Configure the SLS permission assistant for RAM policies - Simple Log Service

The permission assistant simplifies RAM policy configuration for SLS resources.

Procedure

Log on to the Simple Log Service console.
In the Projects section, click the one you want.
In the left-side navigation pane, choose Other > Permission Assistant.

On the Permission Assistant page, configure the following parameters and click Next.

The available modes are Common Project and APP.

Common Project

Common Project mode covers all SLS functional modules.

Parameter	Description
Select Scenario	Select a preset scenario or customize the modules. Each module offers management and read-only permissions. Important Module dependencies: Project permissions (read-only or management) are required for other module permissions to take effect. Selecting Data Ingestion automatically selects the Logstore module. Visualization depends on Data Query. Alerting, Subscription, and Data Ingestion (Cloud Product Integration) depend on Visualization. Alerting and Subscription automatically grant management permissions for Visualization.
Resources	Configure the resources that permissions apply to. Use an asterisk (``) as a wildcard for project and Logstore names. Examples: Full access to all SLS resources: `"Action": "log:", "Resource": "",` Access limited to the `project01` project: `acs:log:::project/project01` `acs:log:::project/project01/` Access limited to `logstore01` in `project01`: `acs:log:::project/project01/logstore/logstore01` `acs:log:::project/project01/logstore/logstore01/*`
Condition	Optionally, add conditions to restrict access. See Policy elements.

APP

APP mode covers applications such as Cost Manager, Log Audit Service, and K8s Event Center.

Parameter	Description
Applications	Select applications and set their permissions to Allow or Deny.
Select Scenario	When you set an application's permission to Allow, the required modules are automatically selected. You can customize the selection. Each module offers management and read-only permissions. Important Module dependencies: Project permissions (read-only or management) are required for other module permissions to take effect. Selecting Data Ingestion automatically selects the Logstore module. Visualization depends on Data Query. Alerting, Subscription, and Data Ingestion (Cloud Product Integration) depend on Visualization. Alerting and Subscription automatically grant management permissions for Visualization.
Resources	Resources are automatically selected based on the chosen APP and cannot be modified.
Condition	Optionally, add conditions to restrict access. See Policy elements.

Preview the access policy and edit it as needed. The following table describes available actions. Click Next when done.

Actions	Description
Format	Formats manually edited JSON code.
Compress	Removes extra spaces and line breaks to reduce the policy size. Policies have a character limit.
Reset	Discards all manual edits and restores the policy to its generated state.
Copy to clipboard	Copies the policy to the clipboard.
Add to custom template	Saves the policy as a custom template for reuse. Note The template is stored in your browser's local storage and cannot be accessed from other browsers.

Create a custom policy.
1. Log on to the RAM console by using your Alibaba Cloud account or a RAM user who has administrative rights.
2. In the left-side navigation pane, choose Permissions > Policies.
3. On the Policies page, click Create Policy.
4. On the Create Policy page, click the JSON tab, replace the existing content with the policy from Step 5, and then click OK.
5. In the Create Policy dialog box, enter a policy name and Description, and then click OK.
Attach the custom policy from Step 6 to a RAM user or RAM role. Grant permissions to a RAM user and Manage the permissions of a RAM role.

The principal can then access resources according to the attached policy.

Minimum permissions for data ingestion via SDK

When you write and read logs through a Simple Log Service SDK, make sure that the final policy follows the principle of least privilege and contains the following six actions, whether you generate the policy in the Permission Assistant or write it manually. If you grant only log:PostLogStoreLogs and log:GetLogStoreLogs, API calls return a 401 permission error, because log:ListProject is the prerequisite permission for accessing Simple Log Service.

Action	Description
`log:ListProject`	Lists projects. This is the prerequisite permission for accessing Simple Log Service.
`log:GetProject`	Queries the details of a project.
`log:ListLogStores`	Lists LogStores.
`log:PostLogStoreLogs`	Writes logs.
`log:GetCursorOrData`	Obtains a cursor and reads log data.
`log:GetLogStoreLogs`	Queries logs.

Sample policy:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "log:ListProject",
        "log:GetProject",
        "log:ListLogStores",
        "log:PostLogStoreLogs",
        "log:GetCursorOrData",
        "log:GetLogStoreLogs"
      ],
      "Resource": "acs:log:*:*:project/*"
    }
  ]
}

In the sample policy, Resource is set to acs:log:*:*:project/*, which covers all projects under the current Alibaba Cloud account. To narrow the permission scope, replace this value with a specific project or LogStore by using the same notation as the Resources parameter earlier in this procedure.

Related operations

Applying a common policy template

The Permission Assistant tab provides common policy templates. Select a template that fits your needs.
Applying a custom policy template

On the Permission Assistant tab, save a custom policy as a template for reuse.

Note
Custom templates are stored in your browser's local storage and cannot be accessed from other browsers.