SLS RAM access control permissions - Simple Log Service - Alibaba Cloud Documentation Center

Use Resource Access Management (RAM) to grant different SLS permissions to different users. This topic lists the permissions required for each SLS feature.

Note

RAM users: request the required policy from the Alibaba Cloud account owner. Grant permissions to a RAM user.

System policies

SLS provides the following system policies, which Alibaba Cloud maintains and you cannot modify:

AliyunLogFullAccess: Grants full access to SLS.
AliyunLogReadOnlyAccess: Grants read-only access to SLS.

Custom policies

For fine-grained access control beyond system policies, create custom policies.

SLS provides the Permission Assistant to simplify custom policy creation.

Obtain a policy using the Permission Assistant

Log on to the Simple Log Service console and click the target project in the project list.
In the left-side navigation pane, choose Other > Permission Assistant.

On the Permission Assistant page, configure the following parameters and click Next.

Common Project: Includes permissions for all SLS functional modules.

Parameter	Description
Select Scenario	Select a preset scenario or customize by selecting specific modules. Each module supports management or read-only permission.
Resources	Apply permissions to specific resources. Use an asterisk (``) as a wildcard for project and Logstore names. For example: Access all SLS resources: `"Action": "log:", "Resource": "",` Access only the project01 project: `acs:log:::project/project01` `acs:log:::project/project01/` Access only the logstore01 Logstore in project01: `acs:log:::project/project01/logstore/logstore01` `acs:log:::project/project01/logstore/logstore01/*`
Limits	Configure conditions based on policy elements.

Application: Includes permissions for Cost Manager, Log Audit Service, and K8s Event Center.

Parameter	Description
Applications	Select applications and set each to Allow or Deny.
Select Scenario	When you set the permission for an application to Allow, related modules are auto-selected. You can customize the selection. Each module supports management or read-only permission.
Resources	Resources are auto-selected based on the application and cannot be modified.
Limits	Configure conditions based on policy elements.

Preview and copy the policy, then use it to create a custom policy.

The following table lists SLS operations and required permissions:

Operation type	Actions	Description
Read	log:GetAlert	Gets an alert rule.
Read	log:GetAppliedConfigs	Gets the applied Logtail configurations.
Read	log:GetAppliedMachineGroups	Gets the machine groups associated with a Logtail configuration.
Read	log:GetConfig	Gets a Logtail configuration.
Read	log:GetCursorOrData	Gets a cursor by time.
Read	log:GetDashboard	Gets a dashboard.
Read	log:GetETL	Gets a data transformation job.
Read	log:GetIndex	Gets an index.
Read	log:GetLogging	Gets the service log configuration.
Read	log:GetLogStore	Gets a Logstore.
Read	log:GetLogStoreLogs	Gets the monitoring logs of a Logstore.
Read	log:GetLogStoreMeteringMode	Gets the metering mode of a Logstore.
Read	log:GetLogtailPipelineConfig	Gets a Logtail pipeline configuration.
Read	log:GetMachineGroup	Gets a machine group.
Read	log:GetProject	Gets a Project.
Read	log:GetProjectPolicy	Gets the Project authorization policy.
Read	log:GetSavedSearch	Gets a saved search.
Read	log:GetScheduledSQL	Gets a scheduled SQL job.
Read	log:GetStoreView	Gets a dataset.
Read	log:GetStoreViewIndex	Gets the index configuration of a dataset.
Read	log:ListConsumerGroup	Lists consumer groups.
Read	log:ListDomains	Lists custom domain names.
Read	log:ListLogStores	Lists Logstores.
Read	log:ListMachineGroup	Lists machine groups in a Project.
Read	log:ListMachines	Lists the machines in a machine group.
Read	log:ListProject	Lists Projects.
Read	log:ListSavedSearch	Lists saved searches.
Read	log:ListShards	Lists shards.
Read	log:ListTagResources	Lists tags on resources.
Read	log:ListProjectsInRecycleBin	Lists Projects in the recycle bin.
Write	log::PutProjectTransferAcceleration	Configures transfer acceleration for a Project.
Write	log:ChangeResourceGroup	Changes the Resource Group of a resource.
Write	log:ConsumerGroupHeartBeat	Sends a heartbeat for a consumer group.
Write	log:ConsumerGroupUpdateCheckPoint	Updates a consumption checkpoint.
Write	log:CreateConfig	Creates a Logtail configuration.
Write	log:CreateConsumerGroup	Creates a consumer group.
Write	log:CreateDashboard	Creates a dashboard.
Write	log:CreateDomain	Creates a custom domain name.
Write	log:CreateIndex	Creates an index.
Write	log:CreateLogging	Creates a service log.
Write	log:CreateLogStore	Creates a Logstore.
Write	log:CreateLogtailPipelineConfig	Creates a Logtail pipeline configuration.
Write	log:CreateMachineGroup	Creates a machine group.
Write	log:CreateMetricStore	Creates a Metricstore.
Write	log:CreateProject	Creates a Project.
Write	log:CreateSavedSearch	Creates a saved search.
Write	log:CreateScheduledSQL	Creates a scheduled SQL job.
Write	log:CreateSqlInstance	Creates a dedicated SQL instance.
Write	log:CreateStoreView	Creates a dataset.
Write	log:DeleteAlert	Deletes an alert rule.
Write	log:DeleteConfig	Deletes a Logtail configuration.
Write	log:DeleteConsumerGroup	Deletes a consumer group.
Write	log:DeleteDashboard	Deletes a dashboard.
Write	log:DeleteDomain	Deletes a custom domain name.
Write	log:DeleteIndex	Deletes an index.
Write	log:DeleteLogStore	Deletes a Logstore.
Write	log:DeleteMachineGroup	Deletes a machine group.
Write	log:DeleteProject	Deletes a Project.
Write	log:DeleteProjectPolicy	Deletes the Project authorization policy.
Write	log:DeleteSavedSearch	Deletes a saved search.
Write	log:DeleteScheduledSQL	Deletes a scheduled SQL job.
Write	log:DeleteStoreView	Deletes a dataset.
Write	log:DisableAlert	Disables an alert rule.
Write	log:DisableScheduledSQL	Disables a scheduled SQL job.
Write	log:EnableAlert	Enables an alert rule.
Write	log:EnableScheduledSQL	Enables a scheduled SQL job.
Write	log:GetSqlInstance	Gets a dedicated SQL instance.
Write	log:ListScheduledSQLs	Lists scheduled SQL jobs.
Write	log:MergeShard	Merges shards.
Write	log:PostLogStoreLogs	Writes logs to a Logstore.
Write	log:PutProjectPolicy	Creates or updates a Project authorization policy.
Write	log:SplitShard	Splits a shard.
Write	log:TagResources	Adds tags to resources.
Write	log:UntagResources	Removes tags from resources.
Write	log:UpdateConfig	Updates a Logtail configuration.
Write	log:UpdateConsumerGroup	Updates a consumer group.
Write	log:UpdateDashboard	Updates a dashboard.
Write	log:UpdateIndex	Updates an index.
Write	log:UpdateLogging	Updates a service log configuration.
Write	log:UpdateLogStore	Updates a Logstore.
Write	log:UpdateLogStoreMeteringMode	Updates the metering mode of a Logstore.
Write	log:UpdateLogtailPipelineConfig	Updates a Logtail pipeline configuration.
Write	log:UpdateMachineGroup	Updates a machine group.
Write	log:UpdateMachineGroupMachine	Updates the list of machines in a machine group.
Write	log:UpdateProject	Updates a Project.
Write	log:UpdateSavedSearch	Updates a saved search.
Write	log:UpdateScheduledSQL	Updates a scheduled SQL job.
Write	log:UpdateSqlInstance	Updates a dedicated SQL instance.
Write	log:UpdateStoreView	Updates a dataset.
List	log:ListConfig	Lists Logtail configurations.
List	log:ListDashboard	Lists dashboards.
List	log:ListDownloadJobs	Lists log download jobs.
List	log:ListETLs	Lists data transformation jobs.
List	log:ListOSSExports	Lists OSS data shipping jobs.
List	log:ListOSSHDFSExports	Lists OSS-HDFS shipping tasks.
List	log:ListOSSIngestions	Lists OSS import tasks.
List	log:ListStoreViews	Lists datasets.

Custom policy scenarios and examples

View project list

Grant a RAM user the following permission:

View the project list.

The following policy grants this permission:

{
  "Version": "1",
  "Statement": [
    {
      "Action": [
        "log:ListProject"
      ],
      "Resource": [
        "acs:log:*:*:project/*"
      ],
      "Effect": "Allow"
    }
  ]
}

Project read-only permissions

Grant a RAM user the following permissions:

View the project list.
Read-only access to a specific project.

Note

Read-only project permissions alone do not include log access. You must also grant read-only permissions for the project's Logstores.

The following policy grants these permissions:

{
   "Version": "1",
   "Statement": [
     {
       "Action": ["log:ListProject"],
       "Resource": ["acs:log:*:*:project/*"],
       "Effect": "Allow"
      },
     {
       "Action": [
         "log:Get*",
         "log:List*"
       ],
       "Resource": "acs:log:*:*:project/<your-project-name>/*",
       "Effect": "Allow"
     }
   ]
 }

Logstore and saved search permissions

Grant a RAM user the following permissions:

View the project list.
Read-only permission for a specified Logstore and permission to create and manage saved searches.

The following example policy grants these permissions:

{
  "Version": "1",
  "Statement": [
    {
      "Action": [
        "log:ListProject"
      ],
      "Resource": "acs:log:*:*:project/*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "log:List*"
      ],
      "Resource": "acs:log:*:*:project/<your-project-name>/logstore/*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "log:Get*",
        "log:List*"
      ],
      "Resource": [
        "acs:log:*:*:project/<your-project-name>/logstore/<your-logstore-name>"
      ],
      "Effect": "Allow"
    },
    {
      "Action": [
        "log:List*"
      ],
      "Resource": [
        "acs:log:*:*:project/<your-project-name>/dashboard",
        "acs:log:*:*:project/<your-project-name>/dashboard/*"
      ],
      "Effect": "Allow"
    },
    {
      "Action": [
        "log:Get*",
        "log:List*",
        "log:Create*"
      ],
      "Resource": [
        "acs:log:*:*:project/<your-project-name>/savedsearch",
        "acs:log:*:*:project/<your-project-name>/savedsearch/*"
      ],
      "Effect": "Allow"
    }
  ]
}

Read-only access to a specific Logstore, saved searches, and dashboards

Grant a RAM user the following permissions:

View the list of all projects.
Read-only access to a specific Logstore, and view access to all saved searches and dashboards within the same project.

The following policy grants these permissions:

{
  "Version": "1",
  "Statement": [
    {
      "Action": [
        "log:ListProject"
      ],
      "Resource": "acs:log:*:*:project/*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "log:List*"
      ],
      "Resource": "acs:log:*:*:project/<your-project-name>/logstore/*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "log:Get*",
        "log:List*"
      ],
      "Resource": [
        "acs:log:*:*:project/<your-project-name>/logstore/<your-logstore-name>"
      ],
      "Effect": "Allow"
    },
    {
      "Action": [
        "log:Get*",
        "log:List*"
      ],
      "Resource": [
        "acs:log:*:*:project/<your-project-name>/dashboard",
        "acs:log:*:*:project/<your-project-name>/dashboard/*"
      ],
      "Effect": "Allow"
    },
    {
      "Action": [
        "log:Get*",
        "log:List*"
      ],
      "Resource": [
        "acs:log:*:*:project/<your-project-name>/savedsearch",
        "acs:log:*:*:project/<your-project-name>/savedsearch/*"
      ],
      "Effect": "Allow"
    }
  ]
}

Project write permissions

Grants a RAM user write access to a specified project. Does not include query or other permissions.

{
  "Version": "1",
  "Statement": [
    {
      "Action": [
        "log:Post*"
      ],
      "Resource": "acs:log:*:*:project/<your-project-name>/*",
      "Effect": "Allow"
    }
  ]
}

Logstore write permissions

Grants a RAM user write access to a specified Logstore. Does not include query or other permissions.

{
  "Version":"1",
  "Statement":[
    {
      "Effect":"Allow",
      "Action":[
        "log:PostLogStoreLogs"
      ],
      "Resource":[
        "acs:log:*:*:project/<your-project-name>/logstore/<your-logstore-name>"
      ]
    }
  ]
}

Project consumption permissions

Grants a RAM user data consumption access to a specified project. Does not include write or query permissions.

{
  "Version": "1",
  "Statement": [
    {
      "Action": [
        "log:ListShards",
        "log:GetCursorOrData",
        "log:GetConsumerGroupCheckPoint",
        "log:UpdateConsumerGroup",
        "log:ConsumerGroupHeartBeat",
        "log:ConsumerGroupUpdateCheckPoint",
        "log:ListConsumerGroup",
        "log:CreateConsumerGroup"
      ],
      "Resource": "acs:log:*:*:project/<your-project-name>/*",
      "Effect": "Allow"
    }
  ]
}

Logstore consumption permissions

Grants a RAM user data consumption access to a specified Logstore. Does not include write or query permissions.

{
  "Version": "1",
  "Statement": [
    {
      "Action": [
        "log:ListShards",
        "log:GetCursorOrData",
        "log:GetConsumerGroupCheckPoint",
        "log:UpdateConsumerGroup",
        "log:ConsumerGroupHeartBeat",
        "log:ConsumerGroupUpdateCheckPoint",
        "log:ListConsumerGroup",
        "log:CreateConsumerGroup"
      ],
      "Resource": [
        "acs:log:*:*:project/<your-project-name>/logstore/<your-logstore-name>",
        "acs:log:*:*:project/<your-project-name>/logstore/<your-logstore-name>/*"
      ],
      "Effect": "Allow"
    }
  ]
}

Logstore encryption requirement

Requires a RAM user to specify an encryption configuration when creating or updating a Logstore.

Note

You can specify an exact project and Logstore name, or use an asterisk (*) as a wildcard.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "log:CreateLogStore",
        "log:UpdateLogStore"
      ],
      "Resource": [
        "acs:log:*:*:project/<your-project-name>/logstore/<your-logstore-name>",
        "acs:log:*:*:project/<your-project-name>/logstore/*"
      ],
      "Condition": {
        "Bool": {
          "log:Encrypted": "true"
        }
      }
    }
  ]
}

Permissions for log applications

Grant the following permissions to use these log applications or features:

Database Audit
Mobile O&M Monitoring
Flow Log Center
Log Analysis for AWS CloudTrail
SREWorks
General Host Audit
Intelligent Anomaly Analysis
Custom dashboards
Dashboard playlists

The following policies define log application permissions.

Read-only permissions

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "log:GetResource",
                "log:ListResources",
                "log:GetResourceRecord",
                "log:ListResourceRecords"
            ],
            "Resource": [
                "acs:log:*:*:resource/*"
            ]
        }
    ]
}

Management permissions

{
    "Version": "1",
    "Statement": [
          {
      "Effect": "Allow",
      "Action": [
        "log:*"
      ],
      "Resource": [
        "acs:log:*:*:resource/*"
      ]
    }
    ]
}