Create custom RAM policies for SLS when system policies don't meet your needs. Custom policies enable fine-grained permission control and improve resource access security, following the principle of least privilege.
What is a custom policy?
Resource Access Management (RAM) policies are classified into system policies and custom policies. You can manage custom policies based on your business requirements.
After you create a custom policy, you must attach the policy to a RAM user, RAM user group, or RAM role. This way, the permissions that are specified in the policy can be granted to the principal.
You can delete a RAM policy that is not attached to a principal. If the RAM policy is attached to a principal, before you can delete the RAM policy you must detach the RAM policy from the principal.
Custom policies support version control. You can manage custom policy versions based on the version management mechanism provided by RAM.
References
Sample policies
App-level permissions
log:GetApp is an App-level read action that corresponds to the DescribeApp OpenAPI operation. Grant this action to let a RAM user read the information of a specified application (App).
The Resource format is acs:log:*:{accountId}:app/{appName}, where {accountId} is the Alibaba Cloud account ID and {appName} is the name of the App. Specify an exact App name, or use an asterisk (*) for a fuzzy match.
The following access policy grants this permission:
{
"Version": "1",
"Statement": [
{
"Action": [
"log:GetApp"
],
"Resource": [
"acs:log:*:{accountId}:app/{appName}"
],
"Effect": "Allow"
}
]
}Before you begin
Before creating a custom policy, understand your requirements and SLS authorization. For more information, see RAM authorization.
Permissions such as ListStoreViews and GetApp are auxiliary permissions of Simple Log Service. Their authorization status, including missing or ineffective authorization, does not affect core log query and viewing capabilities. If a Resource Access Management (RAM) user sees an insufficient-permission message in the console, the user can still view and query log data in the authorized projects and LogStores.