OSS data shipping requires both operation permissions and data access permissions.
-
If you use an Alibaba Cloud account, you must grant the OSS data shipping job data access permissions.
-
If you use a Resource Access Management (RAM) user, you must grant both operation permissions to the RAM user and data access permissions to the OSS data shipping job.
ImportantTo ensure the security of your cloud resources, we recommend that you use a RAM user.
Operation permissions for OSS data shipping
Operation permissions include creating, deleting, modifying, and viewing OSS data shipping jobs.
-
Alibaba Cloud account: An Alibaba Cloud account has AliyunLogFullAccess management permissions for Simple Log Service. No additional operation permissions are required.
-
(Recommended) RAM user: To use a RAM user for OSS data shipping, use an Alibaba Cloud account to grant the required operation permissions to the RAM user. For more information, see Grant a RAM user operation permissions for OSS data shipping.
Data access authorization for an OSS data shipping job
An OSS data shipping job needs permissions to read data from a source Logstore and write data to a destination OSS bucket. You can grant these permissions by using a default role or a custom role.
-
Default role: Grant the OSS data shipping job the Alibaba Cloud system role AliyunLogDefaultRole to read data from the source Logstore and write data to the destination OSS bucket.
AliyunLogDefaultRole has permissions to read data from Logstores and write data to OSS buckets. For more information, see Access data using a default role.
-
Custom role: Grant the OSS data shipping job a custom role to read data from the source Logstore and write data to the destination OSS bucket.
Use an Alibaba Cloud account to grant the custom role permissions to read data from the Logstore and write data to the OSS bucket. For more information, see Access data within an Alibaba Cloud account using a custom RAM role and Access data across Alibaba Cloud accounts using a custom RAM role.