Simple Log Service:Authorize a RAM role to read Logstore data

Authorize the default role

Procedure

1. Log on to the Alibaba Cloud Management Console using your Alibaba Cloud account or a RAM user.

2. Click Resource Access Authorization to complete the authorization.

   Note

   • If the Alibaba Cloud account does not have the default role AliyunLogDefaultRole, the role is created the first time the RAM user clicks the link.

   • Simple Log Service assumes the AliyunLogDefaultRole role to access your resources in other cloud products.

   • For details about the access policy of AliyunLogDefaultRole, see AliyunLogDefaultRole.

Authorize a custom role

Procedure

Authorizing a RAM role allows a MaxCompute shipping task to use that role to read data from the logstore.

1. Log on to the RAM console using your Alibaba Cloud account or as a RAM administrator.

2. Create a RAM role to be assumed by the Alibaba Cloud service. For more information, see Create a RAM role for Alibaba Cloud services.

   Important

   • When creating a RAM role, set Principal Type to Cloud Service, and Principal Name to Simple Log Service.

   • Check the trust policy of the RAM role. Make sure that the Service element contains at least "log.aliyuncs.com".

     {
       "Statement": [
         {
           "Action": "sts:AssumeRole",
           "Effect": "Allow",
           "Principal": {
             "Service": [
               "log.aliyuncs.com"
             ]
           }
         }
       ],
       "Version": "1"
     }

3. Create a custom policy to grant Logstore read permissions.

   Grant permissions by exact match or wildcard match.

   Exact match

   Important

   Replace Project name and Logstore name in the policy document based on your business requirements.

   "Version":"1", "Statement":[ { "Action":[ "log:GetCursorOrData", "log:ListShards" ], "Resource":[ "acs:log:*:*:project/your-project-name/logstore/your-Logstore-name" ], "Effect":"Allow" } ] }

   Wildcard match

   Important

   • For example, use a wildcard match to grant permissions to multiple projects and Logstores at once, such as projects named log-project-dev-* and Logstores named website_*_log.

   • Replace log-project-dev-* and website_*_log* in the policy with your project and Logstore name patterns.

   {
       "Version":"1",
       "Statement":[
           {
               "Action":[
                   "log:GetCursorOrData",
                   "log:ListShards"
               ],
               "Resource":[
                   "acs:log:*:*:project/log-project-dev-*/logstore/website_*_log*"
               ],
               "Effect":"Allow"
           }
       ]
   }

4. Attach the created custom policy to the RAM role. For more information, see Manage permissions for a RAM role.