Simple Log Service:Authorize a RAM user to ship data to OSS

Procedure

1. Log on to the RAM console by using your Alibaba Cloud account or a RAM user who has administrative rights.

2. Create a custom policy. On the JSON tab of the Create Policy page, replace the existing script in the code editor with the following policy document. For more information, see Using the script editor.

   Important

   • Replace ProjectName and LogstoreName in the script based on your actual project and Logstore names.

   • If you want to use a RAM user to configure alerts for OSS data shipping jobs, you must authorize the RAM user to manage alerts. For more information, see Grant a RAM user permissions to manage alerts.

   {
     "Version": "1",
     "Statement": [{
       "Effect": "Allow",
       "Action": [
         "log:GetLogStore",
         "log:GetIndex",
         "log:GetLogStoreHistogram",
         "log:GetLogStoreLogs"
       ],
       "Resource": [
         "acs:log:*:*:project/ProjectName/logstore/LogstoreName",
         "acs:log:*:*:project/ProjectName/logstore/internal-diagnostic_log"
       ]
     },
       {
         "Effect": "Allow",
         "Action": [
           "log:CreateOSSExport",
           "log:UpdateOSSExport",
           "log:DeleteOSSExport",
           "log:ListOSSExports",
           "log:GetOSSExport"
         ],
         "Resource": "acs:log:*:*:project/ProjectName/ossexport/*"
       },
       {
         "Effect": "Allow",
         "Action": [
           "log:ListLogStores",
           "log:ListDashboard",
           "log:ListSavedSearch"
         ],
         "Resource": "acs:log:*:*:project/ProjectName/*"
       },
       {
         "Effect": "Allow",
         "Action": [
           "ram:PassRole",
           "ram:GetRole",
           "ram:ListRoles"
         ],
         "Resource": "*"
       }
     ]
   }

3. Attach the custom policy created in Step 2 to the RAM user. For more information, see Manage RAM user permissions.