最近更新时间：2022.10.14 10:40:37
首次发布时间：2022.10.14 10:40:37
容器服务规范化并收敛了跨服务授权 ServiceRole（ServiceRoleForVKE）的权限策略 Policy（ServiceRolePolicyForVKE），避免因权限过大，而存在潜在的安全风险和安全审查漏洞。
收敛后的 ServiceRolePolicyForVKE 具体语法如下。
{ "Statement": [ { "Effect": "Allow", "Action": [ "ecs:Describe*", "ecs:Get*", "ecs:CreateInstances", "ecs:DeleteInstance", "ecs:DeleteVolume", "ecs:AttachVolume", "ecs:DetachVolume", "ecs:ExtendVolume", "ecs:ReplaceSystemVolume", "ecs:ModifyInstanceAttribute", "ecs:StartInstance", "ecs:StopInstance", "ecs:BindAssumeRole", "ecs:UnbindAssumeRole", "ecs:ListAssumeRoles" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "vpc:Describe*", "vpc:CreateSecurityGroup", "vpc:CreateNetworkInterface", "vpc:CreateRouteTable", "vpc:CreateRouteEntry", "vpc:CreateNetworkInterfacePermission", "vpc:AllocateEipAddress", "vpc:AuthorizeSecurityGroupIngress", "vpc:AuthorizeSecurityGroupEgress", "vpc:RevokeSecurityGroupIngress", "vpc:RevokeSecurityGroupEgress", "vpc:ModifyNetworkInterfaceAttributes", "vpc:AttachNetworkInterface", "vpc:DetachNetworkInterface", "vpc:DeleteSecurityGroup", "vpc:DeleteNetworkInterface", "vpc:DeleteRouteTable", "vpc:DeleteRouteEntry", "vpc:DeleteNetworkInterfacePermission", "vpc:AssociateRouteTable", "vpc:AssociateEipAddress", "vpc:DisassociateEipAddress", "vpc:DisassociateRouteTable", "vpc:ReleaseEipAddress", "vpc:ClientGroupAddClient", "vpc:ClientGroupDeleteClient", "vpc:ServerGroupAddServer", "vpc:ServerGroupDeleteServer", "vpc:AddBandwidthPackageIp", "vpc:RemoveBandwidthPackageIp" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "clb:Describe*", "clb:CreateLoadBalancer", "clb:CreateRules", "clb:CreateServerGroup", "clb:CreateListener", "clb:AddServerGroupBackendServers", "clb:ModifyLoadBalancerAttributes", "clb:ModifyListenerAttributes", "clb:ModifyServerGroupAttributes", "clb:ModifyRules", "clb:RemoveServerGroupBackendServers", "clb:DeleteLoadBalancer", "clb:DeleteServerGroup", "clb:DeleteListener", "clb:DeleteRules" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "alb:Describe*", "alb:CreateLoadBalancer", "alb:CreateServerGroup", "alb:CreateListener", "alb:CreateRules", "alb:AddServerGroupBackendServers", "alb:ModifyLoadBalancerAttributes", "alb:ModifyServerGroupBackendServers", "alb:ModifyServerGroupAttributes", "alb:ModifyListenerAttributes", "alb:ModifyRules", "alb:RemoveServerGroupBackendServers", "alb:DeleteLoadBalancer", "alb:DeleteServerGroup", "alb:DeleteListener", "alb:DeleteRules" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "natgateway:CreateNatGateway", "natgateway:CreateSnatEntry", "natgateway:Describe*", "natgateway:DeleteNatGateway", "natgateway:DeleteSnatEntry" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cr:List*", "cr:Get*" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "FileNAS:List*" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "tls:CreateProject", "tls:CreateTopic", "tls:CreateIndex", "tls:CreateRule", "tls:CreateHostGroup", "tls:Describe*" "tls:GetLogCollectorConfig", "tls:LogCollectorHeartbeat", "tls:PutLogs", "tls:ModifyRule", "tls:ApplyRuleToHostGroups", "tls:DeleteRuleFromHostGroups", "tls:DeleteRule" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "tos:ListBuckets" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "storage_ebs:Describe*", "storage_ebs:CreateVolume", "storage_ebs:AttachVolume", "storage_ebs:DetachVolume", "storage_ebs:ExtendVolume", "storage_ebs:DeleteVolume" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "algalon:List*", "algalon:CreateDatasource", "algalon:UpdateDatasource", "algalon:DeleteDatasource" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "vke:List*" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:List*", "iam:CreateRole", "iam:CreatePolicy", "iam:UpdatePolicy", "iam:AttachRolePolicy", "iam:DetachRolePolicy", "iam:DeleteRole", "iam:DeletePolicy" ], "Resource": [ "*" ] } ] }