访问管理 Agent Runtime

一、服务（相关）角色是由腾讯云服务预定义，经用户授权后相应服务即可通过扮演服务相关角色对用户资源进行访问操作。这篇档介绍具体服务相关角色的使用场景及相关权限策略信息。

二、AGS_QCSLinkedRoleInSandboxTool

·策略名称： QcloudAccessForAGSRoleInSandboxTool

·策略内容：{
"version": "2.0",
"statement": [
{
"effect": "allow",
"action": [
"cfs:DescribeMountTargets",
"vpc:DescribeSubnets",
"vpc:DescribeSecurityGroups",
"vpc:CreateVpcEndPointServiceWhiteList",
"vpc:DeleteVpcEndPointServiceWhiteList",
"vpc:DescribeVpcEndPointServiceWhiteList",
"vpc:DescribeVpcEndPointService",
"vpc:CreateVpcEndPointService",
"vpc:DeleteVpcEndPointService",
"vpc:DescribeSubnetEx",
"cvm:DescribeSecurityGroups",
"cos:GetService",
"tcr:CreateInstanceToken",
"tcr:DescribeImages",
"tcr:DescribeInstances",
"tcr:DescribeInternalEndpoints",
"tcr:DescribeNamespaces",
"tcr:DescribeRepositories",
"tcr:DescribeApplicationTokenPersonal",
"tcr:DescribeImagePersonal",
"tcr:DescribeImageFilterPersonal",
"tcr:DescribeRepositoryOwnerPersonal",
"tcr:DescribeNamespacePersonal",
"tcr:DescribeRepositoryFilterPersonal",
"cos:PutObject",
"cos:GetObject",
"cos:HeadObject",
"cos:DeleteObject",
"cos:HeadBucket",
"cos:GetBucket",
"cos:UploadPart",
"cos:ListParts",
"cos:InitiateMultipartUpload",
"cos:ListMultipartUploads",
"cos:CompleteMultipartUpload",
"cos:AbortMultipartUpload",
"tcr:PullRepository",
"clb:CreateLoadBalancer",
"clb:DeleteLoadBalancer",
"clb:DescribeLoadBalancers",
"clb:CreateListener",
"clb:DeleteListener",
"clb:DescribeListeners",
"clb:RegisterTargets",
"clb:DeregisterTargets",
"clb:BatchRegisterTargets",
"clb:BatchDeregisterTargets",
"clb:DescribeTargets",
"clb:DescribeTargetHealth",
"clb:ModifyTargetWeight",
"clb:DescribeTaskStatus",
"smh:DescribeAccountFlag",
"smh:DescribeInstanceDetail",
"smh:DescribeLibraries",
"smh:DescribeLibrarySecret",
"smh:DescribeOfficialInstances",
"smh:DescribeOfficialOverview",
"smh:DescribeOfficialOverview",
"smh:DescribeOrgInfo",
"smh:DescribePhoneRelatedOrg",
"smh:DescribeSpaceInternal",
"smh:DescribeTrafficPackages",
"smh:DescribeUserLifecycle",
"ags:*",
"clb:ModifyLoadBalancerAttributes",
"privatedns:DescribePrivateZone",
"privatedns:DescribePrivateZoneService",
"privatedns:DeletePrivateZone",
"privatedns:CreatePrivateZone",
"privatedns:DeletePrivateZoneRecord",
"privatedns:CreatePrivateZoneRecord",
"privatedns:ModifyPrivateZoneRecord",
"privatedns:ModifyPrivateZoneVpc",
"privatedns:ModifyRecordsStatus",
"privatedns:DescribePrivateZoneList",
"privatedns:DescribePrivateZoneRecordList",
"vpc:CreateVpcEndPoint",
"vpc:ModifyVpcEndPointAttribute",
"vpc:DeleteVpcEndPoint",
"vpc:DescribeVpcEndPoint",
"ssl:DescribeCertificates",
"ssl:DescribeCertificateDetail",
"vpc:DescribeVpcLimits",
"vpc:DescribeHaVips",
"cfs:DescribeCfsFileSystems"
],
"resource": "*"
}
]
}

三、AGC_QCSLinkedRoleInResourceAccess

使用场景： 当前角色为Agent Runtime (ags) Agent 集群服务相关角色，用于授权 Agent 集群服务代表你访问 TKE等腾讯云资源，完成专属 TKE 集群的创建、查询和生命周期管理等。权限策略

·策略名称： QcloudAccessForAGSLinkedRoleInTKE

·策略内容：{
"version": "2.0",
"statement": [
{
"effect": "allow",
"action": [
"tke:CreateCluster",
"tke:DeleteCluster",
"tke:DescribeAddon",
"tke:DescribeClusterInstances",
"tke:DescribeClusterLevelAttribute",
"tke:DescribeClusterStatus",
"tke:DescribeNodePools",
"tke:DisableClusterDeletionProtection",
"tke:EnableClusterDeletionProtection",
"tke:InstallAddon",
"tke:ModifyClusterAttribute",
"tke:ModifyClusterTags",
"ags:CheckServiceLinkedRoleResourcesByRegion",
"tke:DescribeClusters",
"vpc:DescribeVpcs",
"vpc:DescribeSubnets"
],
"resource": "*"
}
]
}