Service roles and service-linked roles are predefined by Tencent Cloud services and, upon user authorization, the corresponding services can access and use resources by assuming these service-linked roles. This document provides detailed information on the use cases and associated authorization policies of these specific service-linked roles.

Product	Role Name	Role Types	Role Entity
Cloud Native Database TDSQL-C	CynosDB_QCSLinkedRoleInDBLog	Service-Related Roles	DBLog.cynosdb.cloud.tencent.com
Cloud Native Database TDSQL-C	CynosDBMysql_QCSLinkedRoleInKms	Service-Related Roles	kms.cynosdb.cloud.tencent.com
Cloud Native Database TDSQL-C	CynosDBMysql_QCSLinkedRoleInClslog	Service-Related Roles	clslog.cynosdb.cloud.tencent.com
Cloud Native Database TDSQL-C	CynosDB_QCSLinkedRoleInDBlogDeliver	Service-Related Roles	DBLogDeliver.cynosdb.cloud.tencent.com
Cloud Native Database TDSQL-C	CynosDB_QCSLinkedRoleInDBLogDeliverCOS	Service-Related Roles	DBLogDeliverCOS.cynosdb.cloud.tencent.com
Cloud Native Database TDSQL-C	CynosDBMysql_QCSLinkedRoleInDtsDataSync	Service-Related Roles	dtsDataSync.cynosdb.cloud.tencent.com
Cloud Native Database TDSQL-C	CynosDB_QCSLinkedRoleInAuditReplayForCos	Service-Related Roles	AuditReplayCos.cynosdb.cloud.tencent.com

CynosDB_QCSLinkedRoleInDBLog

Use Cases： The current role is the TDSQL-C service linked role, which will access your other service resources within the scope of the permissions of the associated policy.
Authorization Polices

• Policy Name： QcloudAccessForCynosDBLinkedRoleInDBLog
• Policy Information：
  

  {
      "version": "2.0",
      "statement": [
          {
              "effect": "allow",
              "action": [
                  "cls:ModifyKafkaRecharge",
                  "cls:DescribeKafkaRecharges",
                  "cls:DeleteKafkaRecharge",
                  "cls:CreateKafkaRecharge",
                  "cls:DeleteCloudProductLogTask",
                  "cls:ModifyCloudProductLogTask"
              ],
              "resource": "*"
          }
      ]
  }

CynosDBMysql_QCSLinkedRoleInKms

Use Cases： The current role is the cynosdb service linked role, which will access your other service resources within the scope of the permissions of the associated policy.
Authorization Polices

• Policy Name： QcloudAccessForCynosDBLinkedRoleInKms
• Policy Information：
  

  {
      "version": "2.0",
      "statement": [
          {
              "effect": "allow",
              "action": [
                  "kms:GetServiceStatus",
                  "kms:ListKeyDetail",
                  "kms:CreateKey",
                  "kms:GenerateDataKey",
                  "kms:Decrypt",
                  "kms:BindCloudResource",
                  "kms:UnbindCloudResource"
              ],
              "resource": [
                  "*"
              ]
          }
      ]
  }

CynosDBMysql_QCSLinkedRoleInClslog

Use Cases： The current role is the CYNOSDB service linked role, which will access your other service resources within the scope of the permissions of the associated policy.
Authorization Polices

• Policy Name： QcloudAccessForCynosDBLinkedRoleInClslog
• Policy Information：
  

  {
      "version": "2.0",
      "statement": [
          {
              "effect": "allow",
              "action": [
                  "cls:DescribeIndexs",
                  "cls:DescribeTopics",
                  "cls:DescribeIndex",
                  "cls:CreateIndex",
                  "cls:DeleteIndex",
                  "cls:ModifyIndex",
                  "cls:pushLog",
                  "cls:CreateLogset",
                  "cls:CreateTopic",
                  "cls:DescribeLogsets",
                  "cls:DeleteTopic",
                  "cls:DeleteLogset"
              ],
              "resource": [
                  "*"
              ]
          }
      ]
  }

CynosDB_QCSLinkedRoleInDBlogDeliver

Use Cases： The current role is the TDSQL-C service linked role, which will access your other service resources within the scope of the permissions of the associated policy.
Authorization Polices

• Policy Name： QcloudAccessForCynosDBLinkedRoleInDBLogDeliver
• Policy Information：
  

  {
      "version": "2.0",
      "statement": [
          {
              "effect": "allow",
              "action": [
                  "ckafka:DescribeTopic",
                  "ckafka:CreateTopic",
                  "ckafka:CreateRoute",
                  "ckafka:DescribeTaskStatus",
                  "ckafka:DescribeRoute"
              ],
              "resource": "*"
          }
      ]
  }

CynosDB_QCSLinkedRoleInDBLogDeliverCOS

Use Cases： The current role is the TDSQL-C service linked role, which will access your other service resources within the scope of the permissions of the associated policy.
Authorization Polices

• Policy Name： QcloudAccessForCynosDBLinkedRoleInDBLogDeliverCOS
• Policy Information：
  

  {
      "version": "2.0",
      "statement": [
          {
              "effect": "allow",
              "action": [
                  "cos:InitiateMultipartUpload",
                  "cos:UploadPart",
                  "cos:CompleteMultipartUpload",
                  "cos:AbortMultipartUpload",
                  "cos:ListMultipartUploads",
                  "cos:ListParts",
                  "cos:HeadObject",
                  "cos:PutBucketLifecycle",
                  "cos:GetBucketLifecycle",
                  "cos:DeleteBucketLifecycle"
              ],
              "resource": "*"
          }
      ]
  }

CynosDBMysql_QCSLinkedRoleInDtsDataSync

Use Cases： The current role is the cynosdb service linked role, which will access your other service resources within the scope of the permissions of the associated policy.
Authorization Polices

• Policy Name： QcloudAccessForCynosDBLinkedRoleInDtsDataSync
• Policy Information：
  

  {
      "version": "2.0",
      "statement": [
          {
              "effect": "allow",
              "action": [
                  "dts:CreateSyncJob",
                  "dts:ConfigureSyncJob",
                  "dts:CreateCheckSyncJob",
                  "dts:DescribeCheckSyncJobResult",
                  "dts:SkipSyncCheckItem",
                  "dts:StartSyncJob",
                  "dts:DescribeSyncJobs",
                  "dts:IsolateSyncJob",
                  "dts:DestroySyncJob"
              ],
              "resource": [
                  "*"
              ]
          },
          {
              "action": [
                  "finance:trade",
                  "finance:CreateOrders"
              ],
              "effect": "allow",
              "resource": [
                  "qcs::dts:::*"
              ]
          }
      ]
  }

CynosDB_QCSLinkedRoleInAuditReplayForCos

Use Cases： The current role is the TDSQL-C service linked role, which will access your other service resources within the scope of the permissions of the associated policy.
Authorization Polices

• Policy Name： QcloudAccessForCynosDBLinkedRoleInAuditReplayForCos
• Policy Information：
  

  {
      "version": "2.0",
      "statement": [
          {
              "effect": "allow",
              "action": [
                  "cos:HeadObject",
                  "cos:HeadBucket",
                  "cos:GetObject",
                  "cos:GetBucket"
              ],
              "resource": "*"
          }
      ]
  }