You need to enable JavaScript to run this app.
文档中心
AI 数据湖服务

AI 数据湖服务

复制全文
下载 pdf
运维与监控
LAS 系统预置权限策略说明
复制全文
下载 pdf
LAS 系统预置权限策略说明
LAS 系统预置权限策略说明​
LAS 提供 LASAIFullAccess 和 LASAIReadOnlyAccess 两个系统预置权限策略。主账号可以在火山引擎访问控制(IAM)中,将策略授予 IAM 用户、用户组或角色,使其获得相应的 LAS 及关联云服务访问权限。​
系统预置策略由火山引擎统一创建和维护,您无法修改策略内容。本文展示的策略内容用于帮助您了解权限范围,实际权限请以 IAM 控制台展示的最新策略内容为准。​
​
策略名称​
权限范围​
适用场景​
LASAIFullAccess​
具备 LAS 全部操作权限,并具备使用 LAS 相关功能所需的部分关联云服务权限。​
适用于需要开通和管理 LAS 服务、管理 LAS 资源及执行数据处理等操作的管理员。​
LASAIReadOnlyAccess​
具备 LAS 查询、查看、列表等只读类权限,并具备查看关联云服务资源所需的权限。部分功能包含维持服务正常使用所需的辅助操作权限,具体以策略中的 Action 为准。​
适用于主要查看 LAS 资源、配置、作业状态和监控信息的用户。​
​
注意​
LAS 系统预置权限策略属于 IAM 权限,用于控制用户能否访问 LAS 服务及相关云服务。Catalog、Schema、Table、UDF 等元数据对象的访问权限由 LAS 内部权限体系管理。获得系统预置权限策略后,用户仍需具备相应的元数据对象权限,才能访问具体数据。​
LASAIFullAccess​
LASAIFullAccess 提供以下权限:​
  • LAS 全部操作权限。​
  • EMR Serverless 和 EMR OLAP 全部操作权限。​
  • 查询 TOS Bucket 和对象、镜像仓库、VPC、子网、安全组、EIP 及负载均衡实例的权限。​
  • 查询云监控指标和告警组的权限。​
  • 检查服务关联角色和查询 IAM 角色的权限。​
策略内容如下:​
​
{​
"Statement": [​
{​
"Effect": "Allow",​
"Action": [​
"las:*"​
],​
"Resource": [​
"*"​
]​
},​
{​
"Effect": "Allow",​
"Action": [​
"tos:listBuckets",​
"tos:listObjectsType2",​
"cr:ListRegistries",​
"cr:ListRepositories",​
"cr:ListTags",​
"cr:ListDomains",​
"vpc:DescribeVpcs",​
"vpc:DescribeSubnets",​
"vpc:DescribeSecurityGroups",​
"clb:DescribeLoadBalancers"​
]​
},​
{​
"Effect": "Allow",​
"Action": [​
"emr_serverless:*"​
],​
"Resource": [​
"*"​
]​
},​
{​
"Effect": "Allow",​
"Action": [​
"emr_olap:*"​
],​
"Resource": [​
"*"​
]​
},​
{​
"Effect": "Allow",​
"Action": [​
"Volc_Observe:ListAlertGroup",​
"Volc_Observe:GetMetricData"​
],​
"Resource": [​
"*"​
]​
},​
{​
"Effect": "Allow",​
"Action": [​
"cloudmonitor:ListAlertGroup",​
"cloudmonitor:GetMetricData"​
],​
"Resource": [​
"*"​
]​
},​
{​
"Effect": "Allow",​
"Action": [​
"iam:CheckServiceLinkedRole",​
"iam:ListRoles"​
],​
"Resource": [​
"*"​
]​
},​
{​
"Effect": "Allow",​
"Action": [​
"vpc:DescribeVpcAttributes",​
"vpc:DescribeSubnetAttributes",​
"vpc:DescribeSecurityGroupAttributes",​
"vpc:DescribeEipAddresses"​
],​
"Resource": [​
"*"​
]​
},​
{​
"Effect": "Allow",​
"Action": [​
"cr:ListNamespaces"​
],​
"Resource": [​
"*"​
]​
}​
]​
}​
​
LASAIReadOnlyAccess​
LASAIReadOnlyAccess 提供以下权限:​
  • 查询和查看 LAS 资源、配置及状态的权限。​
  • 查询和监控 EMR Serverless 资源,以及查询 EMR OLAP 资源的权限。​
  • 查询 TOS Bucket 和对象、镜像仓库、VPC、子网、安全组及负载均衡实例的权限。​
  • 查询云监控指标和告警组的权限。​
  • 检查服务关联角色和查询 IAM 角色的权限。​
策略内容如下:​
​
{​
"Statement": [​
{​
"Effect": "Allow",​
"Action": [​
"las:Query*",​
"las:Get*",​
"las:Show*",​
"las:Fetch*",​
"las:List*",​
"las:Check*",​
"las:ConsolePermission",​
"las:UpdateUserAgentStatus"​
],​
"Resource": [​
"*"​
]​
},​
{​
"Effect": "Allow",​
"Action": [​
"tos:listBuckets",​
"tos:listObjectsType2",​
"clb:DescribeLoadBalancers"​
]​
},​
{​
"Effect": "Allow",​
"Action": [​
"emr_serverless:CheckJobStatus",​
"emr_serverless:MonitorScanData",​
"emr_serverless:MonitorStorage",​
"emr_serverless:ConsolePermission",​
"emr_serverless:Query*",​
"emr_serverless:Get*",​
"emr_serverless:Fetch*",​
"emr_serverless:List*",​
"emr_serverless:MonitorServiceLayout",​
"emr_serverless:MonitorServiceDetail",​
"emr_serverless:GrantQueuePrivilege"​
],​
"Resource": [​
"*"​
]​
},​
{​
"Effect": "Allow",​
"Action": [​
"emr_olap:Get*",​
"emr_olap:List*",​
"emr_olap:Describe*",​
"emr_olap:Calculate*",​
"emr_olap:Check*"​
],​
"Resource": [​
"*"​
]​
},​
{​
"Effect": "Allow",​
"Action": [​
"Volc_Observe:ListAlertGroup",​
"Volc_Observe:GetMetricData"​
],​
"Resource": [​
"*"​
]​
},​
{​
"Effect": "Allow",​
"Action": [​
"cloudmonitor:ListAlertGroup",​
"cloudmonitor:GetMetricData"​
],​
"Resource": [​
"*"​
]​
},​
{​
"Effect": "Allow",​
"Action": [​
"iam:CheckServiceLinkedRole",​
"iam:ListRoles"​
],​
"Resource": [​
"*"​
]​
},​
{​
"Effect": "Allow",​
"Action": [​
"vpc:DescribeVpcAttributes",​
"vpc:DescribeSubnetAttributes",​
"vpc:DescribeSecurityGroupAttributes",​
"vpc:DescribeVpcs",​
"vpc:DescribeSubnets",​
"vpc:DescribeSecurityGroups"​
],​
"Resource": [​
"*"​
]​
},​
{​
"Effect": "Allow",​
"Action": [​
"cr:ListRegistries",​
"cr:ListNamespaces",​
"cr:ListRepositories",​
"cr:ListTags",​
"cr:ListDomains"​
],​
"Resource": [​
"*"​
]​
}​
]​
}​
​
​
最近更新时间:2026.09.21 14:23:35
这个页面对您有帮助吗?
有用
有用
无用
无用