All Products
Search

This Product

    Simple Log Service:Authentication rules

    Document Center

    Simple Log Service:Authentication rules

    Last Updated:Oct 10, 2026

    Simple Log Service supports Resource Access Management (RAM) user and role authorization, tag-based authentication, and cross-service authorization through access policies. This reference lists the supported actions and resources for fine-grained permission control.

    Permission policies

    A permission policy is a collection of permissions described by a syntax structure. It precisely defines the resources, operations, and conditions to which permissions apply. For information about the basic policy elements and syntax supported by RAM, see Permission policy elements and Policy syntax and structure.

    RAM supports the following types of permission policies:

    • System policies managed by Alibaba Cloud: Alibaba Cloud creates and maintains the policy versions. You can use but cannot modify these policies.

    • Custom policies managed by users: You can create, update, and delete these policies and maintain their versions.

    Attach permission policies to RAM identities to grant the permissions specified in the policies. For more information, see Manage permissions for a RAM user, Grant permissions to a RAM user group, and Manage permissions for a RAM role.

    Basic elements of an access policy

    Access policy concepts and syntax are covered in Basic elements of an access policy.

    Element

    Description

    Effect

    Specifies whether the policy statement allows or denies access. Valid values are:

    • Allow: Allows access.

    • Deny: Denies access.

    Action/NotAction

    The operation performed on a specific resource. You must specify either Action or NotAction in a policy statement:

    • Action: The specific operation that is allowed or denied.

    • NotAction: The operations that are exempt from the policy. When you use NotAction, all operations are allowed or denied except for those listed.

    Resource

    The specific object or objects to which the policy applies.

    Condition

    The conditions under which the authorization takes effect.

    Principal

    The entity that is allowed or denied access to a resource. This element applies only to resource-based policies, such as the trust policy of a RAM role.

    Authorization flow

    1. Create an account administrator.

      An Alibaba Cloud account (root account) has unrestricted permissions on all resources. Sharing it prevents user-level audit trails and poses a high security risk. Do not use your root account for daily operations.

      Create a RAM user with AdministratorAccess permissions to serve as the account administrator. Use this administrator to create other RAM users with different permissions.

    2. Create a custom policy.

      RAM provides system policies (predefined by Alibaba Cloud, read-only) and custom policies. Create custom policies when system policies do not meet your authorization needs.

    3. Create and authorize a RAM user or RAM role:

      • Create and authorize a RAM user.

        Create RAM users and grant each one only the permissions they need.

        Assigning least privilege to each user avoids sharing root account credentials and reduces security risks.

      • Create and authorize a RAM user group.

        Use RAM user groups to classify and authorize RAM users with the same responsibilities for more efficient permission management.

      • Create and authorize a RAM role.

        A RAM role is a virtual identity with no permanent credentials. A trusted entity assumes the role and receives temporary credentials as a Security Token Service (STS) token to access authorized resources. Assume a RAM role.

    Action

    The action format is log:${API_Name}, where ${API_Name} is a Simple Log Service API name. All public APIs are listed in API overview.

    Separate multiple actions with commas (,) and use the asterisk (*) as a wildcard. For example, in log:Create*, Create* matches all API names starting with Create, such as CreateProduct, CreateThingModel, and CreateProductTopic.

    Important

    The GetCursor and GetCursorTime APIs correspond to the same action: log:GetCursorOrData.

    Resource

    Simple Log Service resources are hierarchical. A project is the root resource. Logstores, configs, and machine groups are peer sub-resources of a project. Shippers and consumer groups are sub-resources of a Logstore.

    Resource type

    Resource description in an authorization policy

    Project

    acs:log:${regionName}:${uid}:project/${projectName}

    acs:log:${regionName}:${uid}:project/*

    Project:Logstore

    acs:log:${regionName}:${uid}:project/${projectName}/logstore/${logstoreName}

    acs:log:${regionName}:${uid}:project/${projectName}/logstore/*

    Project:Logstore:Shipper (deprecated)

    acs:log:${regionName}:${uid}:project/${projectName}/logstore/${logstoreName}/shipper/${shipperName} (deprecated)

    acs:log:${regionName}:${uid}:project/${projectName}/logstore/${logstoreName}/shipper/* (deprecated)

    Project:Config

    acs:log:${regionName}:${uid}:project/${projectName}/logtailconfig/${logtailConfigName}

    acs:log:${regionName}:${uid}:project/${projectName}/logtailconfig/*

    Project:MachineGroup

    acs:log:${regionName}:${uid}:project/${projectName}/machinegroup/${machineGroupName}

    acs:log:${regionName}:${uid}:project/${projectName}/machinegroup/*

    Project:ConsumerGroup

    acs:log:${regionName}:${uid}:project/${projectName}/logstore/${logstoreName}/consumergroup/${consumerGroupName}

    acs:log:${regionName}:${uid}:project/${projectName}/logstore/${logstoreName}/consumergroup/*

    Project:SavedSearch

    acs:log:${regionName}:${uid}:project/${projectName}/savedsearch/${savedSearchName}

    acs:log:${regionName}:${uid}:project/${projectName}/savedsearch/*

    Project:Dashboard

    acs:log:${regionName}:${uid}:project/${projectName}/dashboard/${dashboardName}

    acs:log:${regionName}:${uid}:project/${projectName}/dashboard/*

    Project:Alarm

    acs:log:${regionName}:${uid}:project/${projectName}/alert/${alarmName}

    acs:log:${regionName}:${uid}:project/${projectName}/alert/*

    General pattern

    acs:log:${regionName}:${uid}:*

    acs:log:*:${uid}:*

    Parameter descriptions

    Parameter name

    Description

    ${regionName}

    The name of a region.

    ${uid}

    The ID of an Alibaba Cloud account.

    ${projectName}

    The name of the project.

    ${logstoreName}

    The name of the Logstore.

    ${logtailconfig}

    The name of the Logtail configuration.

    ${machineGroupName}

    The name of the machine group.

    ${shipperName} (deprecated)

    The name of the LogShipper rule.

    ${consumerGroupName}

    The name of the consumer group.

    ${savedSearchName}

    The name of the saved search.

    ${dashboardName}

    The name of the dashboard.

    ${alarmName}

    The name of the alert rule.