Service roles and service-linked roles are predefined by Tencent Cloud services and, upon user authorization, the corresponding services can access and use resources by assuming these service-linked roles. This document provides detailed information on the use cases and associated authorization policies of these specific service-linked roles.

CVM_QCSLinkedRoleInCbsInit

Use Cases： The current role is the CVM service linked role, which will access your other service resources within the scope of the permissions of the associated policy.
Authorization Polices

• Policy Name： QcloudAccessForCVMLinkedRoleInCbsinit
• Policy Information：

  {
    "version": "2.0",
    "statement": [
        {
            "effect": "allow",
            "resource": [
                "*"
            ],
            "action": [
                "tat:RunCommand",
                "tat:DescribeInvocations",
                "tat:DescribeInvocationTasks",
                "tat:DescribeAutomationAgentStatus"
            ]
        }
    ]
  }
  

CVM_QCSLinkedRoleInClawPro

Use Cases： The current role is the Cloud Server-ClawPro service role, which will access your other cloud service resources within the permissions defined by the associated policies.
Authorization Polices

• Policy Name： QcloudAccessForCVMLinkedRolelnClawPro
• Policy Information：

  {
    "version": "2.0",
    "statement": [
        {
            "effect": "allow",
            "action": [
                "cvm:*",
                "tat:*",
                "vpc:*",
                "ses:*",
                "sms:*",
                "cos:*",
                "cls:*",
                "csip:*",
                "cwp:*",
                "cam:PassRole",
                "orcaterm:*",
                "vdb:*",
                "smh:*"
            ],
            "resource": "*"
        },
        {
            "effect": "allow",
            "action": [
                "finance:trade"
            ],
            "resource": [
                "qcs::cvm:::*",
                "qcs::cls:::*",
                "qcs::vdb:::*"
            ]
        }
    ]
  }
  

CVM_QCSLinkedRoleInOpenClaw

Use Cases： The current role is the cloud server -OpenClaw service role. This role will access your other cloud service resources within the permission scope of the associated policy.
Authorization Polices

• Policy Name： QcloudAccessForCVMLinkedRoleInOpenClaw
• Policy Information：

  {
    "version": "2.0",
    "statement": [
        {
            "effect": "allow",
            "action": [
                "cvm:*",
                "tat:*",
                "vpc:*",
                "ses:*",
                "sms:*"
            ],
            "resource": "*"
        },
        {
            "effect": "allow",
            "action": [
                "finance:trade"
            ],
            "resource": [
                "qcs::cvm:::*"
            ]
        }
    ]
  }
  

CVM_QCSLinkedRoleInClawProAgent

Use Cases： The current role is the Cloud Server-ClawProAgent service role, which will access your other cloud service resources within the permissions defined by the associated policies.
Authorization Polices

• Policy Name： QcloudAccessForCVMLinkedRoleInClawProAgent
• Policy Information：

  {
    "statement": [
        {
            "action": [
                "cls:pushLog",
                "cls:getConfig",
                "cls:agentHeartBeat",
                "cls:MetricsRemoteWrite",
                "cls:OpenClawService"
            ],
            "effect": "allow",
            "resource": [
                "*"
            ]
        }
    ],
    "version": "2.0"
  }
  

CVM_QCSLinkedRoleInCVMRecommender

Use Cases： The current role is related to the CVM service.This role can access your CVM resouce usage and cost optimization recommendation with the permission granted by the associated policies
Authorization Polices

• Policy Name： QcloudAccessForCVMLinkedRoleInCVMRecommender
• Policy Information：

  {
    "version": "2.0",
    "statement": [
        {
            "effect": "allow",
            "action": [
                "cos:ListParts",
                "cos:PostObject",
                "cos:PutObject*",
                "cos:InitiateMultipartUpload",
                "cos:UploadPart",
                "cos:UploadPartCopy",
                "cos:CompleteMultipartUpload",
                "cos:AbortMultipartUpload",
                "cos:ListMultipartUploads",
                "organization:DescribeOrganizationMembers",
                "organization:CreateOrgMemberProductServiceRole",
                "region:DescribeRegions",
                "cvm:DescribeInstances",
                "cvm:DescribeInstancesStatus",
                "monitor:GetMonitorData",
                "cvm:InquiryPriceResetInstancesType",
                "cvm:InquiryPriceTerminateInstances",
                "cvm:DescribeZoneInstanceConfigInfos",
                "cvm:InquiryPriceRunInstances",
                "organization:DescribeOrganization"
            ],
            "resource": "*"
        }
    ]
  }
  

CVM_QCSLinkedRoleInCVMSmartDiagnostic

Use Cases： The current role is the CVM service linked role, which will access your other service resources within the scope of the permissions of the associated policy.
Authorization Polices

• Policy Name： QcloudAccessForCVMLinkedRoleInCVMSmartDiagnostic
• Policy Information：

  {
    "version": "2.0",
    "statement": [
        {
            "action": [
                "tat:DescribeAutomationAgentStatus",
                "tat:RunCommand",
                "tat:DescribeInvocationTasks",
                "cwp:DescribeMachineInfo",
                "cwp:DescribeMalWareList",
                "cwp:DescribeHostLoginList",
                "cwp:DescribeBruteAttackList",
                "cwp:DescribeRiskDnsList",
                "cwp:DescribeBashEvents"
            ],
            "resource": "*",
            "effect": "allow"
        }
    ]
  }