ActionTrail:Grant permissions to a RAM user

Procedure

1. Log on to the RAM console.

2. In the left-side navigation pane, choose Identities > User.

3. On the Users page, find the target RAM user and click Add Permissions in the Actions column.

4. In the Grant Permission panel, select a Resource Scope, and then select a Policies.

   1. Select a resource scope.

      • Entire Account: The permissions apply to the current Alibaba Cloud account.

      • Specific Resource Group: The permissions apply to the specified resource group.

        Important

        To grant permissions at the resource group level, make sure that the cloud service and resource type support resource groups. For more information, see Services that work with Resource Group. For an example of resource group authorization, see Use CloudSSO to manage identity and access in a multi-account architecture.

   2. Confirm the principal.

      The principal is the RAM user to receive permissions. The current RAM user is automatically selected.

   3. Select policies.

      Policies define a set of permissions and are categorized into system policies and custom policies. You can select multiple policies.

      • System policy: From the Policy Name list, select the policies that you need.

        Policy name	Description
        AliyunActionTrailReadOnlyAccess	Grants read-only permissions for ActionTrail.
        AliyunActionTrailFullAccess	Grants the permissions to manage ActionTrail.
        AliyunOSSReadOnlyAccess	Grants read-only permissions for Object Storage Service.
        AliyunLogReadOnlyAccess	Grants read-only permissions for Simple Log Service.

      • Custom Policy: Click All Policy Types, and select Custom Policy.

        For more information about how to create a custom policy, see Create a custom policy.

        • Example 1: Grant a RAM user full permissions for ActionTrail and the permissions to list Object Storage Service (OSS) buckets and Simple Log Service (SLS) projects. This allows the user to manage trails.

          Sample code:

          {
              "Version": "1",
              "Statement": [
                  {
                      "Action": [
                          "actiontrail:*",
                          "oss:GetService",
                          "log:ListProject"
                      ],
                      "Resource": "*",
                      "Effect": "Allow"
                  }
              ]
          }
                                  

          Permission description:

          Action	Description
          oss:GetService	Grants the permission to list OSS buckets.
          log:ListProject	Grants the permission to list SLS projects.
          actiontrail:*	Grants full permissions for ActionTrail.

        • Example 2: Grant a RAM user permissions to manage ActionTrail trails and Simple Log Service components, such as Logstores, indexes, dashboards, charts, and projects. This allows the user to manage alerts.

          Sample code:

          { 
              "Version": "1", 
              "Statement": [
                {
               "Effect": "Allow",
               "Action": [
                 "actiontrail:DescribeTrails",
                 "actiontrail:SetDefaultTrail",
                 "actiontrail:GetDefaultTrail",
                 "actiontrail:CreateTrail"
               ],
               "Resource": "*"   
               },
             {
               "Effect": "Allow",
               "Action": [
                 "log:CreateLogStore",
                 "log:CreateIndex",
                 "log:UpdateIndex"
               ],
               "Resource": [
                 "acs:log:*:*:project/YourProjectName/logstore/internal-alert-history",
                 "acs:log:*:*:project/sls-alert-*/logstore/internal-alert-center-log"
               ]   
               },
             {
               "Effect": "Allow",
               "Action": [
                 "log:CreateDashboard",
                 "log:CreateChart",
                 "log:UpdateDashboard"
               ],
               "Resource": "acs:log:*:*:project/YourProjectName/dashboard/*"
             },
             {
               "Effect": "Allow",
               "Action": [
                 "log:*"
               ],
               "Resource": "acs:log:*:*:project/YourProjectName/job/*"   
               },
             {
               "Effect": "Allow",
               "Action": [
                 "log:CreateProject"
               ],
               "Resource": [
                 "acs:log:*:*:project/sls-alert-*"
               ]
             }
           ]
          }

          Permission description:

          Action	Description
          actiontrail:DescribeTrails	Queries trails.
          actiontrail:SetDefaultTrail	Sets the default trail for alerts.
          actiontrail:GetDefaultTrail	Queries the default trail for alerts.
          actiontrail:CreateTrail	Creates a trail.
          log:CreateLogstore	Creates a Logstore.
          log:CreateIndex	Creates an index.
          log:UpdateIndex	Updates an index.
          log:CreateDashboard	Creates a dashboard.
          log:CreateChart	Creates a chart.
          log:UpdateDashboard	Updates a dashboard.
          log:CreateProject	Creates a project.

   4. Click OK.

5. Click Close.