本文为您介绍AgentKit的IAM策略。

系统预设策略

AgentKit系统预设策略

IAM平台已提前为您设置了关于AgentKit的默认策略，具体如下表所示。

您可直接为IAM身份（IAM用户、用户组或角色）授权系统预设策略。系统预设策略只能用于授权，不可编辑和修改。

系统预设策略名称	描述
AgentKitFullAccess	被授权该策略后的IAM身份（IAM用户、用户组、角色），可获得权限范围（全局权限或项目权限）内AgentKit的管理权限，包括创建、修改、删除、查看资源等操作。
AgentKitReadOnlyAccess	被授权该策略后的IAM身份（IAM用户、用户组、角色），可获得权限范围（全局权限或项目权限）内AgentKit的只读权限。仅可查看AgentKit相关资源，不可对资源进行任何管理操作，也不可查看其他未授权的云产品。
AgentKitDeveloperAcess	被授权该策略后的IAM身份（IAM用户、用户组、角色），可获得权限范围（全局权限或项目权限）内AgentKit全功能的开发权限。该权限大于只读权限、小于完全管理权限：相比只读权限：支持资源的创建、配置、更新、调试与发布。相比完全管理权限：仅开放开发运行相关能力，不包含高危平台级管理操作。

AgentKit系统预设策略详情

AgentKitFullAccess 策略详情

{​
  "Statement": [​
    {​
      "Effect": "Allow",​
      "Action": [​
        "agentkit:*",​
        "apmplus_server:Get*",​
        "apmplus_server:List*",​
        "Volc_Observe:Get*",​
        "Volc_Observe:*Describe*",​
        "Volc_Observe:*List*",​
        "cloudmonitor:Get*",​
        "cloudmonitor:*Describe*",​
        "cloudmonitor:*List*",​
        "tls:Get*",​
        "tls:Describe*",​
        "tls:List*",​
        "apig:ConvertMcpConfig",​
        "apmplus_server:CreateOrder",​
        "ark:CreateApiKey",​
        "ark:GetEndpoint",​
        "ark:GetRawApiKey",​
        "ark:InnerDescribeModelEndpoints",​
        "ark:ListApiKeys",​
        "ark:ListEndpoints",​
        "ark:ListFoundationModelVersions",​
        "ark:ListModelChargeItems",​
        "ark:OpenModelChargeItem",​
        "ark:ListFoundationModels",​
        "content_customization:GetQuickOpenSearchInfo",​
        "cp:CreatePipeline",​
        "cp:CreateWorkspace",​
        "cp:DeletePipeline",​
        "cp:GetDefaultWorkspaceInner",​
        "cp:GetInstance",​
        "cp:GetTaskRunLog",​
        "cp:GetTaskRunLogDownloadURI",​
        "cp:ListPipelineRuns",​
        "cp:ListPipelineRunStagesInner",​
        "cp:ListPipelines",​
        "cp:ListWorkspaces",​
        "cp:RunPipeline",​
        "cr:AddVpcEndpointLinkedVpc",​
        "cr:CreateEndpointAclPolicies",​
        "cr:CreateNamespace",​
        "cr:CreateRegistry",​
        "cr:CreateRepository",​
        "cr:DeleteEndpointAclPolicies",​
        "cr:DeleteNamespace",​
        "cr:DeleteRegistry",​
        "cr:DeleteTags",​
        "cr:GetAuthorizationToken",​
        "cr:GetPublicEndpoint",​
        "cr:GetVpcEndpoint",​
        "cr:ListDomains",​
        "cr:ListNamespaces",​
        "cr:ListRegistries",​
        "cr:ListRepositories",​
        "cr:ListTags",​
        "cr:RemoveVpcEndpointLinkedVpc",​
        "cr:StartRegistry",​
        "cr:UpdateNamespace",​
        "cr:UpdatePublicEndpoint",​
        "cr:UpdateVpcEndpoint",​
        "ESCloud:GetMLApiKey",​
        "ESCloud:GetScene",​
        "ESCloud:GetSceneInstance",​
        "ESCloud:ListMLApiKeys",​
        "iam:AttachRolePolicy",​
        "iam:CheckServiceLinkedRole",​
        "iam:CreateRole",​
        "iam:CreateServiceLinkedRole",​
        "iam:DeleteRole",​
        "iam:DetachRolePolicy",​
        "iam:GetPolicy",​
        "iam:GetRole",​
        "iam:GetServiceLinkedRoleTemplate",​
        "iam:GetUser",​
        "iam:ListProjects",​
        "iam:ListRoles",​
        "iam:ListUsers",​
        "iam:UpdateRole",​
        "iam:ListAttachedRolePolicies",​
        "id:CreateApiKey",​
        "id:CreateApiKeyCredentialProvider",​
        "id:CreateInboundAuthConfig",​
        "id:DeleteApiKey",​
        "id:DeleteInboundAuthConfig",​
        "id:GetCallerIdentity",​
        "id:GetInboundAuthConfig",​
        "id:GetResourceApiKey",​
        "id:GetTenantServiceStatus",​
        "id:GetUserPool",​
        "id:GetUserPoolClient",​
        "id:ListCredentialProviders",​
        "id:ListNamespaces",​
        "id:ListServices",​
        "id:ListUserPoolClients",​
        "id:ListUserPools",​
        "id:UpdateInboundAuthConfig",​
        "location:DescribeRegions",​
        "mem0:CreateMemoryProject",​
        "mem0:DeleteMemoryProject",​
        "mem0:DescribeAPIKeyDetail",​
        "mem0:DescribeMemoryProjectDetail",​
        "mem0:DescribeMemoryProjects",​
        "mem0:ModifyMemoryProjectLongTermStrategy",​
        "mem0:SearchMemory",​
        "mem0:SearchMemoryAllInfo",​
        "ml_platform:GetKnowledgeBaseServiceInfo",​
        "ml_platform:ListCollections",​
        "sts:AssumeRole",​
        "tls:ActiveTlsAccount",​
        "tls:SearchLogs",​
        "tos:CopyObject",​
        "tos:CreateBucket",​
        "tos:DeleteBucket",​
        "tos:DeleteObject",​
        "tos:GetAccountStatus",​
        "tos:GetBucketInfo",​
        "tos:HeadBucket",​
        "tos:HeadObject",​
        "tos:ListBuckets",​
        "tos:ListObjectsV2",​
        "tos:PostObject",​
        "tos:PutObject",​
        "vefaas:CreateFunction",​
        "vefaas:CreateSandbox",​
        "vefaas:DeleteFunction",​
        "vefaas:DescribeSandbox",​
        "vefaas:EnableUserCrVpcTunnel",​
        "vefaas:GetAvailabilityZones",​
        "vefaas:GetFunction",​
        "vefaas:GetImageConfig",​
        "vefaas:GetImageSyncStatus",​
        "vefaas:GetReleaseStatus",​
        "vefaas:KillSandbox",​
        "vefaas:ListFunctions",​
        "vefaas:ListRuntimes",​
        "vefaas:ListSandboxes",​
        "vefaas:QueryUserCrVpcTunnel",​
        "vefaas:Release",​
        "vefaas:SetSandboxTimeout",​
        "vefaas:UpdateFunction",​
        "vikingdb:GetKnowledgeBaseServiceInfo",​
        "vikingdb:GetMemorydbInstanceDetail",​
        "vikingdb:ListCollections",​
        "vikingdb:MemoryCollectionInfo",​
        "vikingdb:MemoryCollectionList",​
        "vikingdb:MemorySearch",​
        "vikingdb:MemorySearchUser",​
        "vikingdb:GetCollectionInfo",​
        "vikingdb:CreateCollection",​
        "vikingdb:CreateKnowledgedbInstance",​
        "vikingdb:GetKnowledgedbInstanceStatus",​
        "vikingdb:AddDocument",​
        "vikingdb:UpdateCollection",​
        "vikingdb:DeleteCollection",​
        "vikingdb:CreateMemorydbInstance",​
        "vpc:DescribeSecurityGroups",​
        "vpc:DescribeSubnets",​
        "vpc:DescribeVpcAttributes",​
        "vpc:DescribeVpcs",​
        "vke:ListClusters",​
        "vke:ForwardKubernetesApi",​
        "vke:ListServices",​
        "ecs:DescribeInstances"​
      ],​
      "Resource": [​
        "*"​
      ]​
    }​
  ]​
}​

AgentKitReadOnlyAccess 策略详情

AgentKitDeveloperAcess策略详情