": "RDS Administrator" }, { "catalog": "APIG", "display_name": "APIG Administrator" }, { "catalog": "SMN", "display_name": "SMN Administrator" }, { "catalog": "EVS", "display_name": "EVS Admin" }, { "catalog": "BSS", "display_name": "BSS Administrator" }, { "catalog": "ECS", "display_name": "ECS Admin" }, { "catalog": "OBS", "display_name": "OBS Operator" } ] }	System-defined role	DAYU Administrator
DAYU User { "Version": "1.0", "Statement": [ { "Action": [ "DAYU:*:*" ], "Effect": "Allow" } ], "Depends": [ { "catalog": "VPC", "display_name": "VPC Administrator" }, { "catalog": "DWS", "display_name": "DWS Administrator" }, { "catalog": "KMS", "display_name": "KMS Administrator" }, { "catalog": "DLI", "display_name": "DLI Service Admin" }, { "catalog": "MRS", "display_name": "MRS Administrator" }, { "catalog": "CLOUDTABLE", "display_name": "CLOUDTABLE Administrator" }, { "catalog": "CS", "display_name": "CS Tenant Admin" }, { "catalog": "GES", "display_name": "GES Administrator" }, { "catalog": "RDS", "display_name": "RDS Administrator" }, { "catalog": "APIG", "display_name": "APIG Administrator" }, { "catalog": "SMN", "display_name": "SMN Administrator" }, { "catalog": "EVS", "display_name": "EVS Admin" }, { "catalog": "BSS", "display_name": "BSS Administrator" }, { "catalog": "ECS", "display_name": "ECS Admin" }, { "catalog": "OBS", "display_name": "OBS Operator" } ] }	System-defined role	DAYU User
DBSS FullAccess { "Version": "1.1", "Statement": [ { "Action": [ "dbss:*:*", "vpc:subnets:get", "vpc:publicips:update", "vpc:securityGroups:get", "vpc:vpcs:get", "vpc:vpcs:list", "vpc:securityGroupRules:create", "vpc:ports:create", "vpc:ports:update", "vpc:ports:get", "vpc:ports:delete", "evs:types:get", "ecs:cloudServerFlavors:get", "ecs:availabilityZones:list", "ecs:serverInterfaces:use" ], "Effect": "Allow" } ] }	System-defined policy	Full permissions for Database Security Service
DBSS ReadOnlyAccess { "Version": "1.1", "Statement": [ { "Action": [ "dbss:*:list*", "vpc:publicIps:list", "vpc:vpcs:list", "vpc:securityGroups:get", "vpc:subnets:get" ], "Effect": "Allow" } ] }	System-defined policy	Read-only permissions for Database Security Service
DCS Admin { "Version": "1.1", "Statement": [ { "Action": [ "dcs:*:*", "vpc:*:*", "ces:*:*", "ecs:*:get*", "ecs:*:list*", "ecs:cloudServerNics:update", "ecs:serverInterfaces:use" ], "Effect": "Allow" } ] }	System-defined policy	All permissions of DCS service
DCS Administrator { "Version": "1.0", "Statement": [ { "Action": [ "DCS:instance:*", "DCS:quota:*" ], "Effect": "Allow" } ], "Depends": [ { "catalog": "BASE", "display_name": "Server Administrator" }, { "catalog": "BASE", "display_name": "Tenant Guest" } ] }	System-defined role	Distributed Cache Service Administrator
DCS AgencyAccess { "Version": "1.1", "Statement": [ { "Action": [ "vpc:ports:get", "vpc:ports:create", "vpc:ports:update", "vpc:subnets:get" ], "Effect": "Allow" } ] }	System-defined policy	Permissions to assign to DCS agencies
DCS FullAccess { "Version": "1.1", "Statement": [ { "Action": [ "dcs:*:*", "vpc:*:*", "ecs:*:get*", "ecs:*:list*", "ecs:cloudServerNics:update", "ecs:serverInterfaces:use", "ces:*:get*", "ces:*:list*", "bss:order:update" ], "Effect": "Allow" } ] }	System-defined policy	All permissions for Distributed Cache Service
DCS ReadOnlyAccess { "Version": "1.1", "Statement": [ { "Action": [ "dcs:*:get*", "dcs:*:list*" ], "Effect": "Allow" } ] }	System-defined policy	Read-only permissions for Distributed Cache Service
DCS User { "Version": "1.1", "Statement": [ { "Action": [ "dcs:*:*" ], "Effect": "Allow" }, { "Action": [ "dcs:instance:create", "dcs:instance:delete", "dcs:instance:scale", "dcs:instance:modify" ], "Effect": "Deny" } ] }	System-defined policy	Common permissions of DCS service, except create, modify, delete and scale-up
DCS UserAccess { "Version": "1.1", "Statement": [ { "Action": [ "dcs:*:*", "ces:*:get*", "ces:*:list*" ], "Effect": "Allow" }, { "Action": [ "dcs:instance:create", "dcs:instance:delete", "dcs:instance:scale", "dcs:instance:modify" ], "Effect": "Deny" } ] }	System-defined policy	Common permissions of DCS service, except create, modify, delete and scale-up
DCS Viewer { "Version": "1.1", "Statement": [ { "Action": [ "dcs:*:get*", "dcs:*:list*" ], "Effect": "Allow" } ] }	System-defined policy	The read-only permissions to all DCS resources, which can be used for statistics and survey
DDM CommonOperations { "Version": "1.1", "Statement": [ { "Action": [ "vpc:*:*list*", "vpc:*:*get*", "vpc:ports:update", "ecs:*:get*", "ecs:*:list*", "rds:instance:list", "rds:instance:modify", "rds:instance:modifyParameter" ], "Effect": "Allow" }, { "Condition": { "StringEqualsIgnoreCase": { "g:ServiceName": [ "ddm" ] } }, "NotAction": [ "ddm:instance:create", "ddm:instance:delete", "ddm:database:migrate*", "ddm:instance:resize", "ddm:instance:extendNode" ], "Effect": "Allow" } ] }	System-defined policy	Common user permissions for DDM, except for permissions of creating, deleting, and scaling out DDM instances, scaling out schemas, rolling back schema scaling tasks, and changing instance class
DDM FullAccess { "Version": "1.1", "Statement": [ { "Action": [ "ddm:*:*", "rds:instance:list", "rds:instance:modify", "rds:instance:modifyParameter", "vpc:*:*", "ecs:*:get*", "ecs:*:list*", "ecs:cloudServerNics:update", "ecs:serverInterfaces:use" ], "Effect": "Allow" } ] }	System-defined policy	Full permissions for Distributed Database Middleware
DDM ReadOnlyAccess { "Version": "1.1", "Statement": [ { "Action": [ "rds:instance:list", "vpc:*:*list*", "vpc:*:*get*", "ecs:*:get*", "ecs:*:list*", "ddm:*:list", "ddm:*:get", "ddm:instance:listParameter", "ddm:instance:listRwInfo", "ddm:instance:listSlowSqlInfo" ], "Effect": "Allow" } ] }	System-defined policy	Read-only permissions for Distributed Database Middleware
DDS Admin { "Version": "1.1", "Statement": [ { "Action": [ "dds:*:*", "vpc:*:list", "vpc:*:get", "dss:*:list", "dss:*:get", "kms:*:list", "kms:*:get", "ces:*:list", "ces:alarmsOnOff:put", "ces:alarms:create" ], "Effect": "Allow" } ] }	System-defined policy	Full permissions for Document Database Service
DDS Admin { "Version": "1.1", "Statement": [ { "Action": [ "dds:*:*", "vpc:*:*", "dss:*:get", "dss:*:list", "ecs:*:get*", "ecs:*:list*", "ecs:cloudServerNics:update", "ecs:serverInterfaces:use" ], "Effect": "Allow" } ] }	System-defined policy	All permissions of DDS service
DDS Administrator { "Version": "1.0", "Statement": [ { "Action": [ "DDS:DDS:*" ], "Effect": "Allow" } ], "Depends": [ { "catalog": "BASE", "display_name": "Server Administrator" }, { "catalog": "BASE", "display_name": "Tenant Guest" } ] }	System-defined role	Document Database Service Administrator
DDS DBA { "Version": "1.1", "Statement": [ { "Action": [ "dds:instance:list", "dds:instance:modify", "dds:instance:create", "dds:instance:switchover", "dds:instance:modifyPort", "dds:instance:resetPasswd", "dds:instance:modifyParameter", "dds:instance:modifySSL", "dds:instance:modifySecurityGroup", "dds:instance:bindPublicIp", "dds:instance:extendVolume", "dds:instance:modifySpec", "dds:instance:extendNode", "dds:instance:reboot", "dds:instance:modifyBackupPolicy", "dds:instance:unbindPublicIp", "dds:instance:renew", "dds:instance:createManualBackup", "dds:backup:list", "dds:backup:createInstanceFromBackup", "dds:backup:modify", "dds:backup:delete", "dds:backup:download", "dds:param:list", "dds:param:modify", "dds:param:create", "dds:param:delete", "vpc:*:*", "dss:*:get", "dss:*:list", "ecs:*:get*", "ecs:*:list*", "ecs:cloudServerNics:update", "ecs:serverInterfaces:use" ], "Effect": "Allow" } ] }	System-defined policy	DBA permissions of DDS service, except delete
DDS FullAccess { "Version": "1.1", "Statement": [ { "Action": [ "dds:*:*", "vpc:*:list", "vpc:*:get", "dss:*:list", "dss:*:get", "kms:*:list", "kms:*:get", "ces:*:list", "ces:alarmsOnOff:put", "ces:alarms:create" ], "Effect": "Allow" } ] }	System-defined policy	Full permissions for Document Database Service
DDS ManageAccess { "Version": "1.1", "Statement": [ { "Action": [ "vpc:*:list", "vpc:*:get", "dss:*:list", "dss:*:get", "kms:*:list", "kms:*:get", "ces:*:list", "ces:alarmsOnOff:put", "ces:alarms:create" ], "Effect": "Allow" }, { "Condition": { "StringEqualsIgnoreCase": { "g:ServiceName": [ "dds" ] } }, "NotAction": [ "dds:*:delete*" ], "Effect": "Allow" } ] }	System-defined policy	Database administrator permissions for all operations except deleting DDS resources
DDS ReadOnlyAccess { "Version": "1.1", "Statement": [ { "Action": [ "dds:*:list", "vpc:*:list", "vpc:*:get", "dss:*:list", "dss:*:get", "kms:*:list", "kms:*:get", "ces:*:list" ], "Effect": "Allow" } ] }	System-defined policy	Read-only permissions for Document Database Service
DDS Viewer { "Version": "1.1", "Statement": [ { "Action": [ "dds:*:list", "dds:*:get", "vpc:*:list", "vpc:*:get", "dss:*:list", "dss:*:get", "kms:*:list", "kms:*:get", "ces:*:list" ], "Effect": "Allow" } ] }	System-defined policy	Read-only permissions for Document Database Service
DIS Administrator { "Version": "1.0", "Statement": [ { "Action": [ "dis:*:*" ], "Effect": "Allow" } ] }	System-defined role	Data Ingestion Service User
DIS Operator { "Version": "1.0", "Statement": [ { "Action": [ "dis:*:get", "dis:*:list", "dis:apps:*", "dis:customers:verify", "dis:cbcOrders:create", "dis:clusters:*", "dis:topics:*", "dis:eventEnumSubs:*", "dis:iamAgencies:*", "dis:streamPolicies:*", "dis:streams:*", "dis:updatePartitionCounts:*", "dis:transferTasks:*", "dis:avroSchema:transform", "dis:tagResources:*", "dis:mqttInstances:*" ], "Effect": "Allow" } ] }	System-defined role	Data Ingestion Service Operator
DIS User { "Version": "1.0", "Statement": [ { "Action": [ "dis:*:get", "dis:*:list", "dis:apps:*", "dis:customers:verify", "dis:eventEnumSubs:*", "dis:transferTasks:*", "dis:iamAgencies:check", "dis:avroSchema:transform", "dis:records:*", "dis:checkpoints:*", "dis:consumerGroups:*" ], "Effect": "Allow" } ] }	System-defined role	Data Ingestion Service User
DLI Service Administrator { "Version": "1.0", "Statement": [ { "Action": [ "dli:*:*" ], "Effect": "Allow" } ] }	System-defined role	All permissions for Data Lake Insight
DLI Service User { "Version": "1.0", "Statement": [ { "Action": [ "dli:queue:listQueues", "dli:table:describeTable", "dli:resource:createResource", "dli:group:createGroup" ], "Effect": "Allow" } ] }	System-defined role	Users who were granted this permission can view the queue list, table structure, and create packages and package groups
DMS Admin { "Version": "1.1", "Statement": [ { "Action": [ "dms:*:*", "vpc:*:*", "obs:*:list*", "obs:*:get*" ], "Effect": "Allow" } ] }	System-defined policy	All permissions of Distributed Message Service
DMS Administrator { "Version": "1.0", "Statement": [ { "Action": [ "DMS:Queue:*", "DMS:Consumer_Group:*", "DMS:Message:*", "DMS:Quota:*" ], "Effect": "Allow" } ], "Depends": [ { "catalog": "BASE", "display_name": "Tenant Guest" } ] }	System-defined role	Administrator to control DMS API access
DMS Administrator { "Version": "1.0", "Statement": [ { "Action": [ "DMS:Queue:*", "DMS:Consumer_Group:*", "DMS:Message:*", "DMS:Quota:*" ], "Effect": "Allow" } ] }	System-defined role	Administrator to control DMS API access
DMS User { "Version": "1.1", "Statement": [ { "Action": [ "dms:*:*", "vpc:*:list*", "vpc:*:get*", "obs:*:list*", "obs:*:get*" ], "Effect": "Allow" }, { "Action": [ "dms:instance:create", "dms:instance:delete", "dms:instance:scale", "dms:instance:modify", "dms:instance:connector" ], "Effect": "Deny" } ] }	System-defined policy	Common permissions of Distributed Message Service, except install, modify, delete and so on
DMS Viewer { "Version": "1.1", "Statement": [ { "Action": [ "dms:*:get*", "dms:*:list*", "vpc:*:list*", "vpc:*:get*", "obs:*:list*", "obs:*:get*" ], "Effect": "Allow" }, { "Action": [ "dms:instance:create", "dms:instance:delete", "dms:instance:scale", "dms:instance:modify", "dms:instance:modifyStatus", "dms:instance:resetAuthInfo", "dms:instance:modifyAuthInfo", "dms:instance:deleteBackgroundTask", "dms:instance:connector", "dms:instance:createConnectorSinkTask", "dms:instance:deleteConnectorSinkTask" ], "Effect": "Deny" } ] }	System-defined policy	The read-only permissions to all Distributed Message Service resources
DNS Admin { "Version": "1.1", "Statement": [ { "Action": [ "dns:*:*", "vpc:*:get*", "vpc:*:list*", "ces:remoteChecks:list", "ces:siteMonitorHealthCheck:get", "ces:siteMonitorHealthCheck:create", "ces:siteMonitorRule:delete", "ces:siteMonitorRule:put" ], "Effect": "Allow" } ] }	System-defined policy	DNS administrator permissions, which allow users to perform all operations, including creating, deleting, querying, and modifying DNS resources
DNS Administrator { "Version": "1.0", "Statement": [ { "Action": [ "DNS:Zone:*", "DNS:RecordSet:*", "DNS:PTRRecord:*" ], "Effect": "Allow" } ], "Depends": [ { "catalog": "BASE", "display_name": "Tenant Guest" }, { "catalog": "VPC", "display_name": "VPC Administrator" } ] }	System-defined role	DNS Administrator
DNS Viewer { "Version": "1.1", "Statement": [ { "Action": [ "dns:*:get*", "dns:*:list*", "vpc:*:get*", "vpc:*:list*", "ces:remoteChecks:list", "ces:siteMonitorHealthCheck:get" ], "Effect": "Allow" } ] }	System-defined policy	Read-only permissions, which only allow users to query DNS resources
DRS FullAccess { "Version": "1.1", "Statement": [ { "Action": [ "drs:*:*", "vpc:*:get", "vpc:*:list", "smn:topic:*", "obs:*:get*", "obs:*:list*", "obs:*:head*" ], "Effect": "Allow" } ] }	System-defined policy	Full permissions for Data Replication Service
DRS ReadOnlyAccess { "Version": "1.1", "Statement": [ { "Action": [ "drs:*:list", "drs:*:get*", "vpc:*:get", "vpc:*:list", "obs:*:get*", "obs:*:list*" ], "Effect": "Allow" } ] }	System-defined policy	Read-only permissions for Data Replication Service
DWS FullAccess { "Version": "1.1", "Statement": [ { "Action": [ "dws:*:*", "ecs:*:*", "vpc:*:*", "evs:*:*", "mrs:*:get*", "bss:*:*" ], "Effect": "Allow" } ] }	System-defined policy	All permissions of DWS service
DWS ReadOnlyAccess { "Version": "1.1", "Statement": [ { "Action": [ "dws:*:get*", "dws:*:list*", "ecs:*:get*", "ecs:*:list*", "vpc:*:get*", "vpc:*:list*", "evs:*:get*", "evs:*:list*", "mrs:*:get*", "bss:*:list*", "bss:*:get*" ], "Effect": "Allow" } ] }	System-defined policy	The read-only permissions to all DWS resources
Direct Connect Administrator { "Version": "1.0", "Statement": [ { "Action": [ "dc:*:*" ], "Effect": "Allow" } ], "Depends": [ { "catalog": "BASE", "display_name": "Tenant Guest" } ] }	System-defined role	Direct Connect Administrator
ECS Admin { "Version": "1.1", "Statement": [ { "Action": [ "ecs:*:*", "evs:*:get", "evs:*:list", "evs:volumes:create", "evs:volumes:delete", "evs:volumes:attach", "evs:volumes:detach", "evs:volumes:manage", "evs:volumes:update", "evs:volumes:use", "evs:volumes:uploadImage", "evs:snapshots:create", "vpc:*:get", "vpc:*:list", "vpc:networks:create", "vpc:networks:update", "vpc:subnets:update", "vpc:subnets:create", "vpc:ports:*", "vpc:routers:get", "vpc:routers:update", "vpc:securityGroups:*", "vpc:securityGroupRules:*", "vpc:floatingIps:*", "vpc:publicIps:*", "ims:images:create", "ims:images:delete", "ims:images:get", "ims:images:list", "ims:images:update", "ims:images:upload" ], "Effect": "Allow" } ] }	System-defined policy	All permissions of ECS service
ECS User { "Version": "1.1", "Statement": [ { "Action": [ "ecs:*:get*", "ecs:*:list*", "ecs:*:start", "ecs:*:stop", "ecs:*:reboot", "ecs:cloudServerFpgaImages:relate", "ecs:cloudServerFpgaImages:register", "ecs:cloudServerFpgaImages:delete", "ecs:cloudServerFpgaImags:unrelate", "ecs:cloudServers:setAutoRecovery", "ecs:cloudServers:resetServerPwd", "ecs:cloudServerNics:update", "ecs:cloudServers:vnc", "ecs:diskConfigs:use", "ecs:securityGroups:use", "ecs:serverGroups:manage", "ecs:serverFloatingIps:use", "ecs:serverKeypairs:*", "ecs:serverPasswords:manage", "ecs:servers:createConsole", "ecs:servers:createImage", "ecs:servers:setMetadata", "ecs:servers:setTags", "ecs:serverVolumes:use", "evs:*:get*", "evs:*:list*", "evs:snapshots:create", "evs:volumes:uploadImage", "evs:volumes:delete", "evs:volumes:update", "evs:volumes:attach", "evs:volumes:detach", "evs:volumes:manage", "evs:volumes:use", "vpc:*:get*", "vpc:*:list*", "vpc:floatingIps:create", "vpc:floatingIps:update", "vpc:floatingIps:delete", "vpc:publicIps:update", "vpc:publicIps:delete", "ims:images:create", "ims:images:delete", "ims:images:get", "ims:images:list", "ims:images:update", "ims:images:upload" ], "Effect": "Allow" } ] }	System-defined policy	Common permissions of ECS service, except installation, delete, reinstallation and so on
ECS Viewer { "Version": "1.1", "Statement": [ { "Action": [ "ecs:*:get*", "ecs:*:list*", "ecs:serverGroups:manage", "ecs:serverVolumes:use", "evs:*:get*", "evs:*:list*", "vpc:*:get*", "vpc:*:list*", "ims:*:get*", "ims:*:list*" ], "Effect": "Allow" } ] }	System-defined policy	The read-only permissions to all ECS resources, which can be used for statistics and survey
ELB Admin { "Version": "1.1", "Statement": [ { "Action": [ "elb:*:*", "vpc:*:get*", "vpc:*:list*", "ecs:*:get*", "ecs:*:list*" ], "Effect": "Allow" } ] }	System-defined policy	All permissions of ELB service
ELB Service Administrator { "Version": "1.0", "Statement": [ { "Action": [ "ELB:ELB:*", "ELB:Listener:*", "ELB:Healthcheck:*", "ELB:Member:*" ], "Effect": "Allow" } ], "Depends": [ { "catalog": "OBS", "display_name": "Tenant Administrator" }, { "catalog": "VPC", "display_name": "VPC Administrator" }, { "catalog": "CES", "display_name": "CES Administrator" }, { "catalog": "BASE", "display_name": "Server Administrator" }, { "catalog": "BASE", "display_name": "Tenant Guest" } ] }	System-defined role	ELB Service Administrator
ELB Viewer { "Version": "1.1", "Statement": [ { "Action": [ "elb:*:get", "elb:*:list", "vpc:*:get*", "vpc:*:list*", "ecs:*:get*", "ecs:*:list*" ], "Effect": "Allow" } ] }	System-defined policy	The read-only permissions to all ELB resources, which can be used for statistics and survey
EVS Admin { "Version": "1.1", "Statement": [ { "Action": [ "evs:*:*", "ecs:*:get", "ecs:*:list", "ecs:cloudServers:attach", "ecs:cloudServers:detachVolume", "ecs:serverVolumes:use", "ecs:serverGroups:manage", "vpc:vpcs:list", "vpc:ports:get", "ims:images:create", "ims:images:delete", "ims:images:get", "ims:images:list", "ims:images:update", "ims:images:upload", "cbr:vaults:list", "cbr:policies:list", "bms:serverFlavors:get", "bms:servers:get", "bms:servers:attachVolume", "bms:servers:detachVolume", "vpc:publicIps:list" ], "Effect": "Allow" } ] }	System-defined policy	All permissions of EVS service
EVS Viewer { "Version": "1.1", "Statement": [ { "Action": [ "evs:*:get*", "evs:*:list", "evs:*:count", "ecs:servers:get", "ecs:servers:list", "ecs:cloudServers:get", "ecs:cloudServers:list", "ecs:cloudServerFlavors:get", "bms:servers:get", "bms:servers:list", "bms:serverFlavors:get", "vpc:publicIps:list", "cbr:vaults:list", "cbr:policies:list" ], "Effect": "Allow" } ] }	System-defined policy	The read-only permissions to all EVS resources, which can be used for statistics and survey
Elasticsearch Administrator { "Version": "1.0", "Statement": [ { "Action": [ "css:*:*" ], "Effect": "Allow" } ], "Depends": [ { "catalog": "BASE", "display_name": "Server Administrator" }, { "catalog": "BASE", "display_name": "Tenant Guest" } ] }	System-defined role	Elasticsearch Administrator
Full Access { "Version": "1.1", "Statement": [ { "Action": [ "*:*:*" ], "Effect": "Allow" } ] }	System-defined policy	All permissions of all services
FunctionGraph CommonOperations { "Version": "1.1", "Statement": [ { "Action": [ "functiongraph:*:get*", "functiongraph:*:list*", "functiongraph:function:invoke*", "eps:*:list", "obs:*:*", "vpc:*:get", "vpc:*:list", "aom:*:get", "aom:*:list", "apm:*:get*", "apm:*:list*", "ecs:*:get*", "ecs:*:list*", "sfs:*:get*", "sfsturbo:*:get*", "smn:*:get*", "smn:*:list*", "dms:*:get", "dms:*:list", "lts:*:list", "apig:*:get*", "apig:*:list*", "dds:*:list", "roma:*:list", "roma:*:get", "nosql:instance:list" ], "Effect": "Allow" } ] }	System-defined policy	Common operations for functiongraph service, include query and invoke function
FunctionGraph FullAccess { "Version": "1.1", "Statement": [ { "Action": [ "functiongraph:*:*", "eps:*:list", "obs:*:*", "vpc:*:*", "aom:*:*", "apm:*:*", "ecs:*:*", "sfs:*:*", "sfsturbo:*:*", "smn:*:*", "lts:*:*", "apig:*:*", "dds:*:*", "roma:*:*", "nosql:instance:list" ], "Effect": "Allow" } ] }	System-defined policy	All permissions of FunctionGraph service
FunctionGraph ReadOnlyAccess { "Version": "1.1", "Statement": [ { "Action": [ "functiongraph:*:get*", "functiongraph:*:list*", "eps:*:list", "obs:*:*", "vpc:*:get", "vpc:*:list", "aom:*:get", "aom:*:list", "apm:*:get*", "apm:*:list*", "ecs:*:get*", "ecs:*:list*", "sfs:*:get*", "sfsturbo:*:get*", "smn:*:get*", "smn:*:list*", "dms:*:get", "dms:*:list", "lts:*:list", "apig:*:get*", "apig:*:list*", "dds:*:list", "roma:*:list", "roma:*:get", "nosql:instance:list" ], "Effect": "Allow" } ] }	System-defined policy	The read-only permissions to all functiongraph resources
GES Development { "Version": "1.1", "Statement": [ { "Action": [ "ges:*:get*", "ges:*:list*", "ges:*:operate*", "ges:*:access*", "ges:metadata:*", "ges:backup:*", "ecs:*:*", "vpc:*:*" ], "Effect": "Allow" } ] }	System-defined policy	Usage permissions for Graph Engine Service
GES FullAccess { "Version": "1.1", "Statement": [ { "Action": [ "ges:*:*", "ecs:*:*", "vpc:*:*" ], "Effect": "Allow" } ] }	System-defined policy	Full permissions for Graph Engine Service
GES ReadOnlyAccess { "Version": "1.1", "Statement": [ { "Action": [ "ges:*:get*", "ges:*:list*", "ecs:*:get*", "ecs:*:list*", "vpc:*:get*", "vpc:*:list*" ], "Effect": "Allow" } ] }	System-defined policy	Read-only permissions for Graph Engine Service
HSS Administrator { "Version": "1.0", "Statement": [ { "Action": [ "hss:*:*" ], "Effect": "Allow" } ], "Depends": [ { "catalog": "BASE", "display_name": "Tenant Guest" } ] }	System-defined role	Full permissions for Host Security Service
HSS FullAccess { "Version": "1.1", "Statement": [ { "Action": [ "hss:*:*", "vpc:*:get*", "vpc:*:list*", "ecs:*:get*", "ecs:*:list*" ], "Effect": "Allow" } ] }	System-defined policy	All permissions of Host Security Service
HSS ReadOnlyAccess { "Version": "1.1", "Statement": [ { "Action": [ "hss:*:get*", "hss:*:list*", "vpc:*:get*", "vpc:*:list*", "ecs:*:get*", "ecs:*:list*" ], "Effect": "Allow" } ] }	System-defined policy	Read-only permission for Host Security Service
IAM ReadOnlyAccess { "Version": "1.1", "Statement": [ { "Action": [ "iam:*:get*", "iam:*:list*", "iam:*:check*" ], "Effect": "Allow" } ] }	System-defined policy	Read-only permissions for Identity and Access Management
IMS Admin { "Version": "1.1", "Statement": [ { "Action": [ "ims:*:*", "ecs:*:list", "ecs:*:get", "evs:*:get", "evs:*:list", "bms:servers:list", "bms:serverFlavors:get", "cbr:vaults:listProtectables", "cbr:vaults:listResourceInstances", "cbr:vaults:getProtectables", "cbr:vaults:get", "cbr:vaults:list", "cbr:backups:list", "cbr:backups:get", "cbr:vaults:listExternalVaults" ], "Effect": "Allow" } ] }	System-defined policy	All permissions of Image Management Service
IMS Administrator { "Version": "1.0", "Statement": [ { "Action": [ "ims:*:*", "ecs:*:list", "ecs:*:get", "evs:*:get" ], "Effect": "Allow" } ], "Depends": [ { "catalog": "OBS", "display_name": "Tenant Administrator" } ] }	System-defined role	IMS Administrator
IMS Viewer { "Version": "1.1", "Statement": [ { "Action": [ "ims:*:list", "ims:*:get" ], "Effect": "Allow" } ] }	System-defined policy	The read-only permissions to all IMS resources, which can be used for statistics and survey
KMS Administrator { "Version": "1.0", "Statement": [ { "Action": [ "kms:*:*" ], "Effect": "Allow" } ] }	System-defined role	KMS Administrator
KMS CMKFullAccess { "Version": "1.1", "Statement": [ { "Action": [ "kms:cmk:*", "kms:dek:*", "kms:grant:*", "kms:cmkTag:*", "kms:partition:*" ], "Effect": "Allow" } ] }	System-defined policy	All permissions for custom keys in Key Management Service
LTS FullAccess { "Version": "1.1", "Statement": [ { "Action": [ "lts:*:*", "apm:icmgr:*", "aom:inventory:get", "obs:bucket:List*", "ims:images:get", "ecs:servers:get", "ecs:servers:list", "ecs:securityGroups:use", "ecs:serverKeypairs:get", "aom:log:list", "aom:quota:get", "aom:quota:set", "dis:stream:use" ], "Effect": "Allow" } ] }	System-defined policy	All permissions of Log Tank service
LTS ReadOnlyAccess { "Version": "1.1", "Statement": [ { "Action": [ "lts:*:get", "lts:*:list", "apm:icmgr:get", "apm:icmgr:list", "aom:inventory:get", "obs:bucket:List*", "ims:images:get", "ecs:servers:get", "ecs:servers:list", "ecs:securityGroups:use", "ecs:serverKeypairs:get", "aom:log:list", "aom:quota:get", "aom:alarmRule:get" ], "Effect": "Allow" } ] }	System-defined policy	The read-only permissions to all Log Tank service resources
MRS Admin { "Version": "1.1", "Statement": [ { "Action": [ "mrs:*:*", "ecs:*:*", "evs:*:*", "vpc:*:*" ], "Effect": "Allow" } ] }	System-defined policy	MapReduce all permissions for the service
MRS Administrator { "Version": "1.0", "Statement": [ { "Action": [ "MRS:MRS:*" ], "Effect": "Allow" } ], "Depends": [ { "catalog": "BASE", "display_name": "Server Administrator" }, { "catalog": "BASE", "display_name": "Tenant Guest" } ] }	System-defined role	MRS Administrator
MRS User { "Version": "1.1", "Statement": [ { "Action": [ "mrs:*:get*", "mrs:*:list*", "ecs:*:get*", "ecs:*:list*", "evs:*:get*", "evs:*:list*", "vpc:*:get*", "vpc:*:list*", "mrs:job:submit", "mrs:job:stop", "mrs:job:delete", "mrs:job:batchDelete", "mrs:file:create", "mrs:file:delete", "mrs:tag:batchOperate", "mrs:tag:create", "mrs:tag:delete", "mrs:manager:access", "mrs:patch:install", "mrs:patch:uninstall", "mrs:ops:grant", "mrs:ops:shareLog", "mrs:alarm:subscribe" ], "Effect": "Allow" }, { "Action": [ "mrs:cluster:create", "mrs:cluster:resize", "mrs:cluster:scaleUp", "mrs:cluster:delete", "mrs:cluster:policy" ], "Effect": "Deny" } ] }	System-defined policy	MapReduce Service Usage Permissions
MRS Viewer { "Version": "1.1", "Statement": [ { "Action": [ "mrs:*:get*", "mrs:*:list*", "ecs:*:get*", "ecs:*:list*", "evs:*:get*", "evs:*:list*", "vpc:*:get*", "vpc:*:list*" ], "Effect": "Allow" }, { "Action": [ "mrs:cluster:create", "mrs:cluster:resize", "mrs:cluster:scaleUp", "mrs:cluster:delete", "mrs:cluster:policy", "mrs:job:submit", "mrs:job:stop", "mrs:job:delete", "mrs:job:batchDelete", "mrs:file:create", "mrs:file:delete", "mrs:tag:batchOperate", "mrs:tag:create", "mrs:tag:delete", "mrs:manager:access", "mrs:patch:install", "mrs:patch:uninstall", "mrs:ops:grant", "mrs:ops:shareLog", "mrs:alarm:subscribe" ], "Effect": "Deny" } ] }	System-defined policy	MapReduce Service read-only permissions
ModelArts CommonOperations { "Version": "1.1", "Statement": [ { "Action": [ "modelarts:*:*" ], "Effect": "Allow" }, { "Action": [ "swr:*:*" ], "Effect": "Allow" }, { "Action": [ "smn:*:*" ], "Effect": "Allow" }, { "Action": [ "modelarts:pool:create", "modelarts:pool:update", "modelarts:pool:delete" ], "Effect": "Deny" } ] }	System-defined policy	Common permissions of ModelArts service,except create,update,delete pool
ModelArts FullAccess { "Version": "1.1", "Statement": [ { "Action": [ "modelarts:*:*" ], "Effect": "Allow" }, { "Action": [ "swr:*:*" ], "Effect": "Allow" }, { "Action": [ "smn:*:*" ], "Effect": "Allow" } ] }	System-defined policy	All permissions of ModelArts service
NAT Admin { "Version": "1.1", "Statement": [ { "Action": [ "nat:*:*", "vpc:*:*" ], "Effect": "Allow" } ] }	System-defined policy	All permissions of NAT Gateway service
NAT Gateway Administrator { "Version": "1.0", "Statement": [ { "Action": [ "NAT:nat_gateway:*", "NAT:snat_rule:*", "NAT:dnat_rule:*", "VPC:router:*", "VPC:port:*", "VPC:floatingip:*" ], "Effect": "Allow" } ], "Depends": [ { "catalog": "BASE", "display_name": "Tenant Guest" } ] }	System-defined role	NAT Gateway Administrator
NAT Viewer { "Version": "1.1", "Statement": [ { "Action": [ "nat:*:get", "nat:*:list", "vpc:*:get", "vpc:*:list" ], "Effect": "Allow" } ] }	System-defined policy	The read-only permissions to all NAT Gateway resources
OBS Administrator { "Version": "1.1", "Statement": [ { "Action": [ "obs:*:*" ], "Effect": "Allow" } ] }	System-defined policy	Object Storage Service Administrator
OBS Buckets Viewer { "Version": "1.0", "Statement": [ { "Action": [ "s3:ListAllMyBuckets", "s3:HeadBucket", "s3:GetBucketLocation" ], "Effect": "Allow" } ] }	System-defined role	Permissions to view the bucket list, obtain bucket metadata, and query bucket location
OBS Operator { "Version": "1.1", "Statement": [ { "Action": [ "obs:bucket:ListAllMybuckets", "obs:bucket:HeadBucket", "obs:bucket:ListBucket", "obs:bucket:GetBucketLocation", "obs:object:GetObject", "obs:object:GetObjectVersion", "obs:object:PutObject", "obs:object:DeleteObject", "obs:object:DeleteObjectVersion", "obs:object:ListMultipartUploadParts", "obs:object:AbortMultipartUpload", "obs:object:GetObjectAcl", "obs:object:GetObjectVersionAcl" ], "Effect": "Allow" } ] }	System-defined policy	Basic operation permissions to view the bucket list, obtain bucket metadata, list objects in a bucket, query bucket location, upload objects, download objects, delete objects, and obtain object ACLs
OBS Viewer { "Version": "1.1", "Statement": [ { "Action": [ "obs:bucket:ListAllMybuckets", "obs:bucket:HeadBucket", "obs:bucket:ListBucket", "obs:bucket:GetBucketLocation" ], "Effect": "Allow" } ] }	System-defined policy	Permissions to view the bucket list, obtain bucket metadata, list objects in a bucket, and query bucket location
RDS Admin { "Version": "1.1", "Statement": [ { "Action": [ "rds:*:*", "vpc:*:*", "dss:*:get", "dss:*:list", "ecs:*:get*", "ecs:*:list*", "ecs:cloudServerNics:update", "ecs:serverInterfaces:use" ], "Effect": "Allow" } ] }	System-defined policy	All permissions of RDS service
RDS Administrator { "Version": "1.0", "Statement": [ { "Action": [ "RDS:RDS:*" ], "Effect": "Allow" } ], "Depends": [ { "catalog": "BASE", "display_name": "Server Administrator" }, { "catalog": "BASE", "display_name": "Tenant Guest" } ] }	System-defined role	RDS Administrator
RDS DBA { "Version": "1.1", "Statement": [ { "Action": [ "rds:instance:list", "rds:instance:modify", "rds:instance:create", "rds:instance:switchover", "rds:instance:modifySwitchoverPriority", "rds:instance:modifySynchronizeModel", "rds:instance:modifyPort", "rds:instance:resetPasswd", "rds:instance:modifyParameter", "rds:instance:modifyPublicAccess", "rds:instance:modifySSL", "rds:instance:modifySecurityGroup", "rds:instance:extendSpace", "rds:instance:modifySpec", "rds:instance:restoreInPlace", "rds:instance:createManualBackup", "rds:instance:modifyBackupPolicy", "rds:backup:list", "rds:backup:createInstanceFromBackup", "rds:backup:modify", "rds:backup:delete", "rds:backup:download", "rds:param:list", "rds:param:modify", "rds:param:create", "rds:param:delete", "vpc:*:*", "dss:*:get", "dss:*:list", "ecs:*:get*", "ecs:*:list*", "ecs:cloudServerNics:update", "ecs:serverInterfaces:use" ], "Effect": "Allow" } ] }	System-defined policy	DBA permissions of RDS service, except delete
RDS FullAccess { "Version": "1.1", "Statement": [ { "Action": [ "rds:*:*", "vpc:*:list", "vpc:*:get", "dss:pools:get", "dss:pools:list", "kms:cmk:get", "kms:cmk:list", "ces:*:list", "ces:alarmsOnOff:put", "ces:alarms:create" ], "Effect": "Allow" } ] }	System-defined policy	Full permissions for Relational Database Service
RDS ManageAccess { "Version": "1.1", "Statement": [ { "Action": [ "vpc:*:list", "vpc:*:get", "kms:cmk:get", "kms:cmk:list", "ces:*:list", "ces:alarmsOnOff:put", "ces:alarms:create", "dss:pools:get", "dss:pools:list" ], "Effect": "Allow" }, { "Condition": { "StringEqualsIgnoreCase": { "g:ServiceName": [ "rds" ] } }, "NotAction": [ "rds:*:delete*" ], "Effect": "Allow" } ] }	System-defined policy	Database administrator permissions for all operations except deleting RDS resources
RDS ReadOnlyAccess { "Version": "1.1", "Statement": [ { "Action": [ "rds:*:list*", "rds:*:get*", "dss:pools:list", "dss:pools:get", "vpc:*:list", "vpc:*:get", "kms:cmk:get", "kms:cmk:list", "ces:*:list" ], "Effect": "Allow" } ] }	System-defined policy	Read-only permissions for Relational Database Service
RDS Viewer { "Version": "1.1", "Statement": [ { "Action": [ "rds:instance:list", "rds:backup:list", "rds:param:list", "dss:*:get", "dss:*:list", "ecs:*:get*", "ecs:*:list*", "vpc:*:list", "vpc:*:get" ], "Effect": "Allow" } ] }	System-defined policy	The read-only permissions to all RDS resources, which can be used for statistics and survey
RMS FullAccess { "Version": "1.1", "Statement": [ { "Action": [ "rms:*:*" ], "Effect": "Allow" } ] }	System-defined policy	Full permissions for Resource Management Service
RMS ReadOnlyAccess { "Version": "1.1", "Statement": [ { "Action": [ "rms:resources:list", "rms:resources:get" ], "Effect": "Allow" } ] }	System-defined policy	Read-only permissions for Resource Management Service
SFS Admin { "Version": "1.1", "Statement": [ { "Action": [ "sfs:*:*", "vpc:*:get", "vpc:*:list", "vpc:networks:create", "vpc:networks:update", "vpc:subnets:update", "vpc:subnets:create", "vpc:ports:*", "vpc:routers:update", "vpc:securityGroups:*", "vpc:securityGroupRules:*", "vpc:floatingIps:*" ], "Effect": "Allow" } ] }	System-defined policy	All permissions of Scalable File Service
SFS Administrator { "Version": "1.0", "Statement": [ { "Action": [ "SFS:share:*", "SFS:quota:*", "SFS:share_export_location:*" ], "Effect": "Allow" } ], "Depends": [ { "catalog": "BASE", "display_name": "Tenant Guest" } ] }	System-defined role	SFS Administrator
SFS Turbo Admin { "Version": "1.1", "Statement": [ { "Action": [ "sfsturbo:*:*", "vpc:*:*", "dss:*:get", "dss:*:list", "dss:*:count" ], "Effect": "Allow" } ] }	System-defined policy	All permissions of Scalable File Service (SFS Turbo)
SFS Turbo Viewer { "Version": "1.1", "Statement": [ { "Action": [ "sfsturbo:*:get*", "vpc:*:get", "vpc:*:list", "dss:*:get", "dss:*:list" ], "Effect": "Allow" } ] }	System-defined policy	The read-only permissions to all Scalable File Service (SFS Turbo) resources
SFS Viewer { "Version": "1.1", "Statement": [ { "Action": [ "sfs:*:get*", "vpc:*:get*", "vpc:*:list*" ], "Effect": "Allow" } ] }	System-defined policy	The read-only permissions to all Scalable File Service resources
SMN Administrator { "Version": "1.0", "Statement": [ { "Action": [ "SMN:Topic:*", "SMN:Sms:*", "SMN:Email:*" ], "Effect": "Allow" } ] }	System-defined role	SMN Administrator
SMN FullAccess { "Version": "1.1", "Statement": [ { "Action": [ "smn:*:*" ], "Effect": "Allow" } ] }	System-defined policy	Full permissions for the Simple Message Notification service
SMN ReadOnlyAccess { "Version": "1.1", "Statement": [ { "Action": [ "smn:*:list" ], "Effect": "Allow" } ] }	System-defined policy	Read-only access to the Simple Message Notification service
SMS FullAccess { "Version": "1.1", "Statement": [ { "Action": [ "SMS:*:*" ], "Effect": "Allow" } ] }	System-defined policy	Full permissions for Server Migration Service
SMS ReadOnlyAccess { "Version": "1.1", "Statement": [ { "Action": [ "sms:*:query*" ], "Effect": "Allow" } ] }	System-defined policy	Read-only permissions Server Migration Service
SWR Administrator { "Version": "1.0", "Statement": [ { "Action": [ "SWR:software:*", "SWR:dockerimage:*" ], "Effect": "Allow" } ] }	System-defined role	Software Repository Administrator
Security Administrator { "Version": "1.0", "Statement": [ { "Action": [ "iam:agencies:*", "iam:credentials:*", "iam:groups:*", "iam:identityProviders:*", "iam:mfa:*", "iam:permissions:*", "iam:projects:*", "iam:quotas:*", "iam:roles:*", "iam:users:*", "iam:securitypolicies:*" ], "Effect": "Allow" } ] }	System-defined role	Full permissions for Identity and Access Management. This role does not have permissions for switching roles
Server Administrator { "Version": "1.1", "Statement": [ { "Action": [ "ecs:*:*", "evs:*:get", "evs:*:list", "evs:volumes:create", "evs:volumes:delete", "evs:volumes:attach", "evs:volumes:detach", "evs:volumes:manage", "evs:volumes:update", "evs:volumes:uploadImage", "evs:snapshots:create", "vpc:*:get", "vpc:*:list", "vpc:networks:create", "vpc:networks:update", "vpc:subnets:update", "vpc:subnets:create", "vpc:routers:get", "vpc:routers:update", "vpc:ports:*", "vpc:privateIps:*", "vpc:securityGroups:*", "vpc:securityGroupRules:*", "vpc:floatingIps:*", "vpc:publicIps:*", "vpc:bandwidths:*", "vpc:firewalls:*", "ims:images:create", "ims:images:delete", "ims:images:get", "ims:images:list", "ims:images:update", "ims:images:upload" ], "Effect": "Allow" } ] }	System-defined role	Server Administrator
ServiceStage Admin { "Version": "1.1", "Statement": [ { "Action": [ "servicestage:*:*", "cse:*:*", "cce:*:*", "ecs:*:*", "evs:*:*", "vpc:*:*", "elb:*:*", "aom:*:*", "apm:*:*", "dcs:*:*", "rds:*:*", "dss:*:*", "dss:*:*", "as:*:*", "cci:*:*", "nat:*:*", "ims:*:*", "sfs:*:*" ], "Effect": "Allow" } ] }	System-defined policy	All permissions of ServiceStage service
ServiceStage Administrator { "Version": "1.0", "Statement": [ { "Action": [ "servicestage:*:*" ], "Effect": "Allow" } ], "Depends": [ { "catalog": "BASE", "display_name": "Tenant Guest" }, { "catalog": "BASE", "display_name": "Server Administrator" }, { "catalog": "CCE", "display_name": "CCE Administrator" }, { "catalog": "APM", "display_name": "APM Administrator" } ] }	System-defined role	ServiceStage administrator, who has full permissions for this service
ServiceStage Developer { "Version": "1.1", "Statement": [ { "Action": [ "servicestage:*:*", "cse:*:get", "cse:*:list", "cse:registry:*", "cse:config:*", "cce:*:get", "cce:*:list", "cce:kubernetes:*", "ecs:*:*", "evs:*:get", "evs:*:list", "vpc:*:get", "vpc:*:list", "vpc:securityGroupRules:*", "vpc:securityGroups:*", "vpc:subnets:*", "vpc:publicIps:update", "elb:*:*", "aom:*:*", "apm:*:*", "dcs:*:get", "dcs:*:list", "rds:instance:list", "rds:backup:list", "rds:param:list", "dss:*:get", "dss:*:list", "as:*:list", "as:*:get", "as:instances:*", "cci:*:*", "nat:*:get", "nat:*:list", "nat:snatRules:*", "nat:dnatRules:*", "ims:*:list", "ims:*:get", "sfs:*:get*" ], "Effect": "Allow" }, { "Action": [ "servicestage:*:review", "servicestage:*:approve", "ecs:*:create", "ecs:*:delete" ], "Effect": "Deny" } ] }	System-defined policy	Developer permissions of ServiceStage service(exclude review and approve)
ServiceStage Viewer { "Version": "1.1", "Statement": [ { "Action": [ "servicestage:*:get", "servicestage:*:list", "cse:*:get", "cse:*:list", "cse:registry:*", "cse:config:*", "cce:*:get", "cce:*:list", "cce:kubernetes:*", "ecs:*:get", "ecs:*:list", "evs:*:get", "evs:*:list", "vpc:*:get", "vpc:*:list", "elb:*:get", "elb:*:list", "aom:*:get", "aom:*:list", "apm:*:get", "apm:*:list", "dcs:*:get", "dcs:*:list", "rds:instance:list", "rds:backup:list", "rds:param:list", "dss:*:get", "dss:*:list", "as:*:list", "as:*:get", "cci:*:get", "cci:*:list", "nat:*:get", "nat:*:list", "ims:*:list", "ims:*:get", "sfs:*:get*" ], "Effect": "Allow" } ] }	System-defined policy	The read-only permissions to all ServiceStage resources
TMS Administrator { "Version": "1.0", "Statement": [ { "Action": [ "TMS:predefine_tag:*", "TMS:resource_tag:*" ], "Effect": "Allow" } ], "Depends": [ { "catalog": "BASE", "display_name": "Tenant Guest" }, { "catalog": "BASE", "display_name": "Server Administrator" }, { "catalog": "IMS", "display_name": "IMS Administrator" }, { "catalog": "Auto Scaling", "display_name": "AutoScaling Administrator" }, { "catalog": "VPC", "display_name": "VPC Administrator" }, { "catalog": "VBS", "display_name": "VBS Administrator" }, { "catalog": "OBS", "display_name": "Tenant Administrator" }, { "catalog": "OBS", "display_name": "Tenant Guest" } ] }	System-defined role	Tag Management Service Administrator
Tenant Administrator { "Version": "1.1", "Statement": [ { "Action": [ "obs:*:*" ], "Effect": "Allow" }, { "Condition": { "StringNotEqualsIgnoreCase": { "g:ServiceName": [ "iam" ] } }, "Action": [ "*:*:*" ], "Effect": "Allow" } ] }	System-defined role	Tenant Administrator (Exclude IAM)
Tenant Guest { "Version": "1.1", "Statement": [ { "Action": [ "obs:*:get*", "obs:*:list*", "obs:*:head*" ], "Effect": "Allow" }, { "Condition": { "StringNotEqualsIgnoreCase": { "g:ServiceName": [ "iam" ] } }, "Action": [ "*:*:get*", "*:*:list*", "*:*:head*" ], "Effect": "Allow" } ] }	System-defined role	Tenant Guest (Exclude IAM)
VPC Admin { "Version": "1.1", "Statement": [ { "Action": [ "vpc:*:*", "ecs:*:get*", "ecs:*:list*" ], "Effect": "Allow" } ] }	System-defined policy	All permissions of VPC service
VPC Administrator { "Version": "1.1", "Statement": [ { "Action": [ "vpc:vpcs:*", "vpc:routers:*", "vpc:networks:*", "vpc:subnets:*", "vpc:ports:*", "vpc:privateIps:*", "vpc:peerings:*", "vpc:routes:*", "vpc:lbaas:*", "vpc:vpns:*", "ecs:*:get", "ecs:*:list", "elb:*:get", "elb:*:list" ], "Effect": "Allow" } ] }	System-defined role	Project-level services
VPC Viewer { "Version": "1.1", "Statement": [ { "Action": [ "vpc:*:get", "vpc:*:list", "ecs:*:get*", "ecs:*:list*" ], "Effect": "Allow" } ] }	System-defined policy	The read-only permissions to all VPC resources, which can be used for statistics and survey
VPCEndpoint Administrator { "Version": "1.0", "Statement": [ { "Action": [ "VPCEP:endpoint_services:*" ], "Effect": "Allow" } ], "Depends": [ { "catalog": "BASE", "display_name": "Server Administrator" }, { "catalog": "VPC", "display_name": "VPC Administrator" }, { "catalog": "DNS", "display_name": "DNS Administrator" } ] }	System-defined role	VPCEndpoint service enables you to privately connect your VPC to supported services
VPN Administrator { "Version": "1.0", "Statement": [ { "Action": [ "vpn:*:*" ], "Effect": "Allow" } ], "Depends": [ { "catalog": "BASE", "display_name": "Tenant Guest" }, { "catalog": "VPC", "display_name": "VPC Administrator" } ] }	System-defined role	Virtual Private Network Administrator
WAF Administrator { "Version": "1.0", "Statement": [ { "Action": [ "WAF:*:*" ], "Effect": "Allow" } ], "Depends": [ { "catalog": "BASE", "display_name": "Server Administrator" }, { "catalog": "BASE", "display_name": "Tenant Guest" } ] }	System-defined role	Web application firewall service administrator of instance and policy
WAF FullAccess { "Version": "1.1", "Statement": [ { "Action": [ "waf:*:*", "lts:groups:get", "lts:groups:list", "lts:topics:get", "lts:topics:list", "smn:*:get*", "smn:*:list*", "vpc:*:get*", "vpc:*:list*", "ecs:*:get*", "ecs:*:list*", "elb:*:get*", "elb:*:list*" ], "Effect": "Allow" } ] }	System-defined policy	All permissions of waf service
WAF ReadOnlyAccess { "Version": "1.1", "Statement": [ { "Action": [ "waf:*:get*", "waf:*:list*", "lts:groups:get", "lts:groups:list", "lts:topics:get", "lts:topics:list", "smn:*:get*", "smn:*:list*", "vpc:*:get*", "vpc:*:list*", "ecs:*:get*", "ecs:*:list*", "elb:*:get*", "elb:*:list*" ], "Effect": "Allow" } ] }	System-defined policy	The read-only permissions to all Web application firewall resources, which can be used for statistics and survey

Запустили Evolution free tier
для Dev & Test

Получить

Была ли статья полезной?

Да Нет

НазадЗащита критических операций (Critical option protection)

ДалееБыстрый старт