Server Load Balancer:Authorize a RAM user for CLB access logs

Create a policy

This section describes how to create a custom policy on the JSON tab. For instructions on using the Visual editor tab, see Create a custom policy.

1. Log on to the RAM console as a RAM administrator.

2. In the left-side navigation pane, choose Permissions > Policies.

3. On the Policies page, click Create Policy.

4. On the Create Policy page, click the JSON Editor tab.

5. Enter the policy document and click OK.

   {
     "Statement": [
      {
        "Action": [
          "slb:Create*",
          "slb:List*"
        ],
        "Effect": "Allow",
        "Resource": "acs:log:*:*:project/*"
      },
      {
        "Action": [
          "log:Create*",
          "log:List*"
        ],
        "Effect": "Allow",
        "Resource": "acs:log:*:*:project/*"
      },
      {
        "Action": [
          "log:Create*",
          "log:List*",
          "log:Get*",
          "log:Update*"
        ],
        "Effect": "Allow",
        "Resource": "acs:log:*:*:project/*/logstore/*"
      },
      {
        "Action": [
          "log:Create*",
          "log:List*",
          "log:Get*",
          "log:Update*"
        ],
        "Effect": "Allow",
        "Resource": "acs:log:*:*:project/*/dashboard/*"
      },
      {
        "Action": "cms:QueryMetric*",
        "Resource": "*",
        "Effect": "Allow"
      },
      {
        "Action": [
          "slb:Describe*",
          "slb:DeleteAccessLogsDownloadAttribute",
          "slb:SetAccessLogsDownloadAttribute",
          "slb:DescribeAccessLogsDownloadAttribute"
        ],
        "Resource": "*",
        "Effect": "Allow"
      },
      {
        "Action": [
          "ram:Get*",
          "ram:ListRoles"
        ],
        "Effect": "Allow",
        "Resource": "*"
      }
     ],
     "Version": "1"
   }

6. In the Create Policy dialog box, enter a Policy Name and Description, and then click OK.

Attach the policy to a RAM user

1. Log on to the RAM console as a RAM administrator.

2. In the left-side navigation pane, choose Permissions > Grants.

3. On the Permission page, click Grant Permission.

   1. Select a resource scope.

      • Account: The permissions take effect within the current Alibaba Cloud account.

      • Resource Group: The permissions take effect only within the specified resource group.

        Note

        This option requires that the cloud service and resource type both support resource groups. For more information, see Cloud services that support resource groups.

   2. Select a principal.

      A principal is the RAM user who receives the permissions. You can select multiple RAM users.

   3. Select policies.

      A policy is a set of permissions. You can select multiple policies.

      • System Policy: Alibaba Cloud creates and maintains system policies. You can use system policies, but you cannot modify them. For more information, see Cloud services that support RAM (see the Cloud Service and System Policy columns).

        Note

        The system automatically flags high-risk system policies, such as AdministratorAccess and AliyunRAMFullAccess. Avoid granting these high-risk policies unless they are absolutely required.

      • Custom Policy: You can create, maintain, update, and delete custom policies. For more information about how to create a custom policy, see Create a custom policy.

   4. Click OK.

4. Click Close. Return to the Permission page to verify that the policy is attached to the user. The RAM user can now use CLB access logs.