tencent cloud

Service roles and service-linked roles are predefined by Tencent Cloud services and, upon user authorization, the corresponding services can access and use resources by assuming these service-linked roles. This document provides detailed information on the use cases and associated authorization policies of these specific service-linked roles.

CFG_QCSLinkedRoleInDRP

Use Cases： The current role is the DRP service linked role, which will access your other service resources within the scope of the permissions of the associated policy.
Authorization Polices

• Policy Name： QcloudAccessForCFGLinkedRoleInDRP
• Policy Information：

  {
    "version": "2.0",
    "statement": [
        {
            "effect": "allow",
            "action": [
                "dnspod:ModifyRecord",
                "dnspod:DescribeRecordList",
                "clb:DescribeListeners",
                "clb:SetLoadBalancerSecurityGroups",
                "clb:ModifyTargetWeight",
                "clb:RegisterTargets",
                "clb:CreateListener",
                "clb:CreateLoadBalancer",
                "clb:CloneLoadBalancer",
                "clb:DescribeTaskStatus"
            ],
            "resource": "*"
        }
    ]
  }

CFG_QCSLinkedRoleInChaos

Use Cases： The current role is the Chaotic Fault Generator service role, which will access your other service resources within the scope of the permissions of the associated policy.
Authorization Polices

• Policy Name： QcloudAccessForCFGLinkedRoleInChaos
• Policy Information：

  {
    "statement": [
        {
            "action": [
                "clb:DescribeTargets",
                "clb:BatchModifyTargetWeight",
                "clb:DescribeLoadBalancers",
                "clb:SetLoadBalancerSecurityGroups",
                "tat:DescribeAutomationAgentStatus",
                "tat:DescribeCommands",
                "tat:InvokeCommand",
                "tat:DescribeInvocations",
                "tat:RunCommand",
                "tat:DescribeInvocationTasks",
                "redis:DescribeInstances",
                "redis:KillMasterGroup",
                "cdb:DescribeDBInstances",
                "cdb:SwitchDBInstanceMasterSlave",
                "cdb:DescribeTasks",
                "cdb:ModifyInstanceParam",
                "cdb:DescribeInstanceParams",
                "cdb:DescribeInstanceParamRecords",
                "cvm:DescribeInstances",
                "cvm:RebootInstances",
                "cvm:StopInstances",
                "cvm:StartInstances",
                "monitor:CreateAlarmNotice",
                "monitor:DescribeAlarmHistories",
                "monitor:DescribeAlarmPolicies",
                "monitor:DescribeBaseMetrics",
                "monitor:GetMonitorData",
                "vpc:ResetNatGatewayConnection",
                "vpc:DescribeNatGateways",
                "vpc:ModifyNatGatewayAttribute",
                "cvm:CreateSecurityGroup",
                "cvm:DeleteSecurityGroup",
                "redis:DescribeInstanceZoneInfo",
                "redis:ChangeReplicaToMaster",
                "redis:DescribeTaskInfo",
                "redis:DisassociateSecurityGroups",
                "redis:AssociateSecurityGroups",
                "redis:ModifyDBInstanceSecurityGroups",
                "redis:DescribeDBSecurityGroups",
                "cvm:DescribeSecurityGroupAssociateInstances",
                "cdb:DisassociateSecurityGroups",
                "cdb:AssociateSecurityGroups",
                "cdb:ModifyDBInstanceSecurityGroups",
                "cdb:DescribeDBSecurityGroups",
                "cvm:AssociateSecurityGroups",
                "cvm:DisassociateSecurityGroups",
                "tke:DescribeClusterSecurity",
                "dbbrain:CreateKillTask",
                "dbbrain:CreateProxySessionKillTask",
                "tke:DescribeClusters",
                "clb:ModifyLoadBalancerAttributes",
                "redis:DescribeInstances",
                "redis:DescribeInstanceNodeInfo",
                "redis:DescribeInstanceParams",
                "redis:KillMasterGroup",
                "redis:SwitchProxy",
                "cdb:DescribeDBInstanceConfig",
                "mongodb:DescribeDBInstances",
                "mongodb:RestartNodes",
                "mongodb:DescribeDBInstanceNodeProperty",
                "mongodb:SwitchDBInstancePrimary",
                "mongodb:DescribeAsyncRequestInfo",
                "dc:ModifyDirectConnectTunnelUpOrDown",
                "dc:DescribeDirectConnectTunnels",
                "cvm:DescribeSecurityGroupLimits",
                "cvm:DescribeSecurityGroups",
                "cdb:InjectFatalErrorIntoInstance",
                "cdb:DescribeAsyncRequestInfo",
                "vpc:DescribeSubnets",
                "vpc:CreateNetworkAcl",
                "vpc:AssociateNetworkAclSubnets",
                "vpc:DisassociateNetworkAclSubnets",
                "vpc:DeleteNetworkAcl",
                "vpc:DescribeNetworkAcls",
                "dcdb:DescribeDCDBInstanceDetail",
                "dcdb:SwitchDBInstanceHA",
                "dcdb:DescribeFlow",
                "dcdb:DescribeDCDBInstances",
                "cynosdb:DescribeClusterDetail",
                "cynosdb:DescribeFlow",
                "cynosdb:SwitchClusterZone",
                "cynosdb:DescribeClusters",
                "cynosdb:DescribeInstanceDetail",
                "ckafka:InjectDownAttack",
                "ckafka:DescribeAttackAsyncRequestResult",
                "ckafka:DownAttackRollback",
                "ckafka:DescribeRollbackAsyncRequestResult",
                "pts:AbortJob",
                "pts:StartJob",
                "pts:DescribeJobs",
                "ckafka:DescribeAsyncResult",
                "ckafka:DescribeInstancesDetail",
                "ckafka:DelayMessage",
                "ckafka:DelayMessageRollback",
                "ckafka:BurnCPU",
                "ckafka:BurnDiskIO",
                "mariadb:Describe*",
                "mariadb:SwitchDBInstanceHA",
                "ckafka:DescribeInstances",
                "tag:DescribeResourcesByTagsUnion",
                "clb:DescribeTaskStatus",
                "postgres:DescribeDBInstances",
                "postgres:DescribeDBInstanceAttribute",
                "postgres:DescribeDBInstanceHAConfig",
                "postgres:SwitchDBInstancePrimary",
                "tse:DescribeCloudNativeAPIGatewayServices",
                "tse:DescribeCloudNativeAPIGatewayNodes",
                "tse:DescribeCloudNativeAPIGateways",
                "tse:DescribeCloudNativeAPIGateway",
                "tse:DescribeNativeGatewayServerGroups",
                "tse:RestartNativeGatewayInstanceNode",
                "tse:DescribeCloudNativeAPIGatewayLatestTaskPhases",
                "sqlserver:DescribeDBInstancesAttribute",
                "sqlserver:DescribeDBInstances",
                "sqlserver:DescribeFlowStatus",
                "sqlserver:SwitchCloudInstanceHA",
                "sqlserver:DescribeHASwitchLog",
                "sqlserver:DescribeReadOnlyGroupList",
                "sqlserver:DescribeReadOnlyGroupDetails",
                "advisor:CreatePushHunDunArchitecture",
                "advisor:DeletePushHunDunArchitecture",
                "advisor:DescribeArchitectureBindNode",
                "advisor:DescribeArchitectureNodeInstances",
                "advisor:DescribeArchitectureTaskSummary",
                "advisor:DescribeTaskStrategyRisks",
                "advisor:DescribeRoleStatus",
                "advisor:CreateScanMapTask",
                "advisor:DescribeArchitectureDiagram",
                "advisor:DownloadReportFileAsync",
                "advisor:DescribeDownloadTask",
                "advisor:DescribeConfig",
                "advisor:DescribeGroupAndProductInfos",
                "cdb:RestartDBInstances",
                "cdb:DescribeDBInstanceRebootTime",
                "redis:ModifyInstanceParams",
                "advisor:CreateArchScanTask",
                "advisor:DescribeArchitectureNodeRiskInfoV3",
                "advisor:DescribeNodeStrategyRiskInfo",
                "advisor:DescribeArchTaskStrategyRisks",
                "advisor:CreateArchScanReportFile",
                "advisor:DescribeArchAsync",
                "advisor:DescribeArchTaskResult",
                "advisor:DescribeNodeResources",
                "advisor:DescribeArchList",
                "advisor:DescribeArchScanIsFinish",
                "advisor:DescribeArchSvg",
                "advisor:DescribeArchSync",
                "clb:SetLoadBalancerStartStatus",
                "es:CheckOperation",
                "es:UpdateNodesStatus",
                "es:DescribeInstances",
                "es:GetTaskFlow",
                "es:DescribeViews",
                "live:DescribeLiveDomains",
                "live:DescribeLiveStreamOnlineList",
                "live:DropLiveStream",
                "live:ForbidLiveStream",
                "live:ResumeLiveStream",
                "live:DescribeLiveForbidStreamList",
                "live:SwitchBackupStream",
                "live:DropLiveBackupStream",
                "live:DescribeBackupStreamList",
                "tdmq:CreateRabbitMQChaosTask",
                "tdmq:RestoreRabbitMQCluster",
                "tdmq:DescribeRabbitMQ*",
                "cdb:DescribeClusterInfo",
                "vpc:CreateNetworkAclEntries",
                "tke:DescribeEKSClusterCredential",
                "advisor:DescribeArchScanReportArchiveInfo",
                "advisor:UpdateArchScanReportArchiveInfo",
                "cdb:DescribeRoGroups",
                "cdb:ModifyRoGroupInfo",
                "tke:RebootMachines",
                "tke:StopMachines",
                "tke:RebootMachines",
                "tke:DescribeClusterInstances",
                "postgres:DescribeDBInstanceAttribute",
                "postgres:ModifyDBInstanceSecurityGroups",
                "postgres:DescribeDBInstanceSecurityGroups",
                "postgres:DescribeDBInstances",
                "postgres:RestartDBInstance",
                "postgres:ModifyDBInstanceParameters",
                "postgres:DescribeDBInstanceParameters",
                "postgres:DescribeReadOnlyGroups",
                "tke:StartMachines",
                "ckafka:SwitchAvailableZone",
                "ckafka:DescribeSwitchOperateStatus",
                "ckafka:RestartDisasterZone",
                "trocket:DeleteBrokerNode",
                "trocket:ModifyBrokerNode",
                "trocket:DescribeBrokerStatus",
                "trocket:DescribeFusionInstanceList",
                "tdmq:DescribePulsarProInstanceDetail",
                "tdmq:QueryIsolatePulsarTask",
                "tdmq:IsolatePulsarClusterZone",
                "tdmq:DescribePulsarProInstances",
                "tag:GetTags",
                "tag:TagResources",
                "tag:UnTagResources",
                "tag:AttachResourcesTag",
                "tag:ModifyResourceTags",
                "tag:ModifyResourcesTagValue",
                "tke:StopEKSPod",
                "tke:StartEKSPod",
                "tke:DescribeEKSTask",
                "apm:DescribeServiceOverview",
                "pts:DescribeProjects",
                "pts:DescribeScenarios",
                "monitor:DescribeAlarmHistories",
                "monitor:GetMonitorData",
                "monitor:DescribeStatisticData",
                "region:DescribeRegions",
                "region:DescribeProducts",
                "region:DescribeZones",
                "apm:DescribeTagValues",
                "apm:DescribeInstanceBriefs",
                "apm:DescribeServiceNodes",
                "redis:DescribeInstanceZoneInfo",
                "redis:DescribeInstanceShards"
            ],
            "effect": "allow",
            "resource": [
                "*"
            ]
        }
    ],
    "version": "2.0"
  }