Resource types that can be authorized to RAM users - Simple Log Service

Simple Log Service allows an Alibaba Cloud account to grant a RAM user permissions on specific resources. This topic describes the resource types that can be authorized to a RAM user.

The following table describes the resource types that can be authorized to RAM users and their resource expressions.

Resource type	Resource expressions in a permission policy
Project and Logstore	`acs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/logstore/${logstoreName}`
Project, Logstore, and Shipper (deprecated)	`acs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/logstore/${logstoreName}/shipper/${shipperName}` (deprecated)
Project, Logstore, and Shipper (deprecated)	`acs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/logstore/*`
Project and Config	`acs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/logtailconfig/${logtailConfigName}`
Project and Config	`acs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/logtailconfig/*`
Project and MachineGroup	`acs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/machinegroup/${machineGroupName}`
Project and MachineGroup	`acs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/machinegroup/*`
Project and ConsumerGroup	`acs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/logstore/${logstoreName}/consumergroup/${consumerGroupName}`
Project and ConsumerGroup	`acs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/logstore/${logstoreName}/consumergroup/*`
Project and SavedSearch	`acs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/savedsearch/${savedSearchName}`
Project and SavedSearch	`acs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/savedsearch/*`
Project and Dashboard	`acs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/dashboard/${dashboardName}`
Project and Dashboard	`acs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/dashboard/*`
Project and Alarm	`acs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/alert/${alarmName}`
Project and Alarm	`acs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/alert/*`
General pattern	`acs:log:${regionName}:${projectOwnerAliUid}:*`
General pattern	`acs:log::${projectOwnerAliUid}:`

Note

Simple Log Service resources are hierarchical. A project is the root resource. Logstores, Logtail configurations, and machine groups are peer sub-resources of a project. Shippers (deprecated) and consumer groups are sub-resources of a Logstore.

The following table describes the parameters in resource expressions:

Parameter	Description
`${regionName}`	The name of a region.
`${projectOwnerAliUid}`	The ID of an Alibaba Cloud account.
`${projectName}`	The name of a project.
`${logstoreName}`	The name of a Logstore.
`${logtailconfig}`	The name of a Logtail configuration.
`${machineGroupName}`	The name of a machine group.
`${shipperName}` (deprecated)	The name of a log shipping rule.
`${consumerGroupName}`	The name of a consumer group.
`${savedSearchName}`	The name of a saved search.
`${dashboardName}`	The name of a dashboard.
`${alarmName}`	The name of an alert rule.