数据安全审计

服务（相关）角色是由腾讯云服务预定义，经用户授权后相应服务即可通过扮演服务相关角色对用户资源进行访问操作。本文档介绍具体服务相关角色的使用场景及相关权限策略信息。

CDS_QCSLinkedRoleInAudit

使用场景： 当前角色为数据安全审计机（CDS）服务相关角色，该角色将在已关联策略的权限范围内访问您的其他云服务资源。
权限策略

• 策略名称： QcloudAccessForCDSLinkedRoleInAudit
• 策略内容：
  

  {
      "version": "2.0",
      "statement": [
          {
              "action": [
                  "cvm:DescribeInstances",
                  "clb:CreateLoadBalancer",
                  "clb:DeleteLoadBalancer",
                  "clb:CreateListener",
                  "clb:DescribeListeners",
                  "clb:DeleteListener",
                  "clb:DeleteLoadBalancerListeners",
                  "clb:RegisterTargets",
                  "clb:DeregisterTargets",
                  "vpc:CreateVpcEndPointService",
                  "vpc:DescribeVpcEndPointService",
                  "vpc:ModifyVpcEndPointServiceAttribute",
                  "vpc:DeleteVpcEndPointService",
                  "vpc:CreateVpcEndPointServiceWhiteList",
                  "vpc:DescribeVpcEndPointServiceWhiteList",
                  "vpc:DeleteVpcEndPointServiceWhiteList",
                  "vpc:EnableVpcEndPointConnect",
                  "vpc:CheckVpcEndPointServiceExist",
                  "vpc:CreateVpcEndPoint",
                  "vpc:DescribeVpcEndPoint",
                  "vpc:ModifyVpcEndPointAttribute",
                  "vpc:DeleteVpcEndPoint",
                  "vpc:DeleteVpcEndPointAndServiceAll",
                  "vpc:DescribeSubnetEx",
                  "cdb:DescribeDBRoutes",
                  "cdb:DescribeDBInstances",
                  "mariadb:DescribeDBInstances",
                  "sqlserver:DescribeDBInstances",
                  "postgres:DescribeDBInstances",
                  "redis:DescribeInstances",
                  "mongodb:DescribeDBInstances",
                  "dcdb:DescribeDCDBInstances",
                  "sms:SendSms",
                  "tat:DescribeAutomationAgentStatus",
                  "tat:RunCommand",
                  "tat:DescribeInvocations",
                  "tat:DescribeInvocationTasks",
                  "ckafka:DescribeInstances",
                  "ckafka:DescribeInstancesDetail",
                  "ckafka:DescribeInstanceAttributes",
                  "ckafka:DescribeTopic",
                  "ckafka:DescribeTopicDetail",
                  "ckafka:DescribeRoute",
                  "ckafka:CreateRoute",
                  "cynosdb:DescribeClusters",
                  "cynosdb:DescribeInstances"
              ],
              "resource": "*",
              "effect": "allow"
          }
      ]
  }