tencent cloud

{
	"statement": [{
			"action": [ //Required read-only permission for related products
				"monitor:GetMonitorData",
                "monitor:DescribeBaseMetrics",
				"cam:ListGroups",
				"cam:GetGroup",
				"cam:DescribeSubAccountContacts",
				"cam:ListAttachedRolePolicies",
                "cam:GetRole",
                "vpc:DescribeSubnetEx",//Required for creating DataSight consoles accessed via the private network
                "vpc:DescribeVpcEx",//Required for creating DataSight consoles accessed via the private network
				"tag:TagResources",
				"tag:DescribeResourceTagsByResourceIds",
				"tag:GetTags",
				"tag:GetTagKeys",
				"tag:GetTagValues",
                "kms:GetServiceStatus"
			],
			"effect": "allow",
			"resource": "*"
		},
		{
			"action": [ //Specify that tags such as testCAM:test1 are required for creating dashboards, logsets, topics, alarm policies, notification channel groups, machine groups, and DataSight consoles. Tags are not supported for creating other types of resources.
                "cls:CreateDashboard",
                "cls:CreateLogset",
                "cls:CreateTopic",
                "cls:CreateAlarm",
                "cls:CreateAlarmNotice",
                "cls:CreateMachineGroup",
                "cls:CreateConsole"
			],
			"condition": {
				"for_any_value:string_equal": {
					"qcs:request_tag": [
						"testCAM&test1"
					]
				}
			},
			"effect": "allow",
			"resource": "*"
		},
		{
			"action": [ //Grant permission on all related APIs if tags are specified for resources. (APIs should support permission control by tag.)
				"cls:*"
			],
			"condition": {
				"for_any_value:string_equal": {
					"qcs:resource_tag": [
						"testCAM&test1"
					]
				}
			},
			"effect": "allow",
			"resource": "*"
		},
		{
			"action": [ //Some APIs do not support permission control by tag or resource scope limit. Most of the APIs below involve read operations, while some APIs of auxiliary features involve write operations. All these APIs do not affect the core data security of products.
				"cls:CheckAlarmChannel",
				"cls:CheckAlarmRule",
				"cls:CheckDomainRepeat",
				"cls:CheckFunction",
				"cls:CheckRechargeKafkaServer",
				"cls:DescribeClsPrePayDetails",
				"cls:DescribeClsPrePayInfos",
				"cls:DescribeConfigMachineGroups",
				"cls:DescribeConfigs",
				"cls:DescribeAgentConfigs",
				"cls:DescribeTopicExtendConfig",
				"cls:DescribeDataTransformFailLogInfo",
				"cls:DescribeDataTransformInfo",
				"cls:DescribeDataTransformPreviewDataInfo",
				"cls:DescribeDataTransformPreviewInfo",
				"cls:DescribeDataTransformProcessInfo",
				"cls:DescribeDemonstrations",
				"cls:DescribeExceptionResources",
				"cls:DescribeExternalDataSourcePreview",
				"cls:DescribeFunctions",
				"cls:DescribeResources",
				"cls:DescribeShipperPreview",
				"cls:DescribeScheduledSqlProcessInfo",
				"cls:DescribeConfigurationTemplates",
				"cls:DescribeFolders",
				"cls:GetClsService",
				"cls:GetConfigurationTemplateApplyLog",
				"cls:PreviewKafkaRecharge",
				"cls:agentHeartBeat",
				"cls:CreateDemonstrations",
				"cls:DeleteDemonstrations",
                "cls:DescribeNoticeContents",
                "cls:DescribeWebCallbacks"
			],
			"effect": "allow",
			"resource": "*"
		},
		{
			"action": [ //Some APIs do not support permission control by tag or resource scope limit. The APIs below involve write operations of core features. It is recommended to grant permissions only to certain users as required. APIs require no permission grants can be deleted.
				"cls:RealtimeProducer", //Upload data by using Kafka
				"cls:CreateConfigurationTemplate", //Configuration template API
				"cls:ModifyConfigurationTemplate",
				"cls:DeleteConfigurationTemplate",
				"cls:CreateFolder", //Folder API
				"cls:ModifyFolder",
				"cls:DeleteFolder",
				"cls:ModifyResourceAndFolderRelation",
				"cls:CreateDataTransform",//Data processing API
				"cls:ModifyDataTransform",
				"cls:DeleteDataTransform",
				"cls:RetryShipperTask",//COS shipping API
				"cls:ModifyDashboardSubscribeAck",//Dashboard subscription API
				"cls:DeleteDashboardSubscribe",
				"cls:ModifyConfigExtra",//Collection configuration API
				"cls:DeleteConfigExtra",
				"cls:RemoveMachine",//Machine group API
				"cls:UpgradeAgentNormal",
                "cls:CreateNoticeContent",//API related to alarm notification templates
                "cls:DeleteNoticeContent",
                "cls:ModifyNoticeContent",
                "cls:CreateWebCallback",//API related to alarm integration configuration
                "cls:ModifyWebCallback",
                "cls:DeleteWebCallback"
			],
			"effect": "allow",
			"resource": "*"
		}
	],
	"version": "2.0"
}

{
	"statement": [{
			"action": [ //Required read-only permission for related products
				"monitor:GetMonitorData",
                "monitor:DescribeBaseMetrics",
				"cam:ListGroups",
				"cam:GetGroup",
				"cam:DescribeSubAccountContacts",
				"cam:ListAttachedRolePolicies",
				"tag:DescribeResourceTagsByResourceIds",
				"tag:GetTags",
				"tag:GetTagKeys",
				"tag:GetTagValues"
			],
			"effect": "allow",
			"resource": "*"
		},
		{
			"action": [ //Grant read-only permission on related APIs if tags are specified for resources.
				"cls:DescribeConsumer",
				"cls:DescribeConsumerPreview",
				"cls:DescribeCosRecharges",
				"cls:DescribeDashboardSubscribes",
				"cls:DescribeDashboards",
				"cls:DescribeExports",
				"cls:DescribeIndex",
				"cls:DescribeIndexs",
				"cls:DescribeKafkaConsume",
				"cls:DescribeKafkaConsumer",
				"cls:DescribeKafkaRecharges",
				"cls:DescribeLatestJsonLog",
				"cls:DescribeLatestUserLog",
				"cls:DescribeLogContext",
				"cls:DescribeLogFastAnalysis",
				"cls:DescribeLogHistogram",
				"cls:DescribeMachineGroupConfigs",
				"cls:DescribeMachines",
				"cls:DescribePartitions",
				"cls:DescribeScheduledSqlInfo",
				"cls:DescribeScheduledSqlProcessInfo",
				"cls:DescribeShipperPreview",
				"cls:DescribeTopics",
				"cls:EstimateRebuildIndexTask",
				"cls:GetAlarm",
				"cls:GetAlarmLog",
				"cls:GetMetricLabelValues",
				"cls:GetMetricSeries",
				"cls:MetricsLabelValues",
				"cls:MetricsLabels",
				"cls:MetricsQuery",
				"cls:MetricsQueryExemplars",
				"cls:MetricsQueryRange",
				"cls:MetricsSeries",
				"cls:QueryMetric",
				"cls:QueryRangeMetric",
				"cls:SearchCosRechargeInfo",
				"cls:SearchDashboardSubscribe",
				"cls:SearchLog",
				"cls:DescribeAlarmNotices",
				"cls:DescribeAlarms",
				"cls:DescribeAlertRecordHistory",
				"cls:DescribeExternalDataSources",
				"cls:DescribeLogsets",
				"cls:DescribeMachineGroups",
                "cls:DescribeConsoles",
				"cls:DescribeShipperTasks",
				"cls:DescribeShippers",
				"cls:DescribeRebuildIndexTasks"
			],
			"condition": {
				"for_any_value:string_equal": {
					"qcs:resource_tag": [
						"testCAM&test1"
					]
				}
			},
			"effect": "allow",
			"resource": "*"
		},
		{
			"action": [ //Some APIs do not support permission control by tag or resource scope limit. Most of the APIs below involve read operations, while some APIs of auxiliary features involve write operations. All these APIs do not affect the core data security of products.
				"cls:CheckAlarmChannel",
				"cls:CheckAlarmRule",
				"cls:CheckDomainRepeat",
				"cls:CheckFunction",
				"cls:CheckRechargeKafkaServer",
				"cls:DescribeClsPrePayDetails",
				"cls:DescribeClsPrePayInfos",
				"cls:DescribeConfigMachineGroups",
				"cls:DescribeConfigs",
				"cls:DescribeAgentConfigs",
				"cls:DescribeTopicExtendConfig",
				"cls:DescribeDataTransformFailLogInfo",
				"cls:DescribeDataTransformInfo",
				"cls:DescribeDataTransformPreviewDataInfo",
				"cls:DescribeDataTransformPreviewInfo",
				"cls:DescribeDataTransformProcessInfo",
				"cls:DescribeDemonstrations",
				"cls:DescribeExceptionResources",
				"cls:DescribeExternalDataSourcePreview",
				"cls:DescribeFunctions",
				"cls:DescribeResources",
				"cls:DescribeShipperPreview",
				"cls:DescribeScheduledSqlProcessInfo",
				"cls:DescribeConfigurationTemplates",
				"cls:DescribeFolders",
				"cls:GetClsService",
				"cls:GetConfigurationTemplateApplyLog",
				"cls:PreviewKafkaRecharge",
				"cls:CreateDemonstrations",
				"cls:DeleteDemonstrations",
				"cls:CreateExport",
				"cls:DeleteExport"
                "cls:DescribeNoticeContents",
                "cls:DescribeWebCallbacks"
			],
			"effect": "allow",
			"resource": "*"
		}
	],
	"version": "2.0"
}

{
    "version": "2.0",
    "statement": [{
        "action": [
            "cls:pushLog",
            "cls:getConfig",
            "cls:agentHeartBeat"
        ],
        "resource": "*",
        "effect": "allow"
    }]
}

{
  "version": "2.0",
  "statement": [
    {
      "action": [
        "cls:pushLog",
        "cls:agentHeartBeat",
        "cls:getConfig",
        "cls:CreateConfig",
        "cls:DeleteConfig",
        "cls:ModifyConfig",
        "cls:DescribeConfigs",
        "cls:DescribeMachineGroupConfigs",
        "cls:DeleteConfigFromMachineGroup",
        "cls:ApplyConfigToMachineGroup",
        "cls:DescribeConfigMachineGroups",
        "cls:ModifyTopic",
        "cls:DeleteTopic",
        "cls:CreateTopic",
        "cls:DescribeTopics",
        "cls:CreateLogset",
        "cls:DeleteLogset",
        "cls:DescribeLogsets",
        "cls:CreateIndex",
        "cls:ModifyIndex",
        "cls:CreateMachineGroup",
        "cls:DeleteMachineGroup",
        "cls:DescribeMachineGroups",
        "cls:ModifyMachineGroup",
        "cls:CreateConfigExtra",
        "cls:DeleteConfigExtra",      
        "cls:ModifyConfigExtra"
      ],
      "resource": "*",
      "effect": "allow"
    }
  ]
}

{
    "version": "2.0",
    "statement": [{
        "action": [
            "cls:pushLog",
            "cls:UploadLog",
            "cls:MetricsRemoteWrite"
        ],
        "resource": "*",
        "effect": "allow"
    }]
}

{
    "version": "2.0",
    "statement": [{
        "action": [
            "cls:RealtimeProducer"
        ],
        "resource": "*",
        "effect": "allow"
    }]
}

{
    "version": "2.0",
    "statement": [{
        "action": [
            "cls:CreateMetricSubscribe",
            "cls:DescribeMetricCorrectDimension",
            "cls:DescribeMetricSubscribePreview",
            "monitor:DescribeBaseMetrics",
            "monitor:DescribeProductList"
        ],
        "resource": "*",
        "effect": "allow"
    }]
}

{
    "version": "2.0",
    "statement": [{
        "action": [
            "cls:CreateBinlogSubscribe",
            "cls:DescribeBinlogSubscribes",
            "cls:ModifyBinlogSubscribe",
            "cls:DescribeBinlogSubscribeConnectivity",
            "cls:DescribeBinlogSubscribePreview",
        ],
        "resource": "*",
        "effect": "allow"
    }]
}

{
    "version": "2.0",
    "statement": [{
        "action": [
            "cls:PreviewKafkaRecharge",
            "cls:CreateKafkaRecharge",
            "cls:ModifyKafkaRecharge",
        ],
        "resource": "*",
        "effect": "allow"
    }]
}

{
    "version": "2.0",
    "statement": [{
        "action": [
            "cls:pushLog",
        ],
        "resource": "*",
        "effect": "allow"
    }]
}

{
    "version": "2.0",
    "statement": [{
        "action": [
            "cls:pushLog",
        ],
        "resource": "*",
        "effect": "allow"
    }]
}

{
    "version": "2.0",
    "statement": [{
        "action": [
            "cls:DescribeLogsets",
            "cls:DescribeTopics",
            "cls:CreateConfig",
            "cls:CreateConfig",
            "cls:DeleteConfig",
            "cls:DescribeConfigs",
            "cls:ModifyConfig",
            "cls:CreateConfigExtra",
            "cls:DeleteConfigExtra",
            "cls:ModifyConfigExtra",
            "cls:CreateMachineGroup",
            "cls:DeleteMachineGroup",
            "cls:DescribeMachineGroups",
            "cls:DeleteConfigFromMachineGroup",
            "cls:ApplyConfigToMachineGroup",
            "cls:ModifyMachineGroup"
        ],
        "resource": "*",
        "effect": "allow"
    }
    ]
}

{
    "version": "2.0",
    "statement": [
        {
            "effect": "allow",
            "action": [
                "cls:CreateLogset",
                "cls:CreateTopic",
                "cls:CreateExport",
                "cls:CreateIndex",
                "cls:DeleteLogset",
                "cls:DeleteTopic",
                "cls:DeleteExport",
                "cls:DeleteIndex",
                "cls:ModifyLogset",
                "cls:ModifyTopic",
                "cls:ModifyIndex",
                "cls:MergePartition",
                "cls:SplitPartition",
                "cls:DescribeLogsets",
                "cls:DescribeTopics",
                "cls:DescribeExports",
                "cls:DescribeIndex",
                "cls:DescribeIndexs",
                "cls:DescribePartitions",
                "cls:SearchLog",
                "cls:DescribeLogHistogram",
                "cls:DescribeLogContext",
                "cls:DescribeLogFastAnalysis",
                "cls:DescribeLatestJsonLog",
                "cls:DescribeRebuildIndexTasks",
                "cls:CreateRebuildIndexTask",
                "cls:EstimateRebuildIndexTask",
                "cls:CancelRebuildIndexTask",
				"cls:MetricsLabelValues",
				"cls:MetricsLabels",
				"cls:MetricsQuery",
				"cls:MetricsQueryRange",
				"cls:MetricsSeries",
				"cls:MetricsQueryExemplars",
				"cls:GetMetricLabelValues",
				"cls:QueryMetric",
				"cls:QueryRangeMetric",
				"cls:GetMetricSeries"
            ],
            "resource": [
                "*"
            ]
        }
    ]
}