AI 数据湖服务
AI 数据湖服务
帮助文档
请输入
- 文档首页
AI 数据湖服务运维与监控LAS 系统预置权限策略说明
复制全文
下载 pdfLAS 系统预置权限策略说明
文档反馈
问问助手LAS 系统预置权限策略说明
LAS 提供 LASAIFullAccess 和 LASAIReadOnlyAccess 两个系统预置权限策略。主账号可以在火山引擎访问控制（IAM）中，将策略授予 IAM 用户、用户组或角色，使其获得相应的 LAS 及关联云服务访问权限。
系统预置策略由火山引擎统一创建和维护，您无法修改策略内容。本文展示的策略内容用于帮助您了解权限范围，实际权限请以 IAM 控制台展示的最新策略内容为准。
注意
LAS 系统预置权限策略属于 IAM 权限，用于控制用户能否访问 LAS 服务及相关云服务。Catalog、Schema、Table、UDF 等元数据对象的访问权限由 LAS 内部权限体系管理。获得系统预置权限策略后，用户仍需具备相应的元数据对象权限，才能访问具体数据。
LASAIFullAccess
LASAIFullAccess 提供以下权限：
- LAS 全部操作权限。
- EMR Serverless 和 EMR OLAP 全部操作权限。
- 查询 TOS Bucket 和对象、镜像仓库、VPC、子网、安全组、EIP 及负载均衡实例的权限。
- 查询云监控指标和告警组的权限。
- 检查服务关联角色和查询 IAM 角色的权限。
策略内容如下：
{
"Statement": [
{
"Effect": "Allow",
"Action": [
"las:*"
],
"Resource": [
"*"
]
},
{
"Effect": "Allow",
"Action": [
"tos:listBuckets",
"tos:listObjectsType2",
"cr:ListRegistries",
"cr:ListRepositories",
"cr:ListTags",
"cr:ListDomains",
"vpc:DescribeVpcs",
"vpc:DescribeSubnets",
"vpc:DescribeSecurityGroups",
"clb:DescribeLoadBalancers"
]
},
{
"Effect": "Allow",
"Action": [
"emr_serverless:*"
],
"Resource": [
"*"
]
},
{
"Effect": "Allow",
"Action": [
"emr_olap:*"
],
"Resource": [
"*"
]
},
{
"Effect": "Allow",
"Action": [
"Volc_Observe:ListAlertGroup",
"Volc_Observe:GetMetricData"
],
"Resource": [
"*"
]
},
{
"Effect": "Allow",
"Action": [
"cloudmonitor:ListAlertGroup",
"cloudmonitor:GetMetricData"
],
"Resource": [
"*"
]
},
{
"Effect": "Allow",
"Action": [
"iam:CheckServiceLinkedRole",
"iam:ListRoles"
],
"Resource": [
"*"
]
},
{
"Effect": "Allow",
"Action": [
"vpc:DescribeVpcAttributes",
"vpc:DescribeSubnetAttributes",
"vpc:DescribeSecurityGroupAttributes",
"vpc:DescribeEipAddresses"
],
"Resource": [
"*"
]
},
{
"Effect": "Allow",
"Action": [
"cr:ListNamespaces"
],
"Resource": [
"*"
]
}
]
}
LASAIReadOnlyAccess
LASAIReadOnlyAccess 提供以下权限：
- 查询和查看 LAS 资源、配置及状态的权限。
- 查询和监控 EMR Serverless 资源，以及查询 EMR OLAP 资源的权限。
- 查询 TOS Bucket 和对象、镜像仓库、VPC、子网、安全组及负载均衡实例的权限。
- 查询云监控指标和告警组的权限。
- 检查服务关联角色和查询 IAM 角色的权限。
策略内容如下：
{
"Statement": [
{
"Effect": "Allow",
"Action": [
"las:Query*",
"las:Get*",
"las:Show*",
"las:Fetch*",
"las:List*",
"las:Check*",
"las:ConsolePermission",
"las:UpdateUserAgentStatus"
],
"Resource": [
"*"
]
},
{
"Effect": "Allow",
"Action": [
"tos:listBuckets",
"tos:listObjectsType2",
"clb:DescribeLoadBalancers"
]
},
{
"Effect": "Allow",
"Action": [
"emr_serverless:CheckJobStatus",
"emr_serverless:MonitorScanData",
"emr_serverless:MonitorStorage",
"emr_serverless:ConsolePermission",
"emr_serverless:Query*",
"emr_serverless:Get*",
"emr_serverless:Fetch*",
"emr_serverless:List*",
"emr_serverless:MonitorServiceLayout",
"emr_serverless:MonitorServiceDetail",
"emr_serverless:GrantQueuePrivilege"
],
"Resource": [
"*"
]
},
{
"Effect": "Allow",
"Action": [
"emr_olap:Get*",
"emr_olap:List*",
"emr_olap:Describe*",
"emr_olap:Calculate*",
"emr_olap:Check*"
],
"Resource": [
"*"
]
},
{
"Effect": "Allow",
"Action": [
"Volc_Observe:ListAlertGroup",
"Volc_Observe:GetMetricData"
],
"Resource": [
"*"
]
},
{
"Effect": "Allow",
"Action": [
"cloudmonitor:ListAlertGroup",
"cloudmonitor:GetMetricData"
],
"Resource": [
"*"
]
},
{
"Effect": "Allow",
"Action": [
"iam:CheckServiceLinkedRole",
"iam:ListRoles"
],
"Resource": [
"*"
]
},
{
"Effect": "Allow",
"Action": [
"vpc:DescribeVpcAttributes",
"vpc:DescribeSubnetAttributes",
"vpc:DescribeSecurityGroupAttributes",
"vpc:DescribeVpcs",
"vpc:DescribeSubnets",
"vpc:DescribeSecurityGroups"
],
"Resource": [
"*"
]
},
{
"Effect": "Allow",
"Action": [
"cr:ListRegistries",
"cr:ListNamespaces",
"cr:ListRepositories",
"cr:ListTags",
"cr:ListDomains"
],
"Resource": [
"*"
]
}
]
}
最近更新时间：2026.09.21 14:23:35
这个页面对您有帮助吗？
有用
有用
无用
无用