A data shipping job of the new version reads data from a Logstore and writes the data to OSS across Alibaba Cloud accounts by using a custom RAM role - Simple Log Service

Assume that Simple Log Service belongs to Alibaba Cloud Account A and Object Storage Service (OSS) belongs to Alibaba Cloud Account B. To ship data from a Simple Log Service Logstore to an OSS bucket, authorize an OSS data shipping job of the new version to assume a custom Resource Access Management (RAM) role.

Step 1: Grant the `role-a` RAM role the permissions to read data from a Logstore

After you grant a RAM role named role-a of Alibaba Cloud Account A the permissions to read data from a Logstore, an OSS data shipping job can assume the role to read data from the Logstore.

Log on to the RAM console by using Alibaba Cloud Account A.
Create a custom policy that grants the permissions to read data from a Logstore.

Select a policy document that uses exact match or fuzzy match for authorization.
Exact match for authorization
On the Create Policy page, click the JSON tab. Replace the existing contents in the editor with the following script. For more information, see Create a custom policy.

Important
Replace Project name and Logstore name in the policy document based on your business requirements.
```
{
    "Version":"1",
    "Statement":[
        {
            "Action":[
                "log:GetCursorOrData",
                "log:ListShards"
            ],
            "Resource":[
                "acs:log:*:*:project/Project name/logstore/Logstore name"
            ],
            "Effect":"Allow"
        }
    ]
}
```
Fuzzy match for authorization
On the Create Policy page, click the JSON tab. Replace the existing contents in the editor with the following script. For more information, see Create a custom policy.
Important

In this example, the names of the projects are log-project-dev-a, log-project-dev-b, and log-project-dev-c, and the names of the Logstores are website_a_log, website_b_log, and website_c_log.

Replace log-project-dev-* and website_*_log* in the policy document based on your business requirements.
```
{
    "Version":"1",
    "Statement":[
        {
            "Action":[
                "log:GetCursorOrData",
                "log:ListShards"
            ],
            "Resource":[
                "acs:log:*:*:project/log-project-dev-*/logstore/website_*_log*"
            ],
            "Effect":"Allow"
        }
    ]
}
```
Create a RAM role named role-a. For more information, see Create a RAM role for a trusted Alibaba Cloud service.
Important
- When creating a RAM role, set Principal Type to Cloud Service, and Principal Name to Simple Log Service.
- Check the trust policy of the RAM role. Make sure that the Service element contains at least "log.aliyuncs.com".
```
{
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Effect": "Allow",
      "Principal": {
        "Service": [
          "log.aliyuncs.com"
        ]
      }
    }
  ],
  "Version": "1"
}
```
Attach the created custom policy to the role-a RAM role. For more information, see Manage a RAM role's permissions.

Next steps

Obtain the Alibaba Cloud Resource Name (ARN) of the RAM role. For more information, see View RAM role details.

If you set the Logstore Read RAM Role parameter to Custom Role when you create an OSS data shipping job, you must enter the Alibaba Cloud Resource Name (ARN) of the role. For more information, see Create an OSS data shipping job (new version). ARN

Step 2: Grant the role-b RAM role the permissions to write data to an OSS bucket

After you grant a RAM role named role-b of Alibaba Cloud Account B the permissions to write data to an OSS bucket, an OSS data shipping job can assume the role to write data that is read from the Logstore in Alibaba Cloud Account A to the OSS bucket.

Log on to the RAM console by using Alibaba Cloud Account B.
Create a custom policy that grants the permissions to write data to an OSS bucket.

On the Create Policy page, click the JSON tab. Replace the existing contents in the editor with the following script. For more information, see Create a custom policy.
```
{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "oss:PutObject"
            ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}
```
Note
To implement finer-grained access control on OSS resources, configure a policy based on RAM Policy.
Create a RAM role named role-b. For more information, see Create a RAM role for a trusted Alibaba Cloud service.
Important
- When creating a RAM role, set Principal Type to Cloud Service, and Principal Name to Simple Log Service.
- Check the trust policy of the RAM role. Make sure that the Service element contains at least "log.aliyuncs.com".
```
{
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Effect": "Allow",
      "Principal": {
        "Service": [
          "log.aliyuncs.com"
        ]
      }
    }
  ],
  "Version": "1"
}
```
Modify the trust policy of the role-b RAM role. For more information, see Modify a RAM role's trust policy.

Important
Add ID of Alibaba Cloud Account A@log.aliyuncs.com to the Service element. Replace the ID of Alibaba Cloud Account A with the actual ID. View the ID of your Alibaba Cloud account in the Account Center console.

The following policy allows Alibaba Cloud Account A to obtain a Security Token Service (STS) token to manage the cloud resources of Alibaba Cloud Account B.
```
{
    "Statement": [
        {
            "Action": "sts:AssumeRole",
            "Effect": "Allow",
            "Principal": {
                "Service": [
                    "log.aliyuncs.com",
                    "ID of Alibaba Cloud Account A@log.aliyuncs.com"
                ]
            }
        }
    ],
    "Version": "1"
}
```
Attach the created custom policy to the role-b RAM role. For more information, see Manage a RAM role's permissions.

Next steps

Obtain the Alibaba Cloud Resource Name (ARN) of the RAM role. For more information, see View RAM role details.

If you set the OSS Write RAM Role parameter to Custom Role when you create an OSS data shipping job, you must enter the ARN of the role. For more information, see Create an OSS data shipping job (new version).

ARN

Step 1: Grant the role-a RAM role the permissions to read data from a Logstore

Exact match for authorization

Fuzzy match for authorization

Next steps

Step 2: Grant the role-b RAM role the permissions to write data to an OSS bucket

Next steps

Step 1: Grant the `role-a` RAM role the permissions to read data from a Logstore