Ship data cross-account to OSS with custom RAM roles - Simple Log Service

If your Simple Log Service is in Alibaba Cloud Account A and your Object Storage Service (OSS) is in Alibaba Cloud Account B, you can ship data from a Logstore to an Simple Log Service. Grant the required permissions by using a Simple Log Service.

Step 1: Grant read permissions in Account A

Grant read permissions to a RAM role named role-a in Account A. The data shipping task assumes this role to read Logstore data.

Log on to the RAM console by using Alibaba Cloud Account A.
Create a custom policy to grant Logstore read permissions.
Grant permissions by exact match or wildcard match.
Exact match
Important
Replace Project name and Logstore name in the policy document based on your business requirements.
"Version":"1", "Statement":[ { "Action":[ "log:GetCursorOrData", "log:ListShards" ], "Resource":[ "acs:log:*:*:project/your-project-name/logstore/your-Logstore-name" ], "Effect":"Allow" } ] }
Wildcard match
Important
For example, use a wildcard match to grant permissions to multiple projects and Logstores at once, such as projects named log-project-dev-* and Logstores named website_*_log.
Replace log-project-dev-* and website_*_log* in the policy with your project and Logstore name patterns.
```
{
    "Version":"1",
    "Statement":[
        {
            "Action":[
                "log:GetCursorOrData",
                "log:ListShards"
            ],
            "Resource":[
                "acs:log:*:*:project/log-project-dev-*/logstore/website_*_log*"
            ],
            "Effect":"Allow"
        }
    ]
}
```
Create a RAM role named role-a. For more information, see Create a RAM role for a trusted Alibaba Cloud service.
Important
- When creating a RAM role, set Principal Type to Cloud Service, and Principal Name to Simple Log Service.
- Check the trust policy of the RAM role. Make sure that the Service element contains at least "log.aliyuncs.com".
```
{
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Effect": "Allow",
      "Principal": {
        "Service": [
          "log.aliyuncs.com"
        ]
      }
    }
  ],
  "Version": "1"
}
```
Attach the custom policy that you created to the role-a RAM role. For more information, see Grant permissions to a RAM role.

Next steps

Obtain the Alibaba Cloud Resource Name (ARN) of the RAM role. For more information, see View a RAM role.

When you create an OSS data shipping task, select Custom Role for Read Logstore RAM Role and enter this ARN.

Step 2: Grant write permissions in Account B

Grant write permissions to a RAM role named role-b in Account B. The data shipping task assumes this role to write to the OSS bucket.

Log on to the RAM console by using Alibaba Cloud Account B.

Create a custom policy to grant OSS bucket write permissions.

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "oss:PutObject"
            ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

Create a RAM role named role-b. For more information, see Create a RAM role for a trusted Alibaba Cloud service.
Important
- When creating a RAM role, set Principal Type to Cloud Service, and Principal Name to Simple Log Service.
- Check the trust policy of the RAM role. Make sure that the Service element contains at least "log.aliyuncs.com".
```
{
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Effect": "Allow",
      "Principal": {
        "Service": [
          "log.aliyuncs.com"
        ]
      }
    }
  ],
  "Version": "1"
}
```
Modify the trust policy of the role-b RAM role. Modify the trust policy of a RAM role.
Important
In the Service principal, add <ID of Alibaba Cloud Account A>@log.aliyuncs.com. Replace <ID of Alibaba Cloud Account A> with your account ID from the Account Center.
This policy allows SLS in Account A to assume this role and access Account B resources.
```
{
    "Statement": [
        {
            "Action": "sts:AssumeRole",
            "Effect": "Allow",
            "Principal": {
                "Service": [
                    "log.aliyuncs.com",
                    "@log.aliyuncs.com"
                ]
            }
        }
    ],
    "Version": "1"
}
```
Attach the custom policy that you created to the role-b RAM role. For more information, see Grant permissions to a RAM role.

Next steps

Obtain the Alibaba Cloud Resource Name (ARN) of the RAM role. For more information, see View a RAM role.

When you create an OSS data shipping task, select Custom Role for Write to OSS RAM Role and enter this ARN.

Step 1: Grant read permissions in Account A

Exact match

Wildcard match

Next steps

Step 2: Grant write permissions in Account B

Next steps