Simple Log Service:Grant a RAM user permissions to manage alerts

Method 1: Grant a system policy

Attach the AliyunLogReadOnlyAccess system policy to the RAM user to grant read-only permissions for alerts. For more information, see Manage the permissions of a RAM user.

Method 2: Create and grant a custom policy

1. Log on to the RAM console by using your Alibaba Cloud account or a RAM user who has administrative rights.

2. Create a custom policy. On the JSON tab of the Create Policy page, replace the existing script in the code editor with the following policy document. For more information, see Using the script editor.

   Important

   • your_project_name: The project that contains the alert data you want to grant read-only access to. Replace this placeholder with your actual project name.

   • sls-alert-*: Matches all global alerting center projects in the current Alibaba Cloud account. These projects store evaluation data for all alert rules, sent logs, and global alert reports. If you do not need to view global reports, remove acs:log:*:*:project/sls-alert-*/* from the resource list.

   {
     "Version": "1",
     "Statement": [
       {
         "Effect": "Allow",
         "Action": [
           "log:GetLogStore"
         ],
         "Resource": [
           "acs:log:*:*:project/your_project_name/logstore/internal-alert-history",
           "acs:log:*:*:project/sls-alert-*/logstore/internal-alert-center-log"
         ]
       },
       {
         "Effect": "Allow",
         "Action": [
           "log:GetJob",
           "log:ListJobs"
         ],
         "Resource": "acs:log:*:*:project/your_project_name/job/*"
       },
       {
         "Effect": "Allow",
         "Action": [
           "log:GetProject"
         ],
         "Resource": [
           "acs:log:*:*:project/sls-alert-*"
         ]
       },
       {
         "Effect": "Allow",
         "Action": [
           "log:GetLogStoreLogs",
           "log:ListLogStores",
           "log:GetIndex",
           "log:GetDashboard",
           "log:ListDashboard"
         ],
         "Resource": [
           "acs:log:*:*:project/your_project_name/*",
           "acs:log:*:*:project/sls-alert-*/*"
         ]
       },
       {
         "Effect": "Allow",
         "Action": [
           "log:GetResource",
           "log:ListResources",
           "log:GetResourceRecord",
           "log:ListResourceRecords"
         ],
         "Resource": [
           "acs:log:*:*:resource/*"
         ]
       }
     ]
   }

3. Attach the created custom policy to the RAM user. For more information, see Manage RAM user permissions.

Method 1: Grant a system policy

Attach the AliyunLogFullAccess system policy to the RAM user to grant full management permissions for Simple Log Service. For more information, see Manage the permissions of a RAM user.

Method 2: Create and grant a custom policy

1. Log on to the RAM console by using your Alibaba Cloud account or a RAM user who has administrative rights.

2. Create a custom policy. On the JSON tab of the Create Policy page, replace the existing script in the code editor with the following policy document. For more information, see Using the script editor.

   Important

   • your_project_name: The project that contains the alert data that you want to manage. Replace this placeholder with your actual project name.

   • sls-alert-*: Matches all global alerting center projects in the current Alibaba Cloud account. These projects store evaluation data for all alert rules, sent logs, and global alert reports. To grant permissions for only a single global alerting center project, replace sls-alert-* with the project name in the sls-alert-${uid}-${region} format. Example: sls-alert-148****6461-cn-hangzhou.

   • The policy includes permissions to create Logstores, create indexes, and update indexes. These permissions allow the RAM user to manage alert-related system Logstores, such as the alert history Logstore and the global alerting center Logstore. This access is required to view reports such as the alert history report.

   {
     "Version": "1",
     "Statement": [
       {
         "Effect": "Allow",
         "Action": [
           "log:GetLogStore",
           "log:UpdateLogStore",
           "log:CreateLogStore",
           "log:CreateIndex",
           "log:UpdateIndex"
         ],
         "Resource": [
           "acs:log:*:*:project/your_project_name/logstore/internal-alert-history",
           "acs:log:*:*:project/sls-alert-*/logstore/internal-alert-center-log"
         ]
       },
       {
         "Effect": "Allow",
         "Action": [
           "log:*"
         ],
         "Resource": "acs:log:*:*:project/your_project_name/job/*"
       },
       {
         "Effect": "Allow",
         "Action": [
           "log:GetProject",
           "log:CreateProject"
         ],
         "Resource": [
           "acs:log:*:*:project/sls-alert-*"
         ]
       },
       {
         "Effect": "Allow",
         "Action": [
           "log:GetLogStoreLogs",
           "log:ListLogStores",
           "log:GetIndex",
           "log:GetDashboard",
           "log:CreateDashboard",
           "log:UpdateDashboard",
           "log:ListDashboard"
         ],
         "Resource": [
           "acs:log:*:*:project/your_project_name/*",
           "acs:log:*:*:project/sls-alert-*/*"
         ]
       },
       {
         "Effect": "Allow",
         "Action": [
           "log:*"
         ],
         "Resource": [
           "acs:log:*:*:resource/*"
         ]
       }
     ]
   }

3. Attach the created custom policy to the RAM user. For more information, see Manage RAM user permissions.