All Products
Search

This Product

    Simple Log Service:Authorization

    Document Center

    Simple Log Service:Authorization

    Last Updated:Jun 16, 2026

    The data transformation feature requires permissions for both data transformation operations and data access.

    • If you use an Alibaba Cloud account, you can directly grant data access permissions to the data transformation job.

      Important

      To ensure the security of your cloud resources, use a Resource Access Management (RAM) user.

    • If you use a RAM user, you must grant permissions for data transformation operations and grant data access permissions to the data transformation job.

    Permissions for data transformation operations

    Data transformation operations include creating, deleting, modifying, and viewing data transformation jobs, and previewing transformation results in the console.

    • Alibaba Cloud account: An Alibaba Cloud account has service-managed permissions for Simple Log Service (AliyunLogFullAccess). No additional permissions are required for data transformation operations.

    • (Recommended) RAM user: Before using a RAM user for data transformation, use an Alibaba Cloud account to grant the RAM user data transformation operation permissions. For more information, see Grant a RAM user permissions to manage data transformation jobs.

    Data access permissions for data transformation jobs

    A data transformation job has three steps. Steps 1 and 3 involve data access: the job reads data from the source Logstore and writes transformation results to the destination Logstore.

    1. Read data from the source Logstore.

    2. Transform the source data to generate the result data.

    3. Write the transformation results to the destination Logstore.

    You can grant data access permissions by using a default role or a custom role:

    • Default role: Grants the data transformation job permission to use the Alibaba Cloud system role AliyunLogETLRole to read data from the source Logstore and write transformation results to the destination Logstore. For more information, see Access data using a default role.

      The AliyunLogETLRole system role has data access permissions for Logstores.

    • Custom role: Grants the data transformation job permission to use a custom role to read data from the source Logstore and write transformation results to the destination Logstore. For more information, see Access data using a custom role.

      You must use an Alibaba Cloud account to grant the custom role data access permissions for Logstores.