Custom authorization for log collection and synchronization - Simple Log Service

When you use Log Audit Service to collect cloud service logs across Alibaba Cloud accounts, you must grant Simple Log Service permissions to collect the logs and authorize data synchronization between accounts. You can use the AccessKey pair of a RAM user with the required permissions, or grant custom permissions as described below.

Background information

Log Audit Service can collect cloud service logs within a single Alibaba Cloud account or across multiple accounts. Cross-account log collection requires mutual authorization between the current account and the other accounts.

Note

Authorization for the current Alibaba Cloud account is automatically granted when the AliyunServiceRoleForSLSAudit service-linked role is created. For more information, see Initial configuration. To grant custom permissions for other Alibaba Cloud accounts, follow the authorization steps in this topic.

The current Alibaba Cloud account allows other accounts to synchronize data to its audit Logstore.
Other Alibaba Cloud accounts authorize data synchronization to the audit Logstore of the current account.

Log Audit Service involves the following roles and policies:

Current Alibaba Cloud account

Role	Policy
AliyunServiceRoleForSLSAudit	AliyunServiceRolePolicyForSLSAudit

Other accounts

Role	Policy
sls-audit-service-monitor	ReadOnlyAccess AliyunLogAuditServiceMonitorAccess

Procedure

In one of the other Alibaba Cloud accounts, log on to the RAM console.

We recommend that you log on as a RAM user with RAM read and write permissions, such as those granted by the AliyunRAMFullAccess policy.

Create the AliyunLogAuditServiceMonitorAccess policy.

In the left-side navigation pane, choose Permission Management > Policy. On the Policies page, click Create Policy.

On the Create Policy page, click the Script tab.

Replace the content in the policy editor with the following code.

{
    "Version": "1",
    "Statement": [
        {
            "Action": "log:*",
            "Resource": [
                "acs:log:*:*:project/slsaudit-*",
                "acs:log:*:*:app/audit"
            ],
            "Effect": "Allow"
        },
        {
            "Action": [
                "rds:ModifySQLCollectorPolicy",
                "vpc:*FlowLog*",
                "drds:*SqlAudit*",
                "kvstore:ModifyAuditLogConfig",
                "polardb:ModifyDBClusterAuditLogCollector",
                "config:UpdateIntegratedServiceStatus",
                "config:StartConfigurationRecorder",
                "config:PutConfigurationRecorder",
                "pvtz:DescribeResolveAnalysisScopeStatus",
                "pvtz:SetResolveAnalysisScopeStatus"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": "ram:CreateServiceLinkedRole",
            "Resource": "*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": [
                        "config.aliyuncs.com",
                        "pvtz.aliyuncs.com"
                    ]
                }
            }
        }
    ]
}

Click Next to edit policy information, configure the following parameters, and then click OK.

Parameter	Description
Name	Set the name to AliyunLogAuditServiceMonitorAccess.
Remarks	Enter a brief description for the policy.

Create the sls-audit-service-monitor role.

In the left-side navigation pane, choose Identities > Role, and then click Create Role.
In the Select Role Type step, select Alibaba Cloud Service and click Next.

In the Configure Role step, configure the following parameters, and then click Complete.

Parameter	Description
Role Type	Select Normal Service Role.
Role Name	Set the name to sls-audit-service-monitor.
Select Trusted Service	Select Simple Log Service.

In the Finish step, click Add Permissions to RAM Role.
Click Create Authorization.

Attach policies to the sls-audit-service-monitor role.

In the Create Authorization panel, select AliyunLogAuditServiceMonitorAccess under Custom Policy and ReadOnlyAccess under System Policy. Click OK.
Modify the trust policy of the sls-audit-service-monitor role.
1. On the Trust Policy Management tab, click Edit Trust Policy. Replace the existing content in the policy editor with the following code, and then click Save trust policy document.
  Replace <CentralAccountID> with the ID of your central Alibaba Cloud account. You can find the account ID in the Account Center.
```
 {
    "Statement": [
        {
            "Action": "sts:AssumeRole",
            "Effect": "Allow",
            "Principal": {
                "Service": [
                    "@log.aliyuncs.com",
                    "log.aliyuncs.com"
                ]
            }
        }
    ],
    "Version": "1"
}
```