Service roles and service-linked roles are predefined by Tencent Cloud services and, upon user authorization, the corresponding services can access and use resources by assuming these service-linked roles. This document provides detailed information on the use cases and associated authorization policies of these specific service-linked roles.

APM_QCSLinkedRoleInCLS

Use Cases： The current role is the APM service linked role, which authorizes access to CLS and other Tencent Cloud resources within the scope of the permissions of the associated policy.
Authorization Polices

• Policy Name： QcloudAccessForAPMLinkedRoleInCLS
• Policy Information：
  

  {
      "version": "2.0",
      "statement": [
          {
              "effect": "allow",
              "action": [
                  "cls:SearchLog",
                  "cls:DescribeIndex",
                  "cls:DescribeLogsets",
                  "cls:DescribeTopics"
              ],
              "resource": "*"
          }
      ]
  }

APM_QCSLinkedRoleInApmMcp

Use Cases： This role is for APM services. In MCP scenarios, it accesses APM resources within policy-permitted scope.
Authorization Polices

• Policy Name： QcloudAccessForAPMLinkedRoleInApmMcp
• Policy Information：
  

  {
      "version": "2.0",
      "statement": [
          {
              "effect": "allow",
              "action": [
                  "cls:SearchLog",
                  "apm:CreateProfileTask",
                  "apm:DescribeApmConsumption",
                  "apm:DescribeTagCountValues",
                  "apm:DescribeApmComboInfo",
                  "apm:DescribeHistoryFlameGraphList",
                  "apm:DescribeProfileDetail",
                  "apm:DescribeMetricLineData",
                  "apm:DescribeApmInstances",
                  "apm:DescribeTagValues",
                  "apm:DescribeTopologyNew",
                  "apm:DescribeMetricRecords",
                  "apm:DescribeApmServiceMetric",
                  "apm:DescribeSpanTagList",
                  "apm:DescribeInstanceBriefs",
                  "apm:DescribeSpanTreeByID"
              ],
              "resource": "*"
          }
      ]
  }

APM_QCSLinkedRoleInPromInstance

Use Cases： The current role is the APM service linked role, which will access your Managed Service for Prometheus within the scope of the permissions of the associated policy.
Authorization Polices

• Policy Name： QcloudAccessForAPMLinkedRoleInPromInstance
• Policy Information：
  

  {
      "version": "2.0",
      "statement": [
          {
              "effect": "allow",
              "action": [
                  "monitor:DescribePrometheusInstances",
                  "monitor:DescribePrometheusInstancesOverview"
              ],
              "resource": "*"
          }
      ]
  }

APM_QCSLinkedRoleInCKafkaInstance

Use Cases： The current role is the APM service linked role, which will access your Managed Service for CKafka within the scope of the permissions of the associated policy.
Authorization Polices

• Policy Name： QcloudAccessForAPMLinkedRolelnCKafkaInstance
• Policy Information：
  

  {
      "version": "2.0",
      "statement": [
          {
              "effect": "allow",
              "action": [
                  "ckafka:DescribeInstanceAttributes",
                  "ckafka:DescribeInstances",
                  "ckafka:DescribeTopicAttributes",
                  "ckafka:DescribeRoute",
                  "ckafka:CreateRoute",
                  "ckafka:DeleteRoute",
                  "ckafka:CreateToken",
                  "ckafka:AuthorizeToken"
              ],
              "resource": "*"
          }
      ]
  }