文档中心

容器服务

授权

IAM 授权最佳实践

容器服务的用户授权包括 IAM （Identity and Access Management，基于身份的权限控制）授权和 RBAC （Role-Based Access Control ，基于角色的权限控制）授权。本文介绍针对 IAM 用户的授权最佳实践。

注意

IAM 用户自定义策略不会随产品 API 变更自动更新。当产品新增、修改或下线 API/Action 时，需要您自行评估并更新自定义策略，否则可能出现：

功能不可用（新增 Action 未加入策略，导致鉴权失败）

权限冗余（废弃的 Action 未及时移除，遗留不必要权限）

前提条件

已创建 IAM 用户。详细操作，请参见用户管理。

场景一：为 IAM 用户授权指定的集群

场景介绍

为某个 IAM 用户（User）授予指定集群的访问和操作权限，即该 User 只能在指定的 VKE 集群里进行相关资源的增、删、查、改操作。

操作步骤

使用火山引擎账号（Account）或具有相关权限的 IAM 用户登录 IAM 控制台。

左侧导航栏选择权限策略，搜索 VKEReadOnlyAccess。

单击 VKEReadOnlyAccess，进入策略详情页面，选择语法页签，复制 VKEReadOnlyAccess 策略语法到本地。

按如下说明修改复制到本地的 VKEReadOnlyAccess 策略语法，并保存为新的自定义策略，例如 Access-Cluster-A。

将 VKE 相关 Action 中的内容替换为vke:*，Resource 中的内容替换为需要约束。

{
"Effect": "Allow",
"Action": [
"vke:*"
],
"Resource": [
"trn:vke:{Region_ID}:{Account_ID}:cluster/{Cluster_ID}",
"trn:iam:{Account_ID}:project/*",
"trn:vpc:{Region_ID}:{Account_ID}:securitygroup/*",
"trn:vpc:{Region_ID}:{Account_ID}:subnet/*"
]
}

其中变量说明如下：

{Region_ID}：替换为目标 VKE 集群所在地域的 ID，例如cn-shanghai。

{Account_ID}：替换为您火山引擎账号（主账号）ID，例如210001****。

{Cluster_ID}：替换为目标 VKE 集群的 ID，例如ccm0i61o93a9te2k8****。

完整示例如下：

{
"Effect": "Allow",
"Action": [
"vke:*"
],
"Resource": [
"trn:vke:cn-shanghai:210001****:cluster/ccm0i61o93a9te2k8****",
"trn:iam::210001****:project/*",
"trn:vpc:cn-shanghai:210001****:securitygroup/*",
"trn:vpc:cn-shanghai:210001****:subnet/*"
]
}

增加如下弹性块存储相关 Action 和 Resource。

{
"Effect": "Allow",
"Action": [
"storage_ebs:Describe*",
"storage_ebs:CalculatePrice"
],
"Resource": [
"*"
]
}

新建自定义策略 Access-Cluster-A。详细操作，请参见新建策略。

为 IAM 用户授权 Access-Cluster-A 策略。详细操作，请参见管理用户。

场景二：创建项目范围使用的自定义权限并授权

场景介绍

VKE 中部分操作（Action）和资源（Resource）是按照项目（Project）划分的，可满足项目粒度的权限控制需求。若需要将该类操作和资源授权给 IAM 用户，需要以项目权限的形式授予。

注意

VKE 中有一部分 Action 和 Resource 是无法按照项目划分，因此为 IAM 用户授予项目权限的同时，还需要将无法按照项目划分的 Action 和 Resource，以全局权限的形式授予给该 IAM 用户。否则该 IAM 用户可能无法正常操作和使用容器服务资源。

容器服务相关的 Action 和 Resource 说明，请参见用户自定义策略。

操作步骤

使用火山引擎账号（Account）或具有相关权限的 IAM 用户登录 IAM 控制台。

新建自定义策略，例如名称为 vke-project。策略的 JSON 内容示例如下所示，请按需自行增删具体的 Action 或 Resource 。VKE 依赖的云服务资源访问权限，请参见 VKE 服务关联角色说明。

{
"Statement": [
{
"Effect": "Allow",
"Action": [
"vke:CreateCluster",
"vke:ListClusters",
"vke:UpdateClusterConfig",
"vke:DeleteCluster",
"vke:CreateKubeconfig",
"vke:DeleteKubeconfigs",
"vke:CreateNodePool",
"vke:CreateDefaultNodePool",
"vke:UpdateNodePoolConfig",
"vke:DeleteNodePool",
"vke:CreateNodes",
"vke:DeleteNodes",
"vke:CreateAddon",
"vke:UpdateAddonConfig",
"vke:UpdateAddonVersion",
"vke:DeleteAddon",
"vke:ForwardKubernetesApi",
"vke:ForwardKubernetesReadApi",
"vke:ForwardKubernetesWriteApi",
"vke:CreateScalingPolicy",
"vke:UpdateScalingPolicy",
"vke:DeleteScalingPolicies",
"vke:ListKubeconfigs",
"vke:ListNodePools",
"vke:ListNodes",
"vke:ListAddons",
"vke:SetGlobalDefaultDeleteOption",
"vke:ListScalingPolicies",
"vke:ListScalingEvents",
"vke:UpdateClusterVersion",
"vke:UpdateImageCache",
"alb:DescribeLoadBalancers",
"clb:DescribeLoadBalancers",
"FileNAS:DescribeFileSystems",
"storage_ebs:DescribeVolumes",
"FileNAS:DescribeMountPoints",
"tls:DescribeTopics",
"tls:DescribeProject",
"tls:DescribeTopic",
"TLS:DescribeTopic",
"vpc:DescribeSubnets",
"vpc:DescribeSecurityGroups",
"vpc:DescribeVpcs",
"vpc:DescribeBandwidthPackages",
"vpc:DescribeSecurityGroupAttributes",
"clb:DescribeListeners",
"alb:DescribeListeners",
"natgateway:DescribeNatGateways",
"ecs:DescribeImages",
"ecs:DescribeKeyPairs",
"ecs:DescribeInstances",
"alb:DescribeCertificates",
"clb:DescribeCertificates",
"vepfs:DescribeFileSystems",
"vepfs:DescribeMountServices",
"auto_scaling:DescribeScalingGroups",
"auto_scaling:DescribeScalingActivities",
"certificate_service:CertificateGetInstance",
"artifacts:ListRepositories",
"artifacts:ListInstances",
"artifacts:GetPackageInfo",
"apig:ListGateways",
"cr:ListNamespaces"
],
"Resource": [
"*"
]
}
]
}

为已创建的 vke-project 策略添加授权。

选择目标 IAM 用户，添加 vke-project 策略的项目权限。详细操作，请参见管理用户。

为无法按照项目划分的 Action 和 Resource 新建自定义策略并授权给目标 IAM 用户。

例如名称为 vke-global。策略的 JSON 内容示例如下所示，请按需自行增删具体的 Action 或 Resource 。VKE 依赖的云服务资源访问权限，请参见 VKE 服务关联角色说明。

说明

如果您已为无法按照项目划分的 Action 和 Resource 创建了自定义策略，则直接将策略授权给 IAM 用户即可，无需重复创建。

{
"Statement": [
{
"Effect": "Allow",
"Action": [
"vke:AddClusterNode",
"vke:AddVciSubnets",
"vke:CheckClusterCidrConflict",
"vke:CheckNameConflict",
"vke:CreateAddonInner",
"vke:CreateConfigMap",
"vke:CreateCronHorizontalPodAutoscaler",
"vke:CreateCronJob",
"vke:CreateDaemonSet",
"vke:CreateDefaultNodePoolInner",
"vke:CreateDeployment",
"vke:CreateHorizontalPodAutoscaler",
"vke:CreateIHPA",
"vke:CreateIngress",
"vke:CreateJob",
"vke:CreateLogCollectRule",
"vke:CreateLogConfig",
"vke:CreateNamespace",
"vke:CreateNodePoolInner",
"vke:CreateNodesInner",
"vke:CreatePersistentVolume",
"vke:CreatePersistentVolumeClaim",
"vke:CreateRelease",
"vke:CreateResourceByYaml",
"vke:CreateResourcePackages",
"vke:CreateSecret",
"vke:CreateService",
"vke:CreateStatefulSet",
"vke:CreateStorageClass",
"vke:CreateUserRbac",
"vke:CreateVirtualNode",
"vke:DeleteCRD",
"vke:DeleteConfigMap",
"vke:DeleteCronHorizontalPodAutoscaler",
"vke:DeleteCronJob",
"vke:DeleteDaemonSet",
"vke:DeleteDeployment",
"vke:DeleteHorizontalPodAutoscaler",
"vke:DeleteIHPA",
"vke:DeleteImageCache",
"vke:DeleteIngress",
"vke:DeleteJob",
"vke:DeleteLogCollectRule",
"vke:DeleteLogConfig",
"vke:DeleteNamespace",
"vke:DeletePersistentVolume",
"vke:DeletePersistentVolumeClaim",
"vke:DeletePod",
"vke:DeleteRelease",
"vke:DeleteResource",
"vke:DeleteSecret",
"vke:DeleteService",
"vke:DeleteStatefulSet",
"vke:DeleteStorageClass",
"vke:DeleteUserRbac",
"vke:GetAPIGroup",
"vke:GetAccountQuotaUsages",
"vke:GetApplicationCronInspection",
"vke:GetApplicationInspection",
"vke:GetApplicationInspectionItem",
"vke:GetApplicationInspectionStatus",
"vke:GetChart",
"vke:GetCheckItem",
"vke:GetClusterDeployProgress",
"vke:GetClusterOverview",
"vke:GetClusterResources",
"vke:GetConfigMap",
"vke:GetContainerLogs",
"vke:GetCronJob",
"vke:GetCronScan",
"vke:GetDaemonSet",
"vke:GetDeployment",
"vke:GetEventTopic",
"vke:GetHorizontalPodAutoscaler",
"vke:GetIHPA",
"vke:GetIngress",
"vke:GetJob",
"vke:GetListeners",
"vke:GetLogCollectRule",
"vke:GetLogProjectID",
"vke:GetLogTopicID",
"vke:GetNamespace",
"vke:GetNamespaceResource",
"vke:GetNodePoolNodeStatistics",
"vke:GetPersistentVolume",
"vke:GetPersistentVolumeClaim",
"vke:GetPod",
"vke:GetRelease",
"vke:GetResource",
"vke:GetResourceYaml",
"vke:GetSecret",
"vke:GetSecretDomains",
"vke:GetService",
"vke:GetStatefulSet",
"vke:GetStorageClass",
"vke:GetTerminal",
"vke:InnerReconcileVCIQuotaUsage",
"vke:InnerSyncVCIQuota",
"vke:IsAffectedByVci",
"vke:ListAPIGroups",
"vke:ListAddonFeatureSchemas",
"vke:ListAddonNotRefactoredVersions",
"vke:ListAiSuiteStatus",
"vke:ListAllAddons",
"vke:ListAllSupportedAddons",
"vke:ListApplicationInspectionItems",
"vke:ListApplicationInspectionReports",
"vke:ListBatchSuiteStatus",
"vke:ListBenchmarks",
"vke:ListCRDs",
"vke:ListChartCategories",
"vke:ListCharts",
"vke:ListCheckItems",
"vke:ListClusterNode",
"vke:ListConfigMaps",
"vke:ListContainerInstances",
"vke:ListCronHorizontalPodAutoscalers",
"vke:ListCronJobs",
"vke:ListCustomRoles",
"vke:ListDaemonSets",
"vke:ListDeployments",
"vke:ListEvent",
"vke:ListHorizontalPodAutoscalers",
"vke:ListIHPAs",
"vke:ListImageCaches",
"vke:ListIngress",
"vke:ListInstanceTypes",
"vke:ListJobs",
"vke:ListJobsFromCronJob",
"vke:ListKubernetesObservability",
"vke:ListKubernetesObservabilityComponentConfigs",
"vke:ListLogCollectRules",
"vke:ListLogConfigs",
"vke:ListLogProjects",
"vke:ListLogTopics",
"vke:ListNamespace",
"vke:ListNodePoolNodes",
"vke:ListNodePoolScalingRecords",
"vke:ListNodeReports",
"vke:ListNodeZones",
"vke:ListNodesInner",
"vke:ListObjectEvents",
"vke:ListOperationEvents",
"vke:ListPersistentVolume",
"vke:ListPersistentVolumeClaim",
"vke:ListPods",
"vke:ListReleases",
"vke:ListReservedContainerInstanceGroups",
"vke:ListResourcePackageSpecs",
"vke:ListResources",
"vke:ListSecrets",
"vke:ListServices",
"vke:ListStatefulSets",
"vke:ListStorageClass",
"vke:ListTagsForResources",
"vke:ListTasks",
"vke:ListUpdateRecords",
"vke:ListUserRbacs",
"vke:ListVirtualNodes",
"vke:ListWorkloadHistories",
"vke:ListWorkloadHorizontalPodAutoscalers",
"vke:ListWorkloadPods",
"vke:ListWorkloadServices",
"vke:PatchCronJobSuspend",
"vke:PatchWorkloadImage",
"vke:PatchWorkloadParallelism",
"vke:PatchWorkloadReplicas",
"vke:RestartWorkload",
"vke:RollbackRelease",
"vke:RollbackWorkload",
"vke:SetApplicationCronInspection",
"vke:SetApplicationInspection",
"vke:StartApplicationInspection",
"vke:StartNodeScan",
"vke:StartScan",
"vke:TagResources",
"vke:UntagResources",
"vke:UpdateAiSuiteStatus",
"vke:UpdateConfigMap",
"vke:UpdateCronHorizontalPodAutoscaler",
"vke:UpdateCronJob",
"vke:UpdateCronScan",
"vke:UpdateDaemonSet",
"vke:UpdateDeployment",
"vke:UpdateHorizontalPodAutoscaler",
"vke:UpdateIHPA",
"vke:UpdateIngress",
"vke:UpdateJob",
"vke:UpdateLogCollectRule",
"vke:UpdateNamespace",
"vke:UpdateNamespaceResource",
"vke:UpdateNodePoolForCA",
"vke:UpdateNodesSystemConfigInner",
"vke:UpdateNodesVersion",
"vke:UpdateRelease",
"vke:UpdateResourceByYaml",
"vke:UpdateSecret",
"vke:UpdateService",
"vke:UpdateStatefulSet",
"vke:UpdateUserRbac",
"vmp:CreateAlertingRuleGroup",
"vmp:DeleteAlertingRuleGroup",
"vmp:ListAlertingRuleGroups",
"vmp:ListAlertingRuleTemplates",
"vmp:ListAlertingRules",
"vmp:ListDashboards",
"vmp:ListDatasources",
"vmp:ListNotifyGroupPolicies",
"vmp:ListNotifyPolicies",
"vmp:ListWorkspaceInstanceTypes",
"vmp:ListWorkspaces",
"vmp:UpdateAlertingRuleGroup",
"vpc:DescribeIpv6AddressBandwidths",
"vpc:InnerGetLimitFromKeys",
"vpc:ListTagsForResources",
"alb:DescribeRules",
"apig:CheckGatewayExist",
"cfs:ListFs",
"cfs:ListNs",
"clb:DescribeCertificates",
"clb:DescribeLoadBalancerAttributes",
"clb:ListTagsForResources",
"cr:GetVpcEndpoint",
"cr:ListRegistries",
"cr:ListRepositories",
"ecs:DescribeDeploymentSetSupportedInstanceTypeFamily",
"ecs:DescribeDeploymentSets",
"ecs:DescribeTags",
"iam:AttachRolePolicy",
"iam:CreateRole",
"iam:ListAttachedRolePolicies",
"iam:ListPolicies",
"iam:ListRoles",
"tls:DescribeProjects",
"tos:ListBuckets",
"vepfs:DescribeFileSystemStatistics",
"vepfs:DescribeMountServices"
],
"Resource": [
"*"
]
}
]
}

为已创建的 vke-global 策略添加授权。

选择目标 IAM 用户，添加 vke-global 策略的全局权限。详细操作，请参见管理用户。

最近更新时间：2026.09.18 14:42:19

这个页面对您有帮助吗？

有用

无用