阿里云前置准备
本文主要介绍创建 BYOC 类型仓库涉及的阿里云平台相关操作，包括创建 RAM 用户并授权、创建专有网络 VPC 和交换机、了解资源编排和资源栈 等。
准备 RAM 用户并授权
创建 BYOC 类型仓库前，需提前准备好具备相关权限的阿里云 RAM 用户。
请将此文档发送给您的阿里云平台管理员，请求管理员参照此文档为您创建 RAM 用户，并授权。
管理员访问阿里云 RAM 访问控制 (opens in a new tab) 控制台，执行以下操作：
创建 RAM 用户
提示： 如果已有 RAM 用户，可以跳过创建 RAM 用户步骤。
点击左侧 身份管理 > 用户，进入用户管理页面，点击创建用户，输入相关信息，完成创建。
创建 RAM 用户组（可选）
提示： 如果已有 RAM 用户组，可以跳过创建 RAM 用户组步骤。
如果企业内存在多名人员使用 SelectDB Cloud，可以创建 RAM 用户组，并将相关人员加入用户组，并统一授权。
点击左侧 身份管理 > 用户组，进入用户组管理页面，点击创建用户组，输入相关信息，完成创建。
创建权限策略并授权
创建 SelectDB Cloud BYOC 类型仓库时，需要通过资源编排服务（ROS）执行资源栈模板，会创建 ECS、VPC、OSS 等云资源或进行相关操作，因此需要一系列 RAM 权限。
请参照下面步骤为 RAM 用户或用户组添加权限。
1. 创建权限策略： 点击左侧 权限管理 > 权限策略，进入权限策略管理页面，点击创建权限策略，切换到脚本编辑模式
清空原有文本框，复制以下脚本，输入文本框。详细的权限说明，请见下文 资源栈模板依赖的权限说明 部分。
{
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ecs:DescribeInstances",
"ecs:CreateInstance",
"ecs:RunInstances",
"ecs:StopInstance",
"ecs:StartInstance",
"ecs:RebootInstance",
"ecs:DeleteInstance",
"ecs:ModifyInstanceAttribute",
"ecs:ModifyInstanceChargeType",
"ecs:ModifyInstanceAutoRenewAttribute",
"ecs:ModifyInstanceSpec",
"ecs:ModifyPrepayInstanceSpec",
"ecs:DescribeDisks",
"ecs:ResizeDisk",
"ecs:DescribeTags",
"ecs:AddTags",
"ecs:RemoveTags",
"ecs:DescribeImages",
"ecs:DescribeKeyPairs",
"ecs:CreateKeyPair",
"ecs:AttachKeyPair",
"ecs:DeleteKeyPairs",
"ecs:DetachKeyPair",
"ecs:DescribeInvocations",
"ecs:InvokeCommand",
"ecs:RunCommand",
"ecs:DescribeSecurityGroups",
"ecs:AuthorizeSecurityGroup",
"ecs:AuthorizeSecurityGroupEgress",
"ecs:CreateSecurityGroup",
"ecs:DeleteSecurityGroup",
"ecs:JoinSecurityGroup",
"ecs:ModifySecurityGroupAttribute",
"ecs:LeaveSecurityGroup",
"ecs:ModifySecurityGroupEgressRule",
"ecs:ModifySecurityGroupPolicy",
"ecs:ModifySecurityGroupRule",
"ecs:RevokeSecurityGroup",
"ecs:RevokeSecurityGroupEgress",
"ecs:DescribeSecurityGroupAttribute",
"ecs:DeleteSecurityGroup",
"privatelink:CreateVpcEndpoint",
"privatelink:DeleteVpcEndpoint",
"privatelink:GetVpcEndpointAttribute",
"privatelink:ListVpcEndpoints",
"privatelink:ListVpcEndpointServicesByEndUser",
"privatelink:ListVpcEndpointSecurityGroups",
"privatelink:ListVpcEndpointConnections",
"privatelink:AddZoneToVpcEndpoint",
"privatelink:AttachSecurityGroupToVpcEndpoint",
"privatelink:DetachSecurityGroupFromVpcEndpoint",
"privatelink:DetachSecurityGroupFromVpcEndpoint",
"privatelink:RemoveZoneFromVpcEndpoint",
"privatelink:UpdateVpcEndpointConnectionAttribute",
"privatelink:TagResources",
"privatelink:UntagResources",
"privatelink:UpdateVpcEndpointAttribute"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"vpc:DescribeVpcs",
"vpc:DescribeVSwitches",
"slb:DescribeLoadBalancers",
"slb:DescribeLoadBalancerAttribute",
"slb:CreateLoadBalancer",
"slb:DeleteLoadBalancer",
"slb:DescribeLoadBalancerListeners",
"slb:CreateLoadBalancerHTTPListener",
"slb:CreateLoadBalancerTCPListener",
"slb:StartLoadBalancerListener",
"slb:DeleteLoadBalancerListener",
"slb:DescribeVServerGroups",
"slb:DescribeVServerGroupAttribute",
"slb:CreateVServerGroup",
"slb:AddVServerGroupBackendServers",
"slb:ModifyVServerGroupBackendServers",
"slb:RemoveVServerGroupBackendServers",
"slb:RemoveBackendServers",
"slb:DeleteVServerGroup",
"slb:DescribeAccessControlLists",
"slb:CreateAccessControlList",
"slb:AddAccessControlListEntry",
"slb:RemoveAccessControlListEntry",
"slb:DeleteAccessControlList",
"slb:DescribeRules",
"slb:CreateRules",
"slb:DeleteRules",
"slb:DescribeTags",
"slb:AddTags",
"slb:RemoveTags"
],
"Resource": [
"acs:vpc:cn-beijing:*:*",
"acs:slb:cn-beijing:*:*"
]
},
{
"Effect": "Allow",
"Action": "oss:*",
"Resource": [
"acs:oss:*:*:selectdb-bucket-*",
"acs:oss:*:*:selectdb-bucekt-*/*"
]
},
{
"Effect": "Allow",
"Action": [
"ram:GetUser",
"ram:ListPoliciesForUser",
"ram:ListUsers",
"ram:ListGroupsForUser",
"ram:AttachPolicyToUser",
"ram:CreateUser",
"ram:DeleteUser",
"ram:DetachPolicyFromUser",
"ram:UpdateUser",
"ram:CreateAccessKey",
"ram:DeleteAccessKey",
"ram:UpdateAccessKey",
"ram:GetAccessKeyLastUsed",
"ram:ListAccessKeys",
"ram:ListEntitiesForPolicy",
"ram:AttachPolicyToRole",
"ram:CreatePolicy",
"ram:DeletePolicy",
"ram:DetachPolicyFromRole",
"ram:UpdatePolicyDescription",
"ram:GetPolicy",
"ram:CreateRole",
"ram:DeleteRole",
"ram:PassRole",
"ram:UpdateRole",
"ram:GetRole",
"ram:ListPoliciesForRole",
"ram:ListRoles",
"sts:AssumeRole"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "ros:*",
"Resource": "*"
}
]
}
点击继续编辑基本信息，输入名称，点击确定，完成创建权限策略。
2. 为 RAM 用户或用户组授权权限策略： 点击左侧 权限管理 > 授权，进入授权页面。授权主体选择 RAM 用户或用户组，选择上述步骤创建的权限策略，点击确认新增授权 完成授权。
至此，您已完成 RAM 用户或用户组创建，并已完成授权。
准备专有网络 VPC 和交换机
提示：
- 如果已有符合地域和可用区要求的 VPC 和交换机，并期望将 BYOC 仓库部署在此 VPC 内，可以跳过下面创建专有网络 VPC 和交换机步骤。
- 当前支持的地域和交换机可用区为：
- 北京：可用区H 和 可用区K
- 上海：可用区B 和 可用区E
- 广州：可用区A
- 深圳：可用区D 和 可用区F
- 法兰克福：可用区A
创建 BYOC 类型仓库前，需要使用上述 RAM 用户提前创建专有网络 VPC 和交换机，以下是具体操作。
打开阿里云 专有网络 VPC (opens in a new tab) 控制台，点击 专有网络 > 创建专有网络，进入 VPC 创建页面。
选择您期望创建 BYOC 仓库的地域，输入名称、选择 IPv4 网段，输入交换机名称和可用区，点击确定完成创建。
了解资源编排和资源栈
当用户创建 BYOC 类型仓库时，会首先借助云厂商的资源编排服务自动部署 Agent，完成 Agent 与 SelectDB Cloud 平台之间的私有连接，然后由 Agent 负责 BYOC 仓库的部署与管理工作。
ROS 资源编排模版说明
SelectDB 提供的资源编排模板运行在您的云账号下，并且模版代码可见、可审计，不会对您的数据与 VPC 内的其他环境进行操作。您可以通过以下链接获取 SelectDB 提供的资源编排模板：
https://selectdb-cloud-online-bj.oss-cn-beijing.aliyuncs.com/public/aliyun-cn-shanghai-byoc-cf.yaml当您通过阿里云 ROS 执行上述资源模板时，它会自动进行 Agent 的创建与部署。然后 Agent 会与 SelectDB Cloud 建立私有连接，并完成仓库初始化流程。
在完成资源编排脚本执行后，您即可从 SelectDB Cloud 平台进入相应仓库，像使用普通的仓库一样，开始新建用于数据分析的计算集群。
如何查看资源栈信息
您可以通过阿里云 资源编排ROS (opens in a new tab) 控制台，查看由 SelectDB 资源栈模板创建的所有资源信息，并可通过资源名称查看特定资源。
注意 所有资源栈模版创建出来的资源，都属于您的云账号，并只在您的 VPC 内使用，不会外泄。
- ECS
- 名称：SelectDBAgent（ECS 机器）、SelectDBKeyPair（密钥对）
- 用途：用于部署 Agent 类程序，并提供密钥登录能力
- 终端节点
- 名称：SelectDBEndpoint
- 用途：与 SelectDB Cloud 平台建立私网连接，从而可以拉取管控指令、推送监控和日志
- Bucket
- 名称：SelectDBBucket
- 用途：存储数仓数据
- 安全组
- 名称：SelectDBSecurityGroup
- 用途：绑定在终端节点和 ECS 实例，并通过安全组规则限定特定端口特定子网的流量才能通行（允许来自同一子网的443、22、5000、9090、8888、8666、8777端口流量入网，允许所有端口流量出网）
- RAM User / RAM Role
- 名称：SelectDBUser（子用户），SelectDBUserAccessKey（aksk），SelectDBUserPolicy（子用户权限），SelectDBRole（角色），SelectDBRolePolicy（角色权限）
- 用途：创建出的子用户具备 Agent 所需的最小权限，之后进行的所有业务操作均使用该子用户的身份
资源栈模板依赖的权限说明
在您的云账号下通过资源编排服务（ROS）执行资源栈模板时，会创建 ECS、VPC、OSS 等云资源或进行相关操作，因此需要一系列 RAM 权限。在正式执行前，请确保执行此模板的用户具备相应权限，否则可能会遇到执行模板失败的情况。
注意 资源栈模版的执行过程完全在您的云账号下进行，创建出来的资源也都属于您的云账号。SelectDB 不会获取您的云账号信息，也无法使用该账号的相应 RAM 权限。
以下是根据模板中定义的资源和操作所需的权限：
-
权限汇总：
{ "Version": "1", "Statement": [ { "Effect": "Allow", "Action": [ "ecs:DescribeInstances", "ecs:CreateInstance", "ecs:RunInstances", "ecs:StopInstance", "ecs:StartInstance", "ecs:RebootInstance", "ecs:DeleteInstance", "ecs:ModifyInstanceAttribute", "ecs:ModifyInstanceChargeType", "ecs:ModifyInstanceAutoRenewAttribute", "ecs:ModifyInstanceSpec", "ecs:ModifyPrepayInstanceSpec", "ecs:DescribeDisks", "ecs:ResizeDisk", "ecs:DescribeTags", "ecs:AddTags", "ecs:RemoveTags", "ecs:DescribeImages", "ecs:DescribeKeyPairs", "ecs:CreateKeyPair", "ecs:AttachKeyPair", "ecs:DeleteKeyPairs", "ecs:DetachKeyPair", "ecs:DescribeInvocations", "ecs:InvokeCommand", "ecs:RunCommand", "ecs:DescribeSecurityGroups", "ecs:AuthorizeSecurityGroup", "ecs:AuthorizeSecurityGroupEgress", "ecs:CreateSecurityGroup", "ecs:DeleteSecurityGroup", "ecs:JoinSecurityGroup", "ecs:ModifySecurityGroupAttribute", "ecs:LeaveSecurityGroup", "ecs:ModifySecurityGroupEgressRule", "ecs:ModifySecurityGroupPolicy", "ecs:ModifySecurityGroupRule", "ecs:RevokeSecurityGroup", "ecs:RevokeSecurityGroupEgress", "ecs:DescribeSecurityGroupAttribute", "ecs:DeleteSecurityGroup", "privatelink:CreateVpcEndpoint", "privatelink:DeleteVpcEndpoint", "privatelink:GetVpcEndpointAttribute", "privatelink:ListVpcEndpoints", "privatelink:ListVpcEndpointServicesByEndUser", "privatelink:ListVpcEndpointSecurityGroups", "privatelink:ListVpcEndpointConnections", "privatelink:AddZoneToVpcEndpoint", "privatelink:AttachSecurityGroupToVpcEndpoint", "privatelink:DetachSecurityGroupFromVpcEndpoint", "privatelink:DetachSecurityGroupFromVpcEndpoint", "privatelink:RemoveZoneFromVpcEndpoint", "privatelink:UpdateVpcEndpointConnectionAttribute", "privatelink:TagResources", "privatelink:UntagResources", "privatelink:UpdateVpcEndpointAttribute" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "vpc:DescribeVpcs", "vpc:DescribeVSwitches", "slb:DescribeLoadBalancers", "slb:DescribeLoadBalancerAttribute", "slb:CreateLoadBalancer", "slb:DeleteLoadBalancer", "slb:DescribeLoadBalancerListeners", "slb:CreateLoadBalancerHTTPListener", "slb:CreateLoadBalancerTCPListener", "slb:StartLoadBalancerListener", "slb:DeleteLoadBalancerListener", "slb:DescribeVServerGroups", "slb:DescribeVServerGroupAttribute", "slb:CreateVServerGroup", "slb:AddVServerGroupBackendServers", "slb:ModifyVServerGroupBackendServers", "slb:RemoveVServerGroupBackendServers", "slb:RemoveBackendServers", "slb:DeleteVServerGroup", "slb:DescribeAccessControlLists", "slb:CreateAccessControlList", "slb:AddAccessControlListEntry", "slb:RemoveAccessControlListEntry", "slb:DeleteAccessControlList", "slb:DescribeRules", "slb:CreateRules", "slb:DeleteRules", "slb:DescribeTags", "slb:AddTags", "slb:RemoveTags" ], "Resource": [ "acs:vpc:cn-beijing:*:*", "acs:slb:cn-beijing:*:*" ] }, { "Effect": "Allow", "Action": "oss:*", "Resource": [ "acs:oss:*:*:selectdb-bucket-*", "acs:oss:*:*:selectdb-bucekt-*/*" ] }, { "Effect": "Allow", "Action": [ "ram:GetUser", "ram:ListPoliciesForUser", "ram:ListUsers", "ram:ListGroupsForUser", "ram:AttachPolicyToUser", "ram:CreateUser", "ram:DeleteUser", "ram:DetachPolicyFromUser", "ram:UpdateUser", "ram:CreateAccessKey", "ram:DeleteAccessKey", "ram:UpdateAccessKey", "ram:GetAccessKeyLastUsed", "ram:ListAccessKeys", "ram:ListEntitiesForPolicy", "ram:AttachPolicyToRole", "ram:CreatePolicy", "ram:DeletePolicy", "ram:DetachPolicyFromRole", "ram:UpdatePolicyDescription", "ram:GetPolicy", "ram:CreateRole", "ram:DeleteRole", "ram:PassRole", "ram:UpdateRole", "ram:GetRole", "ram:ListPoliciesForRole", "ram:ListRoles", "sts:AssumeRole" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ros:*", "Resource": "*" } ] } -
Elastic Compute Service (ECS) 权限:
- 管理 ECS 实例
"ecs:DescribeInstances", "ecs:CreateInstance", "ecs:RunInstances", "ecs:StopInstance", "ecs:StartInstance", "ecs:RebootInstance", "ecs:RenewInstance", "ecs:DeleteInstance", "ecs:ModifyInstanceAttribute", "ecs:ModifyInstanceChargeType", "ecs:ModifyInstanceAutoRenewAttribute", "ecs:ModifyInstanceSpec", "ecs:ModifyPrepayInstanceSpec", "ecs:DescribeDisks", "ecs:ResizeDisk", "ecs:DescribeTags", "ecs:AddTags", "ecs:RemoveTags", "ecs:DescribeImages",- 管理 ECS 安全组
"ecs:DescribeSecurityGroups", "ecs:AuthorizeSecurityGroup", "ecs:AuthorizeSecurityGroupEgress", "ecs:CreateSecurityGroup", "ecs:DeleteSecurityGroup", "ecs:JoinSecurityGroup", "ecs:ModifySecurityGroupAttribute", "ecs:LeaveSecurityGroup", "ecs:ModifySecurityGroupEgressRule", "ecs:ModifySecurityGroupPolicy", "ecs:ModifySecurityGroupRule", "ecs:RevokeSecurityGroup", "ecs:RevokeSecurityGroupEgress", "ecs:DescribeSecurityGroupAttribute", "ecs:DeleteSecurityGroup",- 管理 ECS SSH 密钥对
"ecs:DescribeKeyPairs", "ecs:CreateKeyPair", "ecs:AttachKeyPair", "ecs:DeleteKeyPairs", "ecs:DetachKeyPair",- 执行 ECS 云助手相关操作
"ecs:DescribeInvocations", "ecs:InvokeCommand", "ecs:RunCommand" -
Virtual Private Cloud (VPC) 和 PrivateLink 权限:
- 获取 VPC 相关资源信息
"vpc:DescribeVpcs", "vpc:DescribeVSwitches",- 管理 PrivateLink 终端节点
"privatelink:CreateVpcEndpoint", "privatelink:DeleteVpcEndpoint", "privatelink:GetVpcEndpointAttribute", "privatelink:ListVpcEndpoints", "privatelink:ListVpcEndpointServicesByEndUser", "privatelink:ListVpcEndpointSecurityGroups", "privatelink:ListVpcEndpointConnections", "privatelink:AddZoneToVpcEndpoint", "privatelink:AttachSecurityGroupToVpcEndpoint", "privatelink:DetachSecurityGroupFromVpcEndpoint", "privatelink:TagResources", "privatelink:UntagResources", "privatelink:UpdateVpcEndpointAttribute",- 管理负载均衡器（SLB）资源
"slb:DescribeLoadBalancers", "slb:DescribeLoadBalancerAttribute", "slb:CreateLoadBalancer", "slb:DeleteLoadBalancer", "slb:DescribeLoadBalancerListeners", "slb:CreateLoadBalancerHTTPListener", "slb:CreateLoadBalancerTCPListener", "slb:StartLoadBalancerListener", "slb:DeleteLoadBalancerListener", "slb:DescribeVServerGroups", "slb:DescribeVServerGroupAttribute", "slb:CreateVServerGroup", "slb:AddVServerGroupBackendServers", "slb:ModifyVServerGroupBackendServers", "slb:RemoveVServerGroupBackendServers", "slb:RemoveBackendServers", "slb:DeleteVServerGroup", "slb:DescribeAccessControlLists", "slb:CreateAccessControlList", "slb:AddAccessControlListEntry", "slb:RemoveAccessControlListEntry", "slb:DeleteAccessControlList", "slb:DescribeRules", "slb:CreateRules", "slb:DeleteRules", "slb:DescribeTags", "slb:AddTags", "slb:RemoveTags" -
Object Storage Service (OSS) 权限:
- 管理 OSS 存储桶以及对存储桶及其内容进行读写操作(针对特定桶)
{ "Effect": "Allow", "Action": "oss:*", "Resource": [ "acs:oss:*:*:selectdb-bucket-*", "acs:oss:*:*:selectdb-bucekt-*/*" ] }, -
Resource Access Management (RAM) 权限:
- 管理 RAM 用户
"ram:GetUser", "ram:ListPoliciesForUser", "ram:ListUsers", "ram:ListGroupsForUser", "ram:AttachPolicyToUser", "ram:CreateUser", "ram:DeleteUser", "ram:DetachPolicyFromUser", "ram:UpdateUser",- 管理 RAM 访问密钥
"ram:CreateAccessKey", "ram:DeleteAccessKey", "ram:UpdateAccessKey", "ram:GetAccessKeyLastUsed", "ram:ListAccessKeys",- 管理 RAM 策略
ram:AttachPolicyToRole ram:AttachPolicyToUser ram:CreatePolicy ram:DeletePolicy ram:DetachPolicyFromRole ram:DetachPolicyFromUser ram:UpdatePolicyDescription ram:GetPolicy- 管理 RAM 角色
"ram:CreateRole", "ram:DeleteRole", "ram:PassRole", "ram:UpdateRole", "ram:GetRole", "ram:ListPoliciesForRole", "ram:ListRoles", "sts:AssumeRole" -
Resource Orchestration Service（ROS）权限：
- 管理资源栈
"ros:*"
资源栈模板创建的子用户的权限说明
初次执行完资源栈模板后会创建一个子用户，用于后续在您的 VPC 内管控数据仓库相关组件，以下为该子用户拥有的权限说明。
注意 创建出来的子用户隶属于您的云账号，并只在您的 VPC 内使用，不会外泄。
# 策略1: 允许对 ECS,VPC,LB 进行相关操作
- Action:
# ECS https://help.aliyun.com/zh/ecs/user-guide/control-access-to-resources-by-using-ram-users?spm=a2c4g.11186623.0.nextDoc.38e61906zVPKhn
# CloudAssistant https://help.aliyun.com/zh/ecs/user-guide/use-ram-to-implement-permission-control#section-4ym-u5j-3gc
- "ecs:DescribeInstances"
- "ecs:RunInstances"
- "ecs:StopInstance"
- "ecs:StartInstance"
- "ecs:RebootInstance"
- "ecs:RenewInstance"
- "ecs:DeleteInstance"
- "ecs:ModifyInstanceAttribute"
- "ecs:ModifyInstanceChargeType"
- "ecs:ModifyInstanceAutoRenewAttribute"
- "ecs:ModifyInstanceSpec"
- "ecs:ModifyPrepayInstanceSpec"
- "ecs:DescribeDisks"
- "ecs:ResizeDisk"
- "ecs:DescribeTags"
- "ecs:AddTags"
- "ecs:RemoveTags"
- "ecs:DescribeSecurityGroups"
- "ecs:CreateSecurityGroup"
- "ecs:AuthorizeSecurityGroup"
- "ecs:AuthorizeSecurityGroupEgress"
- "ecs:DescribeSecurityGroupAttribute"
- "ecs:DeleteSecurityGroup"
- "ecs:DescribeKeyPairs"
- "ecs:AttachKeyPair"
- "ecs:DetachKeyPair"
- "ecs:InvokeCommand"
- "ecs:RunCommand"
- "ecs:DescribeInvocations"
# VPC https://help.aliyun.com/zh/ram/developer-reference/aliyunvpcfullaccess?spm=a2c4g.11186623.0.i24
- "vpc:DescribeVpcs"
- "vpc:DescribeVSwitches"
# LB https://help.aliyun.com/zh/slb/classic-load-balancer/developer-reference/ram-authorization?spm=a2c4g.11186623.0.i6#concept-slb-rjf-cz
- "slb:DescribeLoadBalancers"
- "slb:DescribeLoadBalancerAttribute"
- "slb:CreateLoadBalancer"
- "slb:DeleteLoadBalancer"
- "slb:DescribeLoadBalancerListeners"
- "slb:CreateLoadBalancerHTTPListener"
- "slb:CreateLoadBalancerTCPListener"
- "slb:StartLoadBalancerListener"
- "slb:DeleteLoadBalancerListener"
- "slb:DescribeVServerGroups"
- "slb:DescribeVServerGroupAttribute"
- "slb:CreateVServerGroup"
- "slb:AddVServerGroupBackendServers"
- "slb:ModifyVServerGroupBackendServers"
- "slb:RemoveVServerGroupBackendServers"
- "slb:RemoveBackendServers"
- "slb:DeleteVServerGroup"
- "slb:DescribeAccessControlLists"
- "slb:CreateAccessControlList"
- "slb:AddAccessControlListEntry"
- "slb:RemoveAccessControlListEntry"
- "slb:DeleteAccessControlList"
- "slb:DescribeRules"
- "slb:CreateRules"
- "slb:DeleteRules"
- "slb:DescribeTags"
- "slb:AddTags"
- "slb:RemoveTags"
Resource:
- "acs:ecs:cn-beijing:*:*"
- "acs:vpc:cn-beijing:*:*"
- "acs:slb:cn-beijing:*:*"
Effect: Allow
# 策略2: 允许对刚创建出的 Bucket 及其中的对象进行增删改查操作
- Action:
# Bucket https://help.aliyun.com/zh/oss/user-guide/overview-22?spm=a2c4g.11186623.0.i63#section-3wi-z7m-fmq
- "oss:*"
Resource:
- Fn::Join:
- ''
- - 'acs:oss:*:*:'
- Ref: SelectDBBucket
- ""
- Fn::Join:
- ''
- - 'acs:oss:*:*:'
- Ref: SelectDBBucket
- "/*"
Effect: Allow
# 策略3: 允许进行访问控制相关操作, 该 RAM User 能够扮演指定的 RAM Role
- Action:
# RAM https://help.aliyun.com/zh/ram/developer-reference/api-ram-2015-05-01-ram?spm=a2c4g.11186623.0.i74
- "sts:AssumeRole"
Resource:
- Fn::GetAtt:
- SelectDBRole
- Arn
Effect: Allow具体权限划分如下：
-
Elastic Compute Service (ECS) 权限:
- 管理 ECS 实例
"ecs:DescribeInstances", "ecs:RunInstances", "ecs:StopInstance", "ecs:StartInstance", "ecs:RebootInstance", "ecs:RenewInstance", "ecs:DeleteInstance", "ecs:ModifyInstanceAttribute", "ecs:ModifyInstanceChargeType", "ecs:ModifyInstanceAutoRenewAttribute", "ecs:ModifyInstanceSpec", "ecs:ModifyPrepayInstanceSpec", "ecs:DescribeDisks", "ecs:ResizeDisk", "ecs:DescribeTags", "ecs:AddTags", "ecs:RemoveTags",- 管理 ECS 安全组
"ecs:DescribeSecurityGroups", "ecs:CreateSecurityGroup", "ecs:AuthorizeSecurityGroup", "ecs:AuthorizeSecurityGroupEgress", "ecs:DescribeSecurityGroupAttribute", "ecs:DeleteSecurityGroup",- 管理 ECS SSH 密钥对
"ecs:DescribeKeyPairs", "ecs:AttachKeyPair", "ecs:DetachKeyPair",- 执行 ECS 云助手相关操作
"ecs:InvokeCommand", "ecs:RunCommand", "ecs:DescribeInvocations", -
Virtual Private Cloud (VPC) 和 SLB 权限:
- 获取 VPC 相关资源信息
"vpc:DescribeVpcs"， "vpc:DescribeVSwitches"，- 管理负载均衡器（SLB）资源
"slb:DescribeLoadBalancers", "slb:DescribeLoadBalancerAttribute", "slb:CreateLoadBalancer", "slb:DeleteLoadBalancer", "slb:DescribeLoadBalancerListeners", "slb:CreateLoadBalancerHTTPListener", "slb:CreateLoadBalancerTCPListener", "slb:StartLoadBalancerListener", "slb:DeleteLoadBalancerListener", "slb:DescribeVServerGroups", "slb:DescribeVServerGroupAttribute", "slb:CreateVServerGroup", "slb:AddVServerGroupBackendServers", "slb:ModifyVServerGroupBackendServers", "slb:RemoveVServerGroupBackendServers", "slb:RemoveBackendServers", "slb:DeleteVServerGroup", "slb:DescribeAccessControlLists", "slb:CreateAccessControlList", "slb:AddAccessControlListEntry", "slb:RemoveAccessControlListEntry", "slb:DeleteAccessControlList", "slb:DescribeRules", "slb:CreateRules", "slb:DeleteRules", "slb:DescribeTags", "slb:AddTags", "slb:RemoveTags", -
Object Storage Service (OSS) 权限:
- 管理 OSS 存储桶以及对存储桶及其内容进行读写操作(针对特定桶)
- Action: # Bucket https://help.aliyun.com/zh/oss/user-guide/overview-22?spm=a2c4g.11186623.0.i63#section-3wi-z7m-fmq - "oss:*" Resource: - Fn::Join: - '' - - 'acs:oss:*:*:' - Ref: SelectDBBucket - "" - Fn::Join: - '' - - 'acs:oss:*:*:' - Ref: SelectDBBucket - "/*" Effect: Allow -
Resource Access Management (RAM) 权限:
- 允许扮演特定角色
- Action: # RAM https://help.aliyun.com/zh/ram/developer-reference/api-ram-2015-05-01-ram?spm=a2c4g.11186623.0.i74 - "sts:AssumeRole" Resource: - Fn::GetAtt: - SelectDBRole - Arn Effect: Allow