All Products
Search

This Product

    Simple Log Service:Access data with a custom role (same account)

    Document Center

    Simple Log Service:Access data with a custom role (same account)

    Last Updated:Sep 11, 2026

    An OSS data shipping job (new version) reads data from a Logstore and ships it to an OSS bucket. Grant the required permissions to a custom role so that it can perform these operations.

    Prerequisites

    A RAM role is required. For details, see Create a RAM role for a trusted Alibaba Cloud service.

    Important

    • When creating a RAM role, set Principal Type to Cloud Service, and Principal Name to Simple Log Service.

    • Check the trust policy of the RAM role. Make sure that the Service element contains at least "log.aliyuncs.com". 

      {
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Effect": "Allow",
      "Principal": {
        "Service": [
          "log.aliyuncs.com"
        ]
      }
    }
  ],
  "Version": "1"
}

    Step 1: Grant read permissions for a Logstore

    These permissions allow the OSS data shipping job to assume the RAM role and read data from the Logstore.

    1. Log on to the RAM console by using your Alibaba Cloud account or a RAM user who has administrative rights.

    2. Create a custom policy to grant Logstore read permissions.

      Grant permissions by exact match or wildcard match.

      Exact match

      Important

      Replace Project name and Logstore name in the policy document based on your business requirements.

      "Version":"1", "Statement":[ { "Action":[ "log:GetCursorOrData", "log:ListShards" ], "Resource":[ "acs:log:*:*:project/your-project-name/logstore/your-Logstore-name" ], "Effect":"Allow" } ] }

      Wildcard match

      Important

      • For example, use a wildcard match to grant permissions to multiple projects and Logstores at once, such as projects named log-project-dev-* and Logstores named website_*_log.

      • Replace log-project-dev-* and website_*_log* in the policy with your project and Logstore name patterns.

      {
    "Version":"1",
    "Statement":[
        {
            "Action":[
                "log:GetCursorOrData",
                "log:ListShards"
            ],
            "Resource":[
                "acs:log:*:*:project/log-project-dev-*/logstore/website_*_log*"
            ],
            "Effect":"Allow"
        }
    ]
}

    3. Attach the created custom policy to the RAM role. For more information, see Manage permissions for a RAM role.

    Step 2: Grant write permissions for an OSS bucket

    These permissions allow the OSS data shipping job to assume the RAM role and write data from the Logstore to the OSS bucket.

    1. Log on to the RAM console by using your Alibaba Cloud account or a RAM user who has administrative rights.

    2. Create a custom policy to grant OSS bucket write permissions.

      {
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "oss:PutObject"
            ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

    3. Attach the created custom policy to the RAM role. For more information, see Manage permissions for a RAM role.

    What to do next

    Obtain the Alibaba Cloud Resource Name (ARN) of the RAM role. For more information, see View a RAM role.

    When creating an OSS data shipping job, you must provide the role's ARN if you select Custom Role for the Logstore Read RAM Role or OSS Write RAM Role. For more information, see Create an OSS data shipping job (new version).