To obtain the resources of other cloud services by using a Log Service application, such as Log Audit Service or EBS Lens, you can assign the AliyunServiceRoleForSLSAudit service-linked role to the application. This topic describes the scenarios and policy of the AliyunServiceRoleForSLSAudit service-linked role.

Scenarios

When you collect the logs from specific cloud services in a Log Service application, such as Log Audit Service or EBS Lens, Log Service calls the API operations of the cloud services to obtain the information of the cloud services. To collect the required information, Log Service must assume the AliyunServiceRoleForSLSAudit service-linked role to obtain the required permissions to read the data of resources from the cloud services and modify the settings of log collection. For more information, see Service-linked roles.

Description

Note When you activate Log Service, a service-linked role named AliyunServiceRoleForSLSAlert is automatically created.
  • Role name: AliyunServiceRoleForSLSAudit.
  • Policy attached to the role: AliyunServiceRolePolicyForSLSAudit.
  • Policy document:
    {
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "resourcemanager:ListAccounts",
                "resourcemanager:GetAccount",
                "resourcemanager:GetResourceDirectory",
                "resourcemanager:GetFolder",
                "resourcemanager:ListFoldersForParent",
                "resourcemanager:ListAccountsForParent",
                "rds:DescribeRegions",
                "rds:DescribeSqlLogInstances",
                "rds:DescribeDBInstanceAttribute",
                "rds:ListTagResources",
                "rds:DisableSqlLogDistribution",
                "rds:EnableSqlLogDistribution",
                "rds:ModifySQLCollectorPolicy",
                "rds:DescribeSQLCollectorRetention",
                "polardb:DescribeRegions",
                "polardb:DescribeDBClusters",
                "polardb:DescribeSqlLogClusters",
                "polardb:ModifyDBClusterAuditLogCollector",
                "polardb:DescribeDBClusterAttribute",
                "polardb:DescribeSQLExplorerRetention",
                "kvstore:DescribeRegions",
                "kvstore:DescribeInstances",
                "kvstore:DescribeRedisLogConfig",
                "kvstore:ModifyAuditLogConfig",
                "kvstore:DescribeInstanceAttribute",
                "kvstore:DescribeEngineVersion",
                "kvstore:InitializeKvstorePermission",
                "drds:DescribeDrdsInstances",
                "drds:DescribeDrdsDBs",
                "drds:EnableSqlAuditExtraWrite",
                "drds:DisableSqlAuditExtraWrite",
                "drds:DescribeDrdsRegions",
                "drds:DescribeDrdsSqlAuditStatus",
                "slb:DescribeRegions",
                "slb:DescribeLoadBalancers",
                "slb:DescribeLoadBalancerAttribute",
                "slb:SetAccessLogsDownloadAttribute",
                "slb:DeleteAccessLogsDownloadAttribute",
                "slb:DescribeAccessLogsDownloadAttribute",
                "slb:ListTagResources",
                "alb:DescribeRegions",
                "alb:ListLoadBalancers",
                "alb:EnableLoadBalancerAccessLog",
                "alb:DisableLoadBalancerAccessLog",
                "alb:GetLoadBalancerAttribute",
                "cs:GetClustersByUid",
                "cs:GetClusters",
                "kms:DescribeKeyStores",
                "oss:GetBucketInfo",
                "oss:ListBuckets",
                "oss:GetBucketTagging",
                "oss:GetBucketWorm",
                "oss:GetBucketLifecycle",
                "oss:GetBucketReferer",
                "ecs:DescribeDisks",
                "ecs:DescribeSnapshots",
                "ecs:DescribeRegions",
                "ecs:DescribeInstances",
                "mse:GetGateway",
                "cen:ListTransitRouters",
                "cen:ListTransitRouterPeerAttachments",
                "cen:ListTransitRouterVbrAttachments",
                "vpc:DescribeVpcs",
                "vpc:GetNatGatewayAttribute",
                "vpc:DescribeNatGateways",
                "vpc:DescribeRegions",
                "hbase:DescribeInstance",
                "lindorm:GetLindormInstance"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "oos:StartExecution",
                "oos:ListExecutions"
            ],
            "Resource": [
                "acs:oos:*:*:template/ACS-LOG-BulkyInstallLogtail",
                "acs:oos:*:*:execution/*"
            ],
            "Effect": "Allow"
        },
        {
            "Action": [
                "ecs:InvokeCommand",
                "ecs:DescribeInvocations",
                "ecs:DescribeInvocationResults",
                "ecs:DescribeCloudAssistantStatus"
            ],
            "Resource": [
                "acs:ecs:*:*:instance/*",
                "acs:ecs:*:*:command/cmd-ACS-LOG-InstallLogtail-*"
            ],
            "Effect": "Allow"
        },
        {
            "Action": [
                "log:CreateProject",
                "log:GetProject",
                "log:ListProject",
                "log:ListLogStores",
                "log:GetLogStore",
                "log:GetLogStoreLogs",
                "log:PostLogStoreLogs",
                "log:BatchPostLogStoreLogs",
                "log:CreateIndex",
                "log:UpdateIndex",
                "log:CreateDashboard",
                "log:UpdateDashboard",
                "log:CreateLogStore",
                "log:CreateSavedSearch",
                "log:UpdateSavedSearch",
                "log:CreateJob",
                "log:UpdateJob",
                "log:ListShards",
                "log:GetCursorOrData",
                "log:GetConsumerGroupCheckPoint",
                "log:UpdateConsumerGroup",
                "log:ConsumerGroupHeartBeat",
                "log:ConsumerGroupUpdateCheckPoint",
                "log:ListConsumerGroup",
                "log:CreateConsumerGroup",
                "log:GetLogging",
                "log:CreateLogging",
                "log:UpdateLogging",
                "log:DeleteLogging",
                "log:PostProjectQuery",
                "log:GetProjectQuery",
                "log:PutProjectQuery",
                "log:DeleteProjectQuery",
                "log:GetMachineGroup",
                "log:ListMachineGroup"
            ],
            "Resource": [
                "acs:log:*:*:project/*"
            ],
            "Effect": "Allow"
        },
        {
            "Action": [
                "log:GetApp",
                "log:UpdateApp",
                "log:CreateApp"
            ],
            "Resource": [
                "acs:log:*:*:app/audit"
            ],
            "Effect": "Allow"
        },
        {
            "Action": "ram:CreateServiceLinkedRole",
            "Resource": "*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": [
                        "r-kvstore.aliyuncs.com",
                        "logdelivery.alb.aliyuncs.com"
                    ]
                }
            }
        },
        {
            "Action": "ram:DeleteServiceLinkedRole",
            "Resource": "*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": "audit.log.aliyuncs.com"
                }
            }
        }
    ]
}