本文为您介绍AgentKit的IAM策略。 ## 系统预设策略 ### AgentKit系统预设策略 IAM平台已提前为您设置了关于AgentKit的默认策略，具体如下表所示。您可直接为IAM身份（IAM用户、用户组或角色）授权系统预设策略。**系统预设策略只能用于授权，不可编辑和修改**。 |系统预设策略名称 |描述 | |---|---| |AgentKitFullAccess |被授权该策略后的IAM身份（IAM用户、用户组、角色），可获得权限范围（全局权限或项目权限）内AgentKit的管理权限，包括创建、修改、删除、查看资源等操作。 | |AgentKitReadOnlyAccess |被授权该策略后的IAM身份（IAM用户、用户组、角色），可获得权限范围（全局权限或项目权限）内AgentKit的只读权限。仅可查看AgentKit相关资源，不可对资源进行任何管理操作，也不可查看其他未授权的云产品。 | ### AgentKit系统预设策略详情 :::tip 如需查看更多系统预设策略详情，请前往[策略管理控制台](https://console.volcengine.com/iam/policymanage?scope=System)。 ::: #### AgentKitFullAccess 策略详情 :::tip 被授予此权限后，可获取权限范围内全部AgentKit资源的管理权限、访问控制IAM等的查看权限。 ::: ```JSON { "Statement": [ { "Effect": "Allow", "Action": [ "agentkit:*", "apig:ConvertMcpConfig", "apmplus_server:CreateOrder", "apmplus_server:GetCheckAccountStatus", "ark:CreateApiKey", "ark:GetEndpoint", "ark:GetRawApiKey", "ark:InnerDescribeModelEndpoints", "ark:ListApiKeys", "ark:ListEndpoints", "ark:ListFoundationModelVersions", "ark:ListModelChargeItems", "ark:OpenModelChargeItem", "cp:CreatePipeline", "cp:CreateWorkspace", "cp:DeletePipeline", "cp:GetDefaultWorkspaceInner", "cp:GetInstance", "cp:GetTaskRunLog", "cp:GetTaskRunLogDownloadURI", "cp:ListPipelineRuns", "cp:ListPipelineRunStagesInner", "cp:ListPipelines", "cp:ListWorkspaces", "cp:RunPipeline", "cr:AddVpcEndpointLinkedVpc", "cr:CreateEndpointAclPolicies", "cr:CreateNamespace", "cr:CreateRegistry", "cr:CreateRepository", "cr:DeleteEndpointAclPolicies", "cr:DeleteNamespace", "cr:DeleteRegistry", "cr:DeleteTags", "cr:GetAuthorizationToken", "cr:GetPublicEndpoint", "cr:GetVpcEndpoint", "cr:ListDomains", "cr:ListNamespaces", "cr:ListRegistries", "cr:ListRepositories", "cr:ListTags", "cr:RemoveVpcEndpointLinkedVpc", "cr:StartRegistry", "cr:UpdateNamespace", "cr:UpdatePublicEndpoint", "cr:UpdateVpcEndpoint", "ESCloud:GetMLApiKey", "ESCloud:GetScene", "ESCloud:GetSceneInstance", "ESCloud:ListMLApiKeys", "iam:AttachRolePolicy", "iam:CheckServiceLinkedRole", "iam:CreateRole", "iam:CreateServiceLinkedRole", "iam:DeleteRole", "iam:DetachRolePolicy", "iam:GetPolicy", "iam:GetRole", "iam:GetServiceLinkedRoleTemplate", "iam:GetUser", "iam:ListProjects", "iam:ListRoles", "iam:ListUsers", "iam:UpdateRole", "id:CreateApiKey", "id:CreateApiKeyCredentialProvider", "id:CreateInboundAuthConfig", "id:DeleteApiKey", "id:DeleteInboundAuthConfig", "id:GetCallerIdentity", "id:GetInboundAuthConfig", "id:GetResourceApiKey", "id:GetTenantServiceStatus", "id:GetUserPool", "id:GetUserPoolClient", "id:ListCredentialProviders", "id:ListUserPoolClients", "id:ListUserPools", "id:UpdateInboundAuthConfig", "location:DescribeRegions", "mem0:CreateMemoryProject", "mem0:DeleteMemoryProject", "mem0:DescribeAPIKeyDetail", "mem0:DescribeMemoryProjectDetail", "mem0:DescribeMemoryProjects", "mem0:ModifyMemoryProjectLongTermStrategy", "mem0:SearchMemory", "ml_platform:GetKnowledgeBaseServiceInfo", "ml_platform:ListCollections", "sts:AssumeRole", "tls:ActiveTlsAccount", "tls:GetAccountStatus", "tls:GetProject", "tls:GetTopic", "tls:ListProjects", "tls:ListTopics", "tos:CopyObject", "tos:CreateBucket", "tos:DeleteBucket", "tos:DeleteObject", "tos:GetAccountStatus", "tos:GetBucketInfo", "tos:HeadBucket", "tos:HeadObject", "tos:ListBuckets", "tos:ListObjectsV2", "tos:PostObject", "tos:PutObject", "vefaas:CreateFunction", "vefaas:CreateSandbox", "vefaas:DeleteFunction", "vefaas:DescribeSandbox", "vefaas:EnableUserCrVpcTunnel", "vefaas:GetAvailabilityZones", "vefaas:GetFunction", "vefaas:GetImageConfig", "vefaas:GetImageSyncStatus", "vefaas:GetReleaseStatus", "vefaas:KillSandbox", "vefaas:ListFunctions", "vefaas:ListSandboxes", "vefaas:QueryUserCrVpcTunnel", "vefaas:Release", "vefaas:SetSandboxTimeout", "vefaas:UpdateFunction", "vikingdb:GetMemorydbInstanceDetail", "vikingdb:MemoryCollectionInfo", "vikingdb:MemoryCollectionList", "vikingdb:MemorySearch", "vikingdb:MemorySearchUser", "vpc:DescribeSecurityGroups", "vpc:DescribeSubnets", "vpc:DescribeVpcAttributes", "vpc:DescribeVpcs" ], "Resource": [ "*" ] } ] } ``` #### AgentKitReadOnlyAccess 策略详情 :::tip 被授予此权限后，可获取权限范围内全部AgentKit资源的查看权限。 ::: ```JSON { "Statement": [ { "Effect": "Allow", "Action": [ "agentkit:Get*", "agentkit:List*", "apig:ConvertMcpConfig", "ark:GetEndpoint", "ark:GetRawApiKey", "ark:InnerDescribeModelEndpoints", "ark:ListApiKeys", "ark:ListEndpoints", "ark:ListFoundationModels", "ark:ListFoundationModelVersions", "ark:ListModelChargeItems", "cp:GetDefaultWorkspaceInner", "cp:GetInstance", "cp:GetTaskRunLog", "cp:GetTaskRunLogDownloadURI", "cp:ListPipelineRuns", "cp:ListPipelineRunStagesInner", "cp:ListPipelines", "cp:ListWorkspaces", "cr:GetAuthorizationToken", "cr:GetPublicEndpoint", "cr:GetVpcEndpoint", "cr:ListDomains", "cr:ListNamespaces", "cr:ListRegistries", "cr:ListRepositories", "cr:ListTags", "escloud:ListScene", "iam:CheckServiceLinkedRole", "iam:GetPolicy", "iam:GetRole", "iam:GetServiceLinkedRoleTemplate", "iam:GetUser", "iam:ListProjects", "iam:ListRoles", "iam:ListUsers", "id:GetCallerIdentity", "id:GetResourceApiKey", "id:GetTenantServiceStatus", "id:GetUserPool", "id:GetUserPoolClient", "id:ListCredentialProviders", "id:ListUserPoolClients", "id:ListUserPools", "location:DescribeRegions", "mem0:DescribeMemoryProjects", "mem0:SearchMemory", "ml_platform:GetKnowledgeBaseServiceInfo", "ml_platform:ListCollections", "tls:GetAccountStatus", "tls:GetProject", "tls:GetTopic", "tls:ListProjects", "tls:ListTopics", "tos:GetAccountStatus", "tos:GetBucketInfo", "tos:HeadBucket", "tos:HeadObject", "tos:ListBuckets", "tos:ListObjectsV2", "vefaas:GetAvailabilityZones", "vefaas:ListFunctions", "vikingdb:GetMemorydbInstanceDetail", "vikingdb:MemoryCollectionInfo", "vikingdb:MemoryCollectionList", "vikingdb:MemorySearch", "vikingdb:MemorySearchUser", "vpc:DescribeSecurityGroups", "vpc:DescribeSubnets", "vpc:DescribeVpcAttributes", "vpc:DescribeVpcs" ], "Resource": [ "*" ] } ] } ``` ## 相关文档 [常见系统预设策略](https://www.volcengine.com/docs/6257/1253730)：文档中介绍了部分常用的系统预设策略，以帮助您更快速的了解、使用系统策略进行权限管控。