When Scheduled SQL jobs run, the jobs execute SQL statements to analyze data in source Logstores, and then save the analysis results to destination Logstores or destination Metricstores. You can assign a Resource Access Management (RAM) role to a Scheduled SQL job to complete the preceding operations. If the source and destination Logstores belong to different Alibaba Cloud accounts, perform the steps that are described in this topic to grant permissions to the RAM role. You can specify Logstores or Metricstores when you configure Scheduled SQL jobs. This topic describes how to grant a RAM role the permissions to access Logstores across Alibaba Cloud accounts.
Prerequisites
RAM Role A is created in Alibaba Cloud Account A and RAM Role B is created in Alibaba Cloud Account B. For more information, see Step 1: Create a RAM role.
Step 1: Grant RAM Role A the permissions to analyze log data in a source Logstore
After you grant RAM Role A the permissions to analyze log data in a source Logstore, a Scheduled SQL job can assume RAM Role A to perform SQL analysis on the log data in the source Logstore that belongs to Alibaba Cloud Account A.
Log on to the RAM console by using Alibaba Cloud Account A.
Create a policy that contains the permissions to analyze the log data of a source Logstore.
In the left-side navigation pane, choose .
On the Policies page, click Create Policy.
On the Create Custom Policy page, set the parameters and click OK. The following table describes the parameters.
Parameter
Description
Policy Name
The name of the policy. Example: log-scheduled-sql-policy.
Configuration Mode
Select Script.
Policy Document
Replace the content in the editor with the following script.
Policy that uses exact names to match resources
In this example, the name of the source project is log-project-prod. The name of the source Logstore is website_log. You can replace the names with the actual names of your projects and Logstores.
ImportantLogstores that are displayed in a policy can also be Metricstores. If you want to manage Metricstores, the following policy also applies.
{ "Version":"1", "Statement":[ { "Action":[ "log:PostProjectQuery" ], "Resource":[ "acs:log:*:*:project/log-project-prod/logstore/website_log", "acs:log:*:*:project/log-project-prod/logstore/website_log/*" ], "Effect":"Allow" }, { "Action":[ "log:GetProjectQuery", "log:PutProjectQuery", "log:DeleteProjectQuery" ], "Resource":[ "acs:log:*:*:project/log-project-prod" ], "Effect":"Allow" } ] }
Policy that uses wildcards to match resources
In this example, the names of the source projects are log-project-dev-a, log-project-dev-b, and log-project-dev-c. The names of the source Logstores are website_a_log, website_b_log, and website_c_log. You can replace the names with the actual names of your projects and Logstores.
{ "Version":"1", "Statement":[ { "Action":[ "log:PostProjectQuery" ], "Resource":[ "acs:log:*:*:project/log-project-dev-*/logstore/website_*_log", "acs:log:*:*:project/log-project-dev-*/logstore/website_*_log/*" ], "Effect":"Allow" }, { "Action":[ "log:GetProjectQuery", "log:PutProjectQuery", "log:DeleteProjectQuery" ], "Resource":[ "acs:log:*:*:project/log-project-dev-*" ], "Effect":"Allow" } ] }
Grant permissions to RAM Role A.
In the left-side navigation pane, choose .
Find RAM Role A and click Add Permissions in the Actions column.
Click Custom Policy in the Select Policy section and select the policy that you created in Step 2, for example, log-scheduled-sql-policy. Then, click OK.
Confirm the authorization result and click Complete.
Obtain the Alibaba Cloud Resource Name (ARN) of RAM Role A.
In the Basic Information section of the RAM role, obtain the ARN. Example: acs:ram::11****27:role/logsource. We recommend that you record the ARN. If you use a custom role when you create a Scheduled SQL job, you must enter the ARN.
Step 2: Grant RAM Role B the permissions to write data to a destination Logstore
After you grant RAM Role B the permissions to write data to a destination Logstore, a Scheduled SQL job can assume RAM Role B to write SQL analysis results to the destination Logstore that belongs to Alibaba Cloud Account B.
Log on to the RAM console by using Alibaba Cloud Account B.
Create a policy that contains the permissions to write data to a destination Logstore.
In the left-side navigation pane, choose .
On the Policies page, click Create Policy.
On the Create Custom Policy page, set the parameters and click OK. The following table describes the parameters.
Parameter
Description
Policy Name
The name of the policy. Example: log-sink-write-policy.
Configuration Mode
Select Script.
Policy Document
Replace the content in the editor with the following script.
Policy that uses exact names to match resources
In this example, the name of the destination project is log-project-prod. The name of the destination Logstore is website_log_output. You can replace the names with the actual names of your projects and Logstores.
ImportantLogstores that are displayed in a policy can also be Metricstores. If you want to manage Metricstores, the following policy also applies.
{ "Version": "1", "Statement": [ { "Action": [ "log:Post*", "log:BatchPost*" ], "Resource": "acs:log:*:*:project/log-project-prod/logstore/website_log_output", "Effect": "Allow" } ] }
Policy that uses wildcards to match resources
In this example, the names of the destination projects are log-project-dev-a, log-project-dev-b, and log-project-dev-c. The names of the destination Logstores are website_a_log_output, website_b_log_output, and website_c_log_output. You can replace the names with the actual names of your projects and Logstores.
{ "Version": "1", "Statement": [ { "Action": [ "log:Post*", "log:BatchPost*" ], "Resource": "acs:log:*:*:project/log-project-dev-*/logstore/website_*_log_output", "Effect": "Allow" } ] }
Grant permissions to RAM Role B.
In the left-side navigation pane, choose .
Find RAM Role B and click Add Permissions in the Actions column.
Click Custom Policy in the Select Policy section and select the policy that you created in Step 2, for example, log-sink-write-policy. Then, click OK.
Confirm the authorization result and click Complete.
Modify the trust policy of RAM Role B.
On the Roles page, click the name of RAM Role B.
On the page that appears, click the Trust Policy Management tab. Then, click Edit Trust Policy.
Modify the trust policy.
Add ID of Alibaba Cloud Account A to the Service element. and replace the ID based on your business scenario. You can view the ID of your Alibaba Cloud account in the Account Management console.
The following policy allows Alibaba Cloud Account A to obtain a temporary STS token to manage the cloud resources of Alibaba Cloud Account B:
{ "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": [ "log.aliyuncs.com", "ID of Alibaba Cloud Account A@log.aliyuncs.com" ] } } ], "Version": "1" }
Obtain the ARN of RAM Role B.
In the Basic Information section of the RAM role, obtain the ARN. Example: acs:ram::13****44:role/logtarget. We recommend that you record the ARN. If you use a custom role when you create a Scheduled SQL job, you must enter the ARN.