Service roles and service-linked roles are predefined by Tencent Cloud services and, upon user authorization, the corresponding services can access and use resources by assuming these service-linked roles. This document provides detailed information on the use cases and associated authorization policies of these specific service-linked roles.

Product	Role Name	Role Types	Role Entity
LLM Service TokenHub	TokenHub_QCSLinkedRoleInBatchInference	Service-Related Roles	batchinference.tokenhub.cloud.tencent.com
LLM Service TokenHub	TokenHub_QCSLinkedRoleInInitialization	Service-Related Roles	initialization.tokenhub.cloud.tencent.com
LLM Service TokenHub	TokenHub_QCSLinkedRoleInInternalAccess	Service-Related Roles	internalaccess.tokenhub.cloud.tencent.com
LLM Service TokenHub	TokenHub_QCSLinkedRoleInCloudLogService	Service-Related Roles	tokenhublog.cls.cloud.tencent.com
LLM Service TokenHub	TokenHub_QCSLinkedRoleInTokenPlanEnterprise	Service-Related Roles	tokenplanenterprise.tokenhub.cloud.tencent.com
LLM Service TokenHub	TokenHub_QCSLinkedRoleInWebApplicationFirewall	Service-Related Roles	tokenhublog.waf.cloud.tencent.com

TokenHub_QCSLinkedRoleInBatchInference

Use Cases： The current role is the TokenHub service linked role, which will access your COS resources within the scope of the permissions of the associated policy.
Authorization Polices

• Policy Name： QcloudAccessForTokenhubRoleInBatchInference
• Policy Information：
  

  {
      "version": "2.0",
      "statement": [
          {
              "effect": "allow",
              "action": [
                  "cos:AbortMultipartUpload",
                  "cos:DeleteMultipleObjects",
                  "cos:DeleteObject",
                  "cos:GetBucket",
                  "cos:GetObject",
                  "cos:HeadBucket",
                  "cos:HeadObject",
                  "cos:ListMultipartUploads",
                  "cos:PutBucket",
                  "cos:PutObject",
                  "cos:ListParts",
                  "cos:UploadPart",
                  "cos:UploadPartCopy",
                  "cos:PutObjectCopy",
                  "cos:InitiateMultipartUpload",
                  "cos:CompleteMultipartUpload"
              ],
              "resource": "*"
          }
      ]
  }

TokenHub_QCSLinkedRoleInInitialization

Use Cases： The current role is the TokenHub service linked role, which will access your other service resources within the scope of the permissions of the associated policy.
Authorization Polices

• Policy Name： QcloudAccessForTokenhubRoleInInitinitialization
• Policy Information：
  

  {
      "version": "2.0",
      "statement": [
          {
              "effect": "allow",
              "action": [
                  "tag:UnTagResources",
                  "tag:TagResources",
                  "tag:ModifyResourcesTagValue",
                  "tag:ModifyResourceTags",
                  "tag:UpdateResourceTagValue",
                  "tag:DescribeResourcesByTags",
                  "tag:DescribeResourceTagsByTagKeys",
                  "tag:DescribeResourceTagsByResourceIds",
                  "tag:DescribeResourceTags"
              ],
              "resource": "*"
          }
      ]
  }

TokenHub_QCSLinkedRoleInInternalAccess

Use Cases： The current role is the TokenHub service linked role, which will access your VPC resources within the scope of the permissions of the associated policy.
Authorization Polices

• Policy Name： QcloudAccessForTokenhubRoleInInternalAccess
• Policy Information：
  

  {
      "version": "2.0",
      "statement": [
          {
              "effect": "allow",
              "action": [
                  "privatedns:ModifyPrivateZoneVpc",
                  "privatedns:ModifyPrivateZone",
                  "privatedns:DeletePrivateZoneRecord",
                  "privatedns:ModifyPrivateZoneRecord",
                  "privatedns:CreatePrivateZoneRecord",
                  "privatedns:CreatePrivateZone",
                  "vpc:CreateVpcEndPoint",
                  "vpc:DeleteVpcEndPoint",
                  "vpc:CheckVpcEndPointServiceExist",
                  "privatedns:AddSpecifyPrivateZoneVpc",
                  "privatedns:DescribePrivateZoneList",
                  "privatedns:DeletePrivateZone",
                  "privatedns:DescribePrivateZoneRecordList",
                  "privatedns:DeleteSpecifyPrivateZoneVpc",
                  "vpc:DescribeVpcEndPoint",
                  "vpc:DescribeVpcs",
                  "vpc:DescribeSubnets"
              ],
              "resource": "*"
          }
      ]
  }

TokenHub_QCSLinkedRoleInCloudLogService

Use Cases： The current role is the TokenHub service linked CloudLogService.
Authorization Polices

• Policy Name： QcloudAccessForTokenhubLinkedRoleInCloudLogService
• Policy Information：
  

  {
      "version": "2.0",
      "statement": [
          {
              "effect": "allow",
              "action": [
                  "cls:pushLog"
              ],
              "resource": "*"
          }
      ]
  }

TokenHub_QCSLinkedRoleInTokenPlanEnterprise

Use Cases： The current role is the Token Plan service linked role, which will access your finance resources within the scope of the permissions of the associated policy.
Authorization Polices

• Policy Name： QcloudAccessForTokenPlanEntRoleInFinance
• Policy Information：
  

  {
      "version": "2.0",
      "statement": [
          {
              "effect": "allow",
              "action": [
                  "finance:trade"
              ],
              "resource": [
                  "qcs::tokenhub:::*",
                  "qcs::lmp:::*"
              ]
          }
      ]
  }

TokenHub_QCSLinkedRoleInWebApplicationFirewall

Use Cases： The current role is the TokenHub service linked Web Application Firewall.
Authorization Polices

• Policy Name： QcloudAccessForTokenhubLinkedRoleInWebApplicationFirewall
• Policy Information：
  

  {
      "version": "2.0",
      "statement": [
          {
              "effect": "allow",
              "action": [
                  "waf:CreateLLMSdkInstance",
                  "waf:DescribeInstances",
                  "waf:AddLLMSdkAccess",
                  "waf:DescribeLLMSdkAccess",
                  "waf:ModifyLLMStatus",
                  "waf:DescribeLLMWafProtectRules",
                  "waf:ModifyLLMWafProtectRule",
                  "waf:DescribeLLMWafProtectRules",
                  "waf:DescribeLLMContentSecCheck"
              ],
              "resource": "*"
          }
      ]
  }