一、实践背景
注意：说明：
注意：建议用户对目标账号配置对应云产品只读访问权限的预设策略，否则若有接口变更可能影响对应产品正常采集。
二、必要权限
必须授予账号以下预设策略和接口权限后才能进行采集。
| 云产品 | 预设策略 | 接口权限 |
| 腾讯云可观测平台 | QcloudMonitorReadOnlyAccess | monitor:DescribeBaseMetricsmonitor:GetMonitorDatamonitor:GetLastMonitorDatamonitor:DescribePrometheusIntegrationAuth |
| 标签 | QcloudTAGReadOnlyAccess | tag:DescribeResourceTagsByResourceIdstag:DescribeProjects |
三、云产品权限
用户可根据业务需求选择对应云产品及对应预设策略对角色进行授权，更多云产品预设策略和接口权限信息可在 策略列表 中进行搜索查看。
| 云产品 | 预设策略 | 接口权限 |
| 云服务器 | QcloudCVMReadOnlyAccess | cvm:DescribeInstancescvm:DescribeInstancesAttributes |
| 云服务器（内网） | QcloudCVMReadOnlyAccess | cvm:DescribeInstances |
| 云硬盘 | QcloudCVMReadOnlyAccess | cvm:DescribeCbsStoragescvm:DescribeInstances |
| 负载均衡（公网） | QcloudCLBReadOnlyAccess | clb:DescribeLoadBalancersclb:DescribeListenersclb:DescribeTargets |
| 负载均衡（内网） | QcloudCLBReadOnlyAccess | clb:DescribeLoadBalancersclb:DescribeListeners |
| 负载均衡（四层独占集群） | QcloudCLBReadOnlyAccess | clb:DescribeExclusiveClusters |
| 负载均衡（七层独占集群） | QcloudCLBReadOnlyAccess | clb:DescribeExclusiveClusters |
| 云数据库 MongoDB | QcloudMongoDBReadOnlyAccess | mongodb:DescribeDBInstances |
| 云数据库 MySQL（CDB） | QcloudCDBReadOnlyAccess | cdb:DescribeDBInstancescdb:DescribeCdbProxyInfo |
| 云数据库 Redis（CKV 版） | QcloudRedisReadOnlyAccess | redis:DescribeInstances |
| 云数据库 Redis（内存版） | QcloudRedisReadOnlyAccess | redis:DescribeInstancesredis:DescribeInstanceNodeInfo |
| 云数据库 Tendis | QcloudRedisReadOnlyAccess | redis:DescribeInstancesredis:DescribeInstanceNodeInfo |
| CTSDB（InfluxDB 版） | QcloudCTSDBReadOnlyAccess | ctsdb:DescribeClustersctsdb:DescribeAccessPoolctsdb:DescribeDatabases |
| 云数据库 MariaDB | QcloudMariaDBReadOnlyAccess | mariadb:DescribeDBInstances |
| 云数据库 PostgreSQL | QcloudPostgreSQLReadOnlyAccess | postgres:DescribeDBInstances |
| TDSQL MySQL 版 | QcloudTDSQLReadOnlyAccess | dcdb:DescribeDCDBInstances |
| TDSQL TDStore 引擎版 | QcloudTDMySQLReadOnlyAccess | tdmysql:DescribeDBInstancestdmysql:DescribeDBNodes |
| TDSQL-C MySQL 版 | QcloudCynosDBReadOnlyAccess | cynosdb:DescribeInstancescynosdb:DescribeProxies |
| 云数据库 SQL Server | QcloudSQLServerReadOnlyAccess | sqlserver:DescribeDBInstances |
| 云数据库 KeeWiDB | QcloudKeeWiDBReadOnlyaccess | keewidb:DescribeInstanceskeewidb:DescribeInstanceNodeInfo |
| 向量数据库 | QcloudVDBReadOnlyaccess | vdb:DescribeInstancesvdb:DescribeInstanceNodes |
| NAT 网关 | QcloudVPCReadOnlyAccess | vpc:DescribeNatGateways |
| NAT 实例监控丢包率 | QcloudVPCReadOnlyAccess | vpc:DescribeNatGateways |
| 消息队列 Ckafka 版 | QcloudCkafkaReadOnlyAccess | ckafka:DescribeInstancesDetailckafka:DescribeConsumerGroupckafka:DescribeTopicckafka:DescribeCvmInfockafka:DescribeTopicDetail |
| 消息队列 Pulsar 版 | QcloudTDMQReadOnlyAccess | tdmq:DescribeClusterstdmq:DescribeEnvironmentstdmq:DescribeTopicstdmq:DescribeSubscriptions |
| 消息队列 RocketMQ 版 | QcloudTrocketReadOnlyaccessQcloudTDMQReadOnlyAccess | trocket:DescribeInstanceListtrocket:DescribeFusionInstanceListtrocket:DescribeTopicListtrocket:DescribeConsumerGroupListtdmq:DescribeRocketMQClusterstdmq:DescribeRocketMQNamespacestdmq:DescribeRocketMQTopicstdmq:DescribeRocketMQGroups |
| 消息队列 RabbitMQ 版 | QcloudTDMQReadOnlyAccess | tdmq:DescribeRabbitMQVipInstancestdmq:DescribeRabbitMQNodeListtdmq:DescribeRabbitMQVirtualHosttdmq:DescribeRabbitMQExchangestdmq:DescribeRabbitMQQueues |
| 消息队列 RabbitMQ Serverless 版 | QcloudTrabbitReadOnlyaccess | trabbit:ListRabbitMQServerlessInstancestrabbit:DescribeRabbitMQServerlessVirtualHosttrabbit:DescribeRabbitMQServerlessExchangestrabbit:DescribeRabbitMQServerlessQueues |
| 消息队列 MQTT 版 | QcloudMQTTReadOnlyAccess | mqtt:DescribeInstanceListmqtt:DescribeTopicListmqtt:DescribeSharedSubscriptionGroupsWithSubscriptions |
| 弹性公网 IP | QcloudVPCReadOnlyAccess | vpc:DescribeAddressesvpc:DescribeIp6Addresses |
| VPN 网关 | QcloudVPCReadOnlyAccess | vpc:DescribeVpnGateways |
| VPN 通道 | QcloudVPCReadOnlyAccess | vpc:DescribeVpnConnections |
| 网络探测 | QcloudVPCReadOnlyAccess | vpc:DescribeNetDetects |
| 私有网络-跨可用区流量 | QcloudVPCReadOnlyAccess | vpc:DescribeVpcsvpc:DescribeSubnets |
| 私有网络-私有连接 | QcloudVPCReadOnlyAccess | vpc:DescribeVpcEndPointvpc:DescribeVpcEndPointService |
| 网络性能大盘-地域内 | 需通过自定义策略添加 region 权限 | region:DescribeRegionsregion:DescribeZones |
| 网络性能大盘-地域间 | 需通过自定义策略添加 region 权限 | region:DescribeRegionsregion:DescribeZones |
| CDN（中国境内域名） | QcloudCDNReadOnlyAccess | cdn:DescribeDomains |
| CDN（中国境外域名） | QcloudCDNReadOnlyAccess | cdn:DescribeDomains |
| COS | QcloudCOSReadOnlyAccess | cos:GetService |
| 专线接入-物理专线 | QcloudDCReadOnlyAccess | dc:DescribeDirectConnects |
| 专线接入-专用通道 | QcloudDCReadOnlyAccess | dc:DescribeDirectConnectTunnels |
| 专线接入-专线网关 | QcloudVPCReadOnlyAccess | vpc:DescribeDirectConnectGateways |
| 轻量应用服务器 | QcloudLighthouseReadOnlyAccess | lighthouse:DescribeInstances |
| 云原生 API 网关 | QcloudTSEReadOnlyAccess | tse:DescribeCloudNativeAPIGatewaystse:DescribeCloudNativeAPIGatewayNodestse:DescribePublicAddressConfigtse:DescribeNativeGatewayServiceSourcestse:DescribeCloudNativeAPIGatewayRoutestse:DescribeCloudNativeAPIGatewayServices |
| Nacos | QcloudTSEReadOnlyAccess | tse:DescribeSREInstancestse:DescribeNacosReplicastse:DescribeNacosServerInterfaces |
| Zookeeper | QcloudTSEReadOnlyAccess | tse:DescribeSREInstancestse:DescribeZookeeperReplicastse:DescribeZookeeperServerInterfaces |
| Elasticsearch | QcloudElasticsearchServiceReadOnlyAccess还需通过自定义策略添加 region 权限 | es:DescribeInstanceses:DescribeViewses:DescribeLogstashInstancesregion:DescribeZones |
| 流计算 Oceanus | QcloudOceanusReadOnlyAccess | oceanus:DescribeJobsoceanus:DescribeJobRuntimeInfo |
| 数据湖计算 DLC | QcloudDLCReadOnlyAccess | dlc:ListLakeFsInfodlc:ListDataEnginesdlc:DescribeSparkAppJobs |
| 腾讯云数据仓库 TCHouse-C | QcloudCDWCHReadOnlyAccess | cdwch:DescribeInstancesNewcdwch:DescribeInstanceNodes |
| 腾讯云数据仓库 TCHouse-D | QcloudCdwdorisReadOnlyaccess | cdwdoris:DescribeInstancescdwdoris:DescribeInstanceNodes |
| 数据传输服务 | QcloudDTSReadOnlyAccess | dts:DescribeSyncJobsdts:DescribeMigrateJobsdts:DescribeSubscribes |
| 云联网 | QcloudVPCReadOnlyAccess | vpc:DescribeCcnsvpc:DescribeCcnRegionBandwidthLimitsvpc:DescribeTrafficQosPolicyvpc:DescribeCcnAttachedInstances |
| 全球应用加速 | QcloudGAAPReadOnlyAccess | gaap:DescribeProxiesgaap:DescribeProxyGroupListgaap:DescribeProxyInstancesgaap:DescribeNoneBgpIpListgaap:DescribeTCPListenersgaap:DescribeUDPListeners |
| 全球加速2.0 | QcloudGATWOReadOnlyAccess | ga2:DescribeGlobalAcceleratorsga2:DescribeListenersga2:DescribeAccelerateAreas |
| EdgeOne（七层） | QcloudTEOReadOnlyaccess | teo:DescribeZonesteo:DescribeHostsSetting |
| EdgeOne（四层） | QcloudTEOReadOnlyaccess | teo:DescribeZonesteo:DescribeL4Proxyteo:DescribeL4ProxyRules |
| Web 应用防火墙 | QcloudWAFReadOnlyAccess | waf:DescribeDomains |
| 文件存储 | QcloudCFSReadOnlyAccess | cfs:DescribeCfsFileSystemscfs:DescribeCfsSnapshotscfs:DescribeUserQuotacfs:DescribeCfsFileSystemClients |
| 数据加速器 GooseFS | QcloudGoosefsReadOnlyaccess | goosefs:DescribeClusters |
| 数据加速器 GooseFSX | QcloudGoosefsReadOnlyaccess | goosefs:DescribeFileSystemsgoosefs:DescribeMonitorMetricUserViewgoosefs:DescribeMonitorMetricNodeViewgoosefs:DescribeFilesets |
| 共享带宽包 | QcloudVPCReadOnlyAccess | vpc:DescribeBandwidthPackagesvpc:DescribeBandwidthPackageResources |
| 云函数 | QcloudSCFReadOnlyAccess | scf:ListNamespacesscf:ListFunctionsscf:ListVersionByFunctionscf:ListAliases |
| 云点播（VOD） | QcloudVODReadonlyAccess | vod:DescribeSubAppIdsvod:DescribeDomainsvod:DescribeCdnBillingAreas |
| 云直播（CSS） | QcloudLIVEReadOnlyAccess | live:DescribeLiveDomains |
| 云直播 MCDN | QcloudLIVEReadOnlyAccess | live:DescribeMCDNDomains |
| 日志服务（CLS）-日志主题 | QcloudCLSReadOnlyAccess | cls:DescribeTopics |
| 数据万象 | QcloudCIReadOnlyAccess | ci:DescribeCIBuckets |
| API 网关 | QcloudAPIGWReadOnlyAccess | apigw:DescribeServicesStatusapigw:DescribeServiceEnvironmentListapigw:DescribeApisStatus |
| TI-ONE（任务式建模） | QcloudTIONEReadOnlyAccessContainMultiservice | tione:DescribeTrainingTaskstione:DescribeTrainingTaskPodstione:DescribeBillingResourceGroups |
| TI-ONE（Notebook） | QcloudTIONEReadOnlyAccessContainMultiservice | tione:DescribeNotebooks |
| TI-ONE（在线服务） | QcloudTIONEReadOnlyAccessContainMultiservice | tione:DescribeModelServiceGroupstione:DescribeModelServiceCallInfotione:DescribeBillingResourceGroups |
| TI-ONE(资源组) | QcloudTIONEReadOnlyAccessContainMultiservice | tione:DescribeBillingResourceGroups |
| 大模型服务平台 TokenHub | QcloudTokenhubReadOnlyAccess | tokenhub:DescribeModelEndpointListtokenhub:DescribeApiKeyList |
| Prometheus | QcloudMonitorReadOnlyAccess | monitor:DescribePrometheusInstances |