Common RAM policy examples for granting granular access to Log Service resources.
In a policy, the term Logstore also refers to a Metricstore. All policies in this topic apply to both.
Follow the principle of least privilege (PoLP): grant only the minimum permissions a RAM user needs. At minimum, most users need read-only access to the project list — without it, the project list is invisible. For more information, see system policies and Create a custom policy.
Policy examples
Project list view permissions
Grants a RAM user permission to view the project list.
The log:ListProject action applies to all projects (project/*), so the RAM user can see every project in the account.
{
"Version": "1",
"Statement": [
{
"Action": [
"log:ListProject"
],
"Resource": [
"acs:log:*:*:project/*"
],
"Effect": "Allow"
}
]
}Project read-only permissions
Grants a RAM user permission to view the project list and read all resources within a specified project.
Project read-only permissions do not include access to log data within that project. To read logs, also grant read-only permissions on the Logstore.
The first statement covers the project list. The second covers all resources within a specific project using log:Get and log:List. Both resource paths are required: the project root (project/<your-project-name>) and all sub-resources (project/<your-project-name>/*).
{
"Version": "1",
"Statement": [
{
"Action": ["log:ListProject"],
"Resource": ["acs:log:*:*:project/*"],
"Effect": "Allow"
},
{
"Action": [
"log:Get*",
"log:List*"
],
"Resource": [
"acs:log:*:*:project/<your-project-name>/*",
"acs:log:*:*:project/<your-project-name>"
],
"Effect": "Allow"
}
]
}Logstore read-only and saved search management
Grants a RAM user permission to view the project list, read a specific Logstore, and create and manage saved searches.
The policy contains five statements, each targeting a different resource type: the project list, all Logstores in the project (for enumeration), the specific Logstore (for data access), dashboards (read-only), and saved searches (read and create).
{
"Version": "1",
"Statement": [
{
"Action": [
"log:ListProject"
],
"Resource": "acs:log:*:*:project/*",
"Effect": "Allow"
},
{
"Action": [
"log:List*"
],
"Resource": "acs:log:*:*:project/<your-project-name>/logstore/*",
"Effect": "Allow"
},
{
"Action": [
"log:Get*",
"log:List*"
],
"Resource": [
"acs:log:*:*:project/<your-project-name>/logstore/<your-logstore-name>"
],
"Effect": "Allow"
},
{
"Action": [
"log:List*"
],
"Resource": [
"acs:log:*:*:project/<your-project-name>/dashboard",
"acs:log:*:*:project/<your-project-name>/dashboard/*"
],
"Effect": "Allow"
},
{
"Action": [
"log:Get*",
"log:List*",
"log:Create*"
],
"Resource": [
"acs:log:*:*:project/<your-project-name>/savedsearch",
"acs:log:*:*:project/<your-project-name>/savedsearch/*"
],
"Effect": "Allow"
}
]
}Read-only permissions on a specified Logstore and on all saved searches and dashboards in a project
Grants a RAM user permission to view the project list, read a specific Logstore, and view all saved searches and dashboards in that Logstore's project.
Statements 3 through 5 use both log:Get and log:List, while statements 1 and 2 use only list-type actions (log:ListProject and log:List). Unlike the previous example, dashboards and saved searches are also read-only here — log:Create is not included for saved searches.
{
"Version": "1",
"Statement": [
{
"Action": [
"log:ListProject"
],
"Resource": "acs:log:*:*:project/*",
"Effect": "Allow"
},
{
"Action": [
"log:List*"
],
"Resource": "acs:log:*:*:project/<your-project-name>/logstore/*",
"Effect": "Allow"
},
{
"Action": [
"log:Get*",
"log:List*"
],
"Resource": [
"acs:log:*:*:project/<your-project-name>/logstore/<your-logstore-name>"
],
"Effect": "Allow"
},
{
"Action": [
"log:Get*",
"log:List*"
],
"Resource": [
"acs:log:*:*:project/<your-project-name>/dashboard",
"acs:log:*:*:project/<your-project-name>/dashboard/*"
],
"Effect": "Allow"
},
{
"Action": [
"log:Get*",
"log:List*"
],
"Resource": [
"acs:log:*:*:project/<your-project-name>/savedsearch",
"acs:log:*:*:project/<your-project-name>/savedsearch/*"
],
"Effect": "Allow"
}
]
}Project write permissions
Grants a RAM user write permissions on a specified project. Does not include permissions for other operations such as querying data.
{
"Version": "1",
"Statement": [
{
"Action": [
"log:Post*"
],
"Resource": "acs:log:*:*:project/<your-project-name>/*",
"Effect": "Allow"
}
]
}Logstore write permissions
Grants a RAM user write permissions on a specified Logstore. Does not include permissions for other operations such as querying data.
{
"Version":"1",
"Statement":[
{
"Effect":"Allow",
"Action":[
"log:PostLogStoreLogs"
],
"Resource":[
"acs:log:*:*:project/<your-project-name>/logstore/<your-logstore-name>"
]
}
]
}Project consume permissions
Grants a RAM user consume permissions on a specified project. Does not include permissions for other operations such as writing or querying data.
{
"Version": "1",
"Statement": [
{
"Action": [
"log:ListShards",
"log:GetCursorOrData",
"log:GetConsumerGroupCheckPoint",
"log:UpdateConsumerGroup",
"log:ConsumerGroupHeartBeat",
"log:ConsumerGroupUpdateCheckPoint",
"log:ListConsumerGroup",
"log:CreateConsumerGroup"
],
"Resource": "acs:log:*:*:project/<your-project-name>/*",
"Effect": "Allow"
}
]
}Logstore consume permissions
Grants a RAM user consume permissions on a specified Logstore. Does not include permissions for other operations such as writing or querying data.
{
"Version": "1",
"Statement": [
{
"Action": [
"log:ListShards",
"log:GetCursorOrData",
"log:GetConsumerGroupCheckPoint",
"log:UpdateConsumerGroup",
"log:ConsumerGroupHeartBeat",
"log:ConsumerGroupUpdateCheckPoint",
"log:ListConsumerGroup",
"log:CreateConsumerGroup"
],
"Resource": [
"acs:log:*:*:project/<your-project-name>/logstore/<your-logstore-name>",
"acs:log:*:*:project/<your-project-name>/logstore/<your-logstore-name>/*"
],
"Effect": "Allow"
}
]
}Enforce Logstore encryption
After this policy is attached to a RAM user, the user must specify an encryption configuration when creating or modifying a Logstore.
Specify an exact project name and Logstore name, or use an asterisk (*) as a wildcard.
{
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"log:CreateLogStore",
"log:UpdateLogStore"
],
"Resource": [
"acs:log:*:*:project/<your-project-name>/logstore/<your-logstore-name>",
"acs:log:*:*:project/<your-project-name>/logstore/*"
],
"Condition": {
"Bool": {
"log:Encrypted": "true"
}
}
}
]
}Permissions for log applications
Grant the following permissions to the RAM user or role when using these log applications or features:
Common Database Audit
Mobile O&M Monitoring
Flow Log Center
Log Analysis for AWS CloudTrail
SREWorks
General Host Audit
Intelligent Anomaly Analysis
Custom dashboards
Dashboard playlists
The following policies provide the required permissions for log applications.
-
Read-only permissions
{ "Version": "1", "Statement": [ { "Effect": "Allow", "Action": [ "log:GetResource", "log:ListResources", "log:GetResourceRecord", "log:ListResourceRecords" ], "Resource": [ "acs:log:*:*:resource/*" ] } ] } -
Management permissions
{ "Version": "1", "Statement": [ { "Effect": "Allow", "Action": [ "log:*" ], "Resource": [ "acs:log:*:*:resource/*" ] } ] }
See also
For a list of actions and resources that Log Service supports, see authorization rules.