Grant a RAM user permissions for ActionTrail

Grant a RAM user permissions to manage ActionTrail by attaching a system policy or a custom policy.

Prerequisites

You have created a RAM user. For more information, see Create a RAM user.

Background

You can grant a RAM user permissions to manage the ActionTrail console in the following ways:

System policy: An unmodifiable policy that Alibaba Cloud creates and maintains. You can only attach it to or detach it from a RAM user. This method is simple.
Custom policy: A policy that you create and maintain. This method provides more granular control and security, but is more complex to configure.

System policy

Log on to the RAM console and attach the AliyunLogFullAccess and AliyunRAMFullAccess system policies to the RAM user. These policies grant full management permissions. For more information, see Manage the permissions of a RAM user.

Custom policy

Log on to the RAM console.

Create a policy.

In the left-side navigation pane, choose Permission Management > Policy.
Click Create Policy.

On the Create Policy page, on the JSON tab, paste one of the following policies into the editor, replacing the existing script. Then, click Continue to edit basic information.

Select one of the following policies based on the permission level you want to grant:

Read-only permissions (Grants permissions to view ActionTrail pages but not to modify configurations.)

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "log:GetApp"
            ],
            "Resource": [
                "acs:log:*:*:app/audit"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "log:Get*",
                "log:List*"
            ],
            "Resource": [
                "acs:log:*:*:project/slsaudit-*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "log:GetProductDataCollection"
            ],
            "Resource": "acs:config:*:*:*"
        }
    ]
}

Read and write permissions (Grants permissions to perform all operations in ActionTrail, including modifying global configurations.)

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "log:GetApp",
                "log:CreateApp"
            ],
            "Resource": [
                "acs:log:*:*:app/audit"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "log:Get*",
                "log:List*",
                "log:CreateJob",
                "log:UpdateJob",
                "log:CreateProject"
            ],
            "Resource": [
                "acs:log:*:*:project/slsaudit-*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "log:GetProductDataCollection",
                "log:OpenProductDataCollection"
            ],
            "Resource": "acs:config:*:*:*"
        }
    ]
}

Enter a Name for the policy and click OK.

For example, set the policy name to log-slsaudit-policy.

Attach the policy to the RAM user.
1. In the left-side navigation pane, choose Identities > > > Users.
2. Find the target RAM user and click Add Permissions.
3. In the Create Authorization panel, in the Policy section, select Custom Policy from the drop-down list. Then, select the policy that you created in Step 2 and click OK.