委托授权

由于SWR企业版在运行中对网络、存储、安全等各类云服务资源都存在依赖关系，因此当您首次登录SWR企业版控制台时，SWR将自动请求获取云资源权限，从而更好地为您提供服务。

前提条件

如果您的账号是IAM子账号，那么您的子账号需要有以下权限才可正常委托授权：关于如何自定义添加云服务的操作权限，请参见自定义策略样例。

约束与限制

在使用SWR企业版委托时，请务必遵守以下限制，以避免业务中断：

严禁删除委托：SWR企业版依赖该服务委托来访问您的网络、存储以及安全等各类云服务资源，请勿在IAM控制台删除由SWR自动创建的委托。
风险说明：如果删除该委托，SWR的核心功能（如创建注册表、镜像上传下载）不可用，并可能导致资源计费异常。
恢复方法：如意外删除，需重新登录SWR企业版控制台界面触发重新授权。

表1 关联云服务权限
关联云服务	操作名称	权限（旧版IAM）	权限（新版IAM）
统一身份认证服务（Identity and Access Management，IAM）	查询权限列表	iam:roles:listRoles	iam:roles:list
	查询委托列表信息	iam:agencies:listAgencies	iam:agencies:list
	查询委托以及信任委托列表	iam:agencies:listAgencies	iam:agencies:listV5
	创建委托	iam:agencies:createAgency	iam:agencies:create
	为委托授予指定权限	iam:permissions:grantRoleToAgency	iam:agencies:grantRole
	查询委托的所有权限	iam:permissions:listRolesForAgency	iam:agencies:listRoles
	查询项目服务中的委托权限	iam:permissions:listRolesForAgencyOnProject	iam:agencies:listRolesOnProject

系统策略SWREnterpriseAgencyPolicy

SWR企业版通过创建委托并授予SWREnterpriseAgencyPolicy策略权限，该策略包含了SWR企业版访问用户资源所需的所有操作权限。

SWREnterpriseAgencyPolicy策略的权限将随SWR企业版功能扩展而动态更新，持续适配业务发展需求。

{
    "Version": "1.1",
    "Statement": [
        {
            "Action": [
                "iam:users:getUser"
            ],
            "Effect": "Allow"
        },
        {
            "Action": [
                "vpc:securityGroups:create",
                "vpc:securityGroups:delete",
                "vpc:securityGroups:get",
                "vpc:securityGroupRules:create",
                "vpc:securityGroupRules:delete",
                "vpc:ports:create",
                "vpc:ports:delete",
                "vpc:ports:update",
                "vpc:ports:get",
                "vpc:subnets:get",
                "vpc:vpcs:get",
                "vpcep:endpoints:create",
                "vpcep:endpoints:delete",
                "vpcep:endpoints:get"
            ],
            "Effect": "Allow"
        },
        {
            "Action": [
                "kms:cmk:create",
                "kms:cmk:update",
                "kms:cmk:getMaterial",
                "kms:cmk:get",
                "kms:cmk:list",
                "kms:cmk:sign",
                "kms:cmk:getPublicKey",
                "kms:dek:create",
                "kms:dek:decrypt",
                "kms:dek:encrypt"
            ],
            "Effect": "Allow"
        },
        {
            "Action": [
                "ces:metricData:list"
            ],
            "Effect": "Allow"
        },
        {
            "Action": [
                "hss:images:set",
                "hss:images:list",
                "hss:vuls:list",
                "hss:containers:list",
                "hss:containers:set"
            ],
            "Effect": "Allow"
        },
        {
            "Action": [
                "swr:instance:createTempCredential",
                "swr:instance:list",
                "swr:repository:listRepositories",
                "swr:repository:listArtifacts",
                "swr:instance:listAllArtifacts",
                "swr:repository:downloadArtifact",
                "swr:repository:getTag"
            ],
            "Effect": "Allow"
        },
        {
            "Action": [
                "obs:bucket:CreateBucket",
                "obs:bucket:DeleteBucket",
                "obs:bucket:DeleteBucketPolicy",
                "obs:bucket:GetBucketPolicy",
                "obs:bucket:GetBucketStorage",
                "obs:bucket:GetEncryptionConfiguration",
                "obs:bucket:GetLifecycleConfiguration",
                "obs:bucket:HeadBucket",
                "obs:bucket:ListBucket",
                "obs:bucket:ListBucketMultipartUploads",
                "obs:bucket:PutBucketPolicy",
                "obs:bucket:PutEncryptionConfiguration",
                "obs:bucket:PutLifecycleConfiguration",
                "obs:object:AbortMultipartUpload",
                "obs:object:DeleteObject",
                "obs:object:GetObject",
                "obs:object:ListMultipartUploadParts",
                "obs:object:PutObject"
            ],
            "Effect": "Allow"
        }
    ]
}