访问管理 费用中心

一、服务（相关）角色是由腾讯云服务预定义，经用户授权后相应服务即可通过扮演服务相关角色对用户资源进行访问操作。这篇档介绍具体服务相关角色的使用场景及相关权限策略信息。

二、Cost_QCSLinkedRoleCostDelegatedAdmin

·策略名称： QcloudFinanceCostDelegatedAdminRole

·策略内容：{
"version": "2.0",
"statement": [
{
"effect": "allow",
"action": [
"tag:GetTags",
"cam:DescribeSubAccountContacts",
"message:DescribeSubscription"
],
"resource": "*"
}
]
}

三、Cost_QCSLinkedRoleCostDelegatedAdminINT

使用场景： 当前角色为财务（finance）服务相关角色，用于授权finance访问cam、message、tag等腾讯云资源，无需用户托管密钥，操作更高效、更安全。该角色将在已关联策略的权限范围内访问你的其他云服务资源权限策略

·策略名称： QcloudFinanceCostDelegatedAdminRoleINT

·策略内容：{
"version": "2.0",
"statement": [
{
"effect": "allow",
"action": [
"message:DescribeReceiversOnMsgType",
"tag:GetTags",
"cam:DescribeSubAccountContacts"
],
"resource": "*"
}
]
}

四、FINANCE_QCSLinkedRoleInModifyInstancesOwner

使用场景： 当前角色为财务（Finance）服务相关角色，该角色将在已关联策略的权限范围内访问你的其他云服务资源。权限策略

·策略名称： QcloudAccessForFinanceLinkedRoleInModifyInstancesOwner

·策略内容：{
"version": "2.0",
"statement": [
{
"effect": "allow",
"action": [
"ssl:ModifyCertificateProject",
"ssl:DescribeCertificate",
"tag:UnTagResources",
"tag:DescribeResourceTags",
"tag:TagResources",
"tag:AddProject",
"tag:UpdateProject",
"cdb:ModifyDBInstanceSecurityGroups",
"cdb:DescribeDBSecurityGroups",
"cdb:ModifyDBInstanceProject",
"cdb:DescribeDBInstances",
"cfs:DescribeCfsFileSystems",
"ckafka:DescribeInstanceAttributes",
"ckafka:DescribeInstances",
"clb:DescribeLoadBalancers",
"clb:DescribeListeners",
"clb:SetLoadBalancerSecurityGroups",
"clb:ModifyLoadBalancersProject",
"cvm:DescribeInstances",
"cvm:ModifyInstancesProject",
"cvm:DescribeSecurityGroupPolicys",
"cvm:AssociateSecurityGroups",
"cvm:CreateSecurityGroup",
"cvm:DescribeAddresses",
"cvm:DescribeCbsStorages",
"cvm:ModifyCbsStorageAttributes",
"dcdb:DescribeDCDBInstances",
"dcdb:ModifyDBInstancesProject",
"dcdb:ModifyDBInstanceSecurityGroups",
"dcdb:DescribeDBSecurityGroups",
"mariadb:ModifyDBInstancesProject",
"mariadb:DescribeDBInstances",
"mariadb:ModifyDBInstanceSecurityGroups",
"mariadb:DescribeDBSecurityGroups",
"mongodb:DescribeDBInstances",
"mongodb:AssignProject",
"mongodb:DescribeAsyncRequestInfo",
"mongodb:DescribeSecurityGroup",
"mongodb:ModifyDBInstanceSecurityGroup",
"redis:DescribeInstances",
"redis:ModifyInstance",
"redis:ModifyDBInstanceSecurityGroups",
"redis:DescribeDBSecurityGroups",
"vpc:DescribeVpcEx",
"vpc:DescribeNetworkInterfaces",
"vpc:DescribeNatGateways",
"cvm:DisassociateNetworkInterfaceSecurityGroups",
"cvm:AssociateNetworkInterfaceSecurityGroups",
"cvm:DescribeSecurityGroups"
],
"resource": "*"
}
]
}