访问管理 云服务器

一、服务（相关）角色是由腾讯云服务预定义，经用户授权后相应服务即可通过扮演服务相关角色对用户资源进行访问操作。这篇档介绍具体服务相关角色的使用场景及相关权限策略信息。

二、CSM_QCSLinkedRoleInOnline

·策略名称： QcloudAccessForCSMLinkedRoleInLiveMigrate

·策略内容：{
"version": "2.0",
"statement": [
{
"effect": "allow",
"action": [
"cvm:ExitLiveMigrateInstance",
"cvm:LiveMigrateInstance",
"cvm:ModifyInstancesVpcAttribute",
"cvm:LiveMigrateInstance",
"cvm:ExitLiveMigrateInstance",
"cvm:DescribeInstances",
"cvm:DescribeInstanceConfigInfos",
"cvm:RunInstances",
"cvm:TerminateInstances",
"cvm:CreateImage",
"cvm:DescribeImages",
"cvm:AssociateSecurityGroups",
"cvm:DisassociateSecurityGroups",
"cvm:CreateDisks",
"cvm:AttachDisks",
"cvm:DetachDisks",
"cvm:DescribeDisks",
"cvm:TerminateDisks",
"vpc:CreateSecurityGroupWithPolicies",
"vpc:DescribeAddressTemplates",
"vpc:DescribeServiceTemplates",
"vpc:DescribeAddressTemplateGroups",
"vpc:DescribeServiceTemplateGroups",
"vpc:DescribeVpcs",
"vpc:CreateVpc",
"vpc:DescribeSubnets",
"vpc:CreateSubnet",
"vpc:DescribeVpcLimits",
"vpc:DescribeSecurityGroupPolicies",
"finance:DescribeAccountBalance",
"cvm:DescribeZones",
"cvm:DescribeUserInstanceQuota",
"cvm:DescribeZoneInstanceConfigInfos",
"cvm:StopInstances",
"cvm:StartInstances",
"cvm:ResetInstance",
"cvm:EnterRescueMode",
"cvm:ExitRescueMode",
"cvm:ImportImage",
"vpc:DescribeSecurityGroups",
"vpc:DescribeAddresses",
"cdc:DescribeDedicatedClusters",
"cdc:DescribeDedicatedClusterInstanceTypes",
"cdc:DescribeDedicatedClusterCbsStatistics",
"lighthouse:DescribeInstances",
"lighthouse:DescribeBlueprints",
"cos:PutObject",
"cos:GetObject",
"cos:InitiateMultipartUpload",
"cos:UploadPart",
"cos:CompleteMultipartUpload",
"cos:AbortMultipartUpload",
"cos:HeadObject",
"cos:ListParts",
"cos:ListMultipartUploads",
"cos:GetBucket"
],
"resource": "*"
}
]
}

三、CVM_QCSLinkedRoleInCbsInit

使用场景： 当前角色为云服务器（CVM）服务相关角色，该角色将在已关联策略的权限范围内访问你的其他云服务资源。权限策略

·策略名称： QcloudAccessForCVMLinkedRoleInCbsinit

·策略内容：{
"version": "2.0",
"statement": [
{
"effect": "allow",
"resource": [
"*"
],
"action": [
"tat:RunCommand",
"tat:DescribeInvocations",
"tat:DescribeInvocationTasks",
"tat:DescribeAutomationAgentStatus"
]
}
]
}

四、CVM_QCSLinkedRoleInClawPro

使用场景： 当前角色为 云服务器-ClawPro 服务角色，该角色将在已关联策略的权限范围内访问你的其他云服务资源。权限策略

·策略名称： QcloudAccessForCVMLinkedRolelnClawPro

·策略内容：{
"version": "2.0",
"statement": [
{
"effect": "allow",
"action": [
"cvm:*",
"tat:*",
"vpc:*",
"ses:*",
"sms:*",
"cos:*",
"cls:*",
"csip:*",
"cwp:*",
"cam:PassRole",
"orcaterm:*",
"vdb:*",
"smh:*",
"tdai:*",
"ssl:*",
"tag:Describe*",
"finance:CheckAccountBalance",
"apis:*",
"tcb:*",
"lowcode:*",
"monitor:*",
"scf:BatchCreateTrigger",
"scf:CreateFunction",
"scf:CreateFunctionTestModel",
"scf:CreateTrigger",
"scf:DeleteFunction",
"scf:DeleteFunctionTestModel",
"scf:DeleteProvisionedConcurrencyConfig",
"scf:GetAlias",
"scf:GetFunction",
"scf:GetFunctionAddress",
"scf:GetFunctionLogs",
"scf:GetFunctionTestModel",
"scf:GetProvisionedConcurrencyConfig",
"scf:GetTempCosInfo",
"scf:Invoke",
"scf:ListFunctionTestModels",
"scf:ListFunctions",
"scf:ListVersionByFunction",
"scf:PublishVersion",
"scf:PutProvisionedConcurrencyConfig",
"scf:UpdateAlias",
"scf:UpdateFunctionCode",
"scf:UpdateFunctionConfiguration",
"scf:UpdateFunctionIncrementalCode",
"scf:UpdateFunctionTestModel",
"hai:*",
"tokenhub:*",
"es:CreateInstance",
"es:DescribeInstances",
"es:DescribeInstanceOperations",
"es:UpdateInstance",
"es:DescribeSpaces",
"es:CreateSpace",
"es:CreateAPIKey",
"es:DescribePostPayStatus",
"es:OpenPostPayService"
],
"resource": "*"
},
{
"effect": "allow",
"action": [
"finance:trade"
],
"resource": [
"qcs::cvm:::*",
"qcs::cls:::*",
"qcs::vdb:::*",
"qcs::smh:::*",
"qcs::es:::*"
]
}
]
}

五、CVM_QCSLinkedRoleInOpenClaw

使用场景： 当前角色为 云服务器-OpenClaw 服务角色，该角色将在已关联策略的权限范围内访问你的其他云服务资源。权限策略

·策略名称： QcloudAccessForCVMLinkedRoleInOpenClaw

·策略内容：{
"version": "2.0",
"statement": [
{
"effect": "allow",
"action": [
"cvm:*",
"tat:*",
"vpc:*",
"ses:*",
"sms:*"
],
"resource": "*"
},
{
"effect": "allow",
"action": [
"finance:trade"
],
"resource": [
"qcs::cvm:::*"
]
}
]
}

六、CVM_QCSLinkedRoleInClawProAgent

使用场景： 当前角色为 云服务器-ClawProAgent 服务角色，用于智能体访问腾讯云资源，该角色将在已关联策略的权限范围内访问你的其他云服务资源。权限策略

·策略名称： QcloudAccessForCVMLinkedRoleInClawProAgent

·策略内容：{
"statement": [
{
"action": [
"cls:pushLog",
"cls:getConfig",
"cls:agentHeartBeat",
"cls:MetricsRemoteWrite",
"cls:OpenClawService"
],
"effect": "allow",
"resource": [
"*"
]
}
],
"version": "2.0"
}

七、CVM_QCSLinkedRoleInCBSRecommender

使用场景： 当前角色为云服务器（CVM）服务相关角色，用于授权该角色将在已关联策略的权限范围内访问你的CVM、Organization等腾讯云资源。权限策略

·策略名称： QcloudAccessForCVMLinkedRoleInCBSRecommender

·策略内容：{
"version": "2.0",
"statement": [
{
"effect": "allow",
"action": [
"cvm:DescribeDisks",
"organization:DescribeOrganizationMembers",
"organization:DescribeOrganization",
"organization:CreateOrgMemberProductServiceRole",
"cvm:DescribeDiskRecommender"
],
"resource": "*"
}
]
}

八、CVM_QCSLinkedRoleInCVMRecommender

使用场景： 当前角色为云服务器(CVM)服务相关角色，该角色将在已关联策略的权限范围内访问你的CVM资源使用情况及相应的降本优化建议权限策略

·策略名称： QcloudAccessForCVMLinkedRoleInCVMRecommender

·策略内容：{
"version": "2.0",
"statement": [
{
"effect": "allow",
"action": [
"cos:ListParts",
"cos:PostObject",
"cos:PutObject*",
"cos:InitiateMultipartUpload",
"cos:UploadPart",
"cos:UploadPartCopy",
"cos:CompleteMultipartUpload",
"cos:AbortMultipartUpload",
"cos:ListMultipartUploads",
"organization:DescribeOrganizationMembers",
"organization:CreateOrgMemberProductServiceRole",
"region:DescribeRegions",
"cvm:DescribeInstances",
"cvm:DescribeInstancesStatus",
"monitor:GetMonitorData",
"cvm:InquiryPriceResetInstancesType",
"cvm:InquiryPriceTerminateInstances",
"cvm:DescribeZoneInstanceConfigInfos",
"cvm:InquiryPriceRunInstances",
"organization:DescribeOrganization"
],
"resource": "*"
}
]
}

九、CVM_QCSLinkedRoleInCVMSmartDiagnostic

使用场景： 当前角色为云服务器（CVM）服务相关角色，该角色将在已关联策略的权限范围内访问你的其他云服务资源。权限策略

·策略名称： QcloudAccessForCVMLinkedRoleInCVMSmartDiagnostic

·策略内容：{
"version": "2.0",
"statement": [
{
"action": [
"tat:DescribeAutomationAgentStatus",
"tat:RunCommand",
"tat:DescribeInvocationTasks",
"cwp:DescribeMachineInfo",
"cwp:DescribeMalWareList",
"cwp:DescribeHostLoginList",
"cwp:DescribeBruteAttackList",
"cwp:DescribeRiskDnsList",
"cwp:DescribeBashEvents"
],
"resource": "*",
"effect": "allow"
}
]
}