Service roles and service-linked roles are predefined by Tencent Cloud services and, upon user authorization, the corresponding services can access and use resources by assuming these service-linked roles. This document provides detailed information on the use cases and associated authorization policies of these specific service-linked roles.

Product	Role Name	Role Types	Role Entity
Cloud Virtual Machine	CVM_QCSLinkedRoleInCbsInit	Service-Related Roles	cbsinit.cvm.cloud.tencent.com
Cloud Virtual Machine	CVM_QCSLinkedRoleInClawPro	Service-Related Roles	clawpro.cvm.cloud.tencent.com
Cloud Virtual Machine	CVM_QCSLinkedRoleInOpenClaw	Service-Related Roles	openclaw.cvm.cloud.tencent.com
Cloud Virtual Machine	CVM_QCSLinkedRoleInClawProAgent	Service-Related Roles	cvm.qcloud.com
Cloud Virtual Machine	CVM_QCSLinkedRoleInCBSRecommender	Service-Related Roles	cbsrecommender.cvm.cloud.tencent.com
Cloud Virtual Machine	CVM_QCSLinkedRoleInCVMRecommender	Service-Related Roles	CVMRecommender.cvm.cloud.tencent.com
Cloud Virtual Machine	CVM_QCSLinkedRoleInCVMSmartDiagnostic	Service-Related Roles	cvmsmartdiagnostic.cvm.cloud.tencent.com

CVM_QCSLinkedRoleInCbsInit

Use Cases： The current role is the CVM service linked role, which will access your other service resources within the scope of the permissions of the associated policy.
Authorization Polices

• Policy Name： QcloudAccessForCVMLinkedRoleInCbsinit
• Policy Information：
  

  {
      "version": "2.0",
      "statement": [
          {
              "effect": "allow",
              "resource": [
                  "*"
              ],
              "action": [
                  "tat:RunCommand",
                  "tat:DescribeInvocations",
                  "tat:DescribeInvocationTasks",
                  "tat:DescribeAutomationAgentStatus"
              ]
          }
      ]
  }

CVM_QCSLinkedRoleInClawPro

Use Cases： The current role is the Cloud Server-ClawPro service role, which will access your other cloud service resources within the permissions defined by the associated policies.
Authorization Polices

• Policy Name： QcloudAccessForCVMLinkedRolelnClawPro
• Policy Information：
  

  {
      "version": "2.0",
      "statement": [
          {
              "effect": "allow",
              "action": [
                  "cvm:*",
                  "tat:*",
                  "vpc:*",
                  "ses:*",
                  "sms:*",
                  "cos:*",
                  "cls:*",
                  "csip:*",
                  "cwp:*",
                  "cam:PassRole",
                  "orcaterm:*",
                  "vdb:*",
                  "smh:*",
                  "tdai:*",
                  "ssl:*",
                  "tag:Describe*",
                  "finance:CheckAccountBalance",
                  "apis:*",
                  "tcb:*",
                  "lowcode:*",
                  "monitor:*",
                  "scf:BatchCreateTrigger",
                  "scf:CreateFunction",
                  "scf:CreateFunctionTestModel",
                  "scf:CreateTrigger",
                  "scf:DeleteFunction",
                  "scf:DeleteFunctionTestModel",
                  "scf:DeleteProvisionedConcurrencyConfig",
                  "scf:GetAlias",
                  "scf:GetFunction",
                  "scf:GetFunctionAddress",
                  "scf:GetFunctionLogs",
                  "scf:GetFunctionTestModel",
                  "scf:GetProvisionedConcurrencyConfig",
                  "scf:GetTempCosInfo",
                  "scf:Invoke",
                  "scf:ListFunctionTestModels",
                  "scf:ListFunctions",
                  "scf:ListVersionByFunction",
                  "scf:PublishVersion",
                  "scf:PutProvisionedConcurrencyConfig",
                  "scf:UpdateAlias",
                  "scf:UpdateFunctionCode",
                  "scf:UpdateFunctionConfiguration",
                  "scf:UpdateFunctionIncrementalCode",
                  "scf:UpdateFunctionTestModel"
              ],
              "resource": "*"
          },
          {
              "effect": "allow",
              "action": [
                  "finance:trade"
              ],
              "resource": [
                  "qcs::cvm:::*",
                  "qcs::cls:::*",
                  "qcs::vdb:::*"
              ]
          }
      ]
  }

CVM_QCSLinkedRoleInOpenClaw

Use Cases： The current role is the cloud server -OpenClaw service role. This role will access your other cloud service resources within the permission scope of the associated policy.
Authorization Polices

• Policy Name： QcloudAccessForCVMLinkedRoleInOpenClaw
• Policy Information：
  

  {
      "version": "2.0",
      "statement": [
          {
              "effect": "allow",
              "action": [
                  "cvm:*",
                  "tat:*",
                  "vpc:*",
                  "ses:*",
                  "sms:*"
              ],
              "resource": "*"
          },
          {
              "effect": "allow",
              "action": [
                  "finance:trade"
              ],
              "resource": [
                  "qcs::cvm:::*"
              ]
          }
      ]
  }

CVM_QCSLinkedRoleInClawProAgent

Use Cases： The current role is the Cloud Server-ClawProAgent service role, which will access your other cloud service resources within the permissions defined by the associated policies.
Authorization Polices

• Policy Name： QcloudAccessForCVMLinkedRoleInClawProAgent
• Policy Information：
  

  {
      "statement": [
          {
              "action": [
                  "cls:pushLog",
                  "cls:getConfig",
                  "cls:agentHeartBeat",
                  "cls:MetricsRemoteWrite",
                  "cls:OpenClawService"
              ],
              "effect": "allow",
              "resource": [
                  "*"
              ]
          }
      ],
      "version": "2.0"
  }

CVM_QCSLinkedRoleInCBSRecommender

Use Cases： The current role is a role related to CVM services, which will access your CVM and Organization resources within the permission scope of the associated policy.
Authorization Polices

• Policy Name： QcloudAccessForCVMLinkedRoleInCBSRecommender
• Policy Information：
  

  {
      "version": "2.0",
      "statement": [
          {
              "effect": "allow",
              "action": [
                  "cvm:DescribeDisks",
                  "organization:DescribeOrganizationMembers",
                  "organization:DescribeOrganization",
                  "organization:CreateOrgMemberProductServiceRole"
              ],
              "resource": "*"
          }
      ]
  }

CVM_QCSLinkedRoleInCVMRecommender

Use Cases： The current role is related to the CVM service.This role can access your CVM resouce usage and cost optimization recommendation with the permission granted by the associated policies
Authorization Polices

• Policy Name： QcloudAccessForCVMLinkedRoleInCVMRecommender
• Policy Information：
  

  {
      "version": "2.0",
      "statement": [
          {
              "effect": "allow",
              "action": [
                  "cos:ListParts",
                  "cos:PostObject",
                  "cos:PutObject*",
                  "cos:InitiateMultipartUpload",
                  "cos:UploadPart",
                  "cos:UploadPartCopy",
                  "cos:CompleteMultipartUpload",
                  "cos:AbortMultipartUpload",
                  "cos:ListMultipartUploads",
                  "organization:DescribeOrganizationMembers",
                  "organization:CreateOrgMemberProductServiceRole",
                  "region:DescribeRegions",
                  "cvm:DescribeInstances",
                  "cvm:DescribeInstancesStatus",
                  "monitor:GetMonitorData",
                  "cvm:InquiryPriceResetInstancesType",
                  "cvm:InquiryPriceTerminateInstances",
                  "cvm:DescribeZoneInstanceConfigInfos",
                  "cvm:InquiryPriceRunInstances",
                  "organization:DescribeOrganization"
              ],
              "resource": "*"
          }
      ]
  }

CVM_QCSLinkedRoleInCVMSmartDiagnostic

Use Cases： The current role is the CVM service linked role, which will access your other service resources within the scope of the permissions of the associated policy.
Authorization Polices

• Policy Name： QcloudAccessForCVMLinkedRoleInCVMSmartDiagnostic
• Policy Information：
  

  {
      "version": "2.0",
      "statement": [
          {
              "action": [
                  "tat:DescribeAutomationAgentStatus",
                  "tat:RunCommand",
                  "tat:DescribeInvocationTasks",
                  "cwp:DescribeMachineInfo",
                  "cwp:DescribeMalWareList",
                  "cwp:DescribeHostLoginList",
                  "cwp:DescribeBruteAttackList",
                  "cwp:DescribeRiskDnsList",
                  "cwp:DescribeBashEvents"
              ],
              "resource": "*",
              "effect": "allow"
          }
      ]
  }