Simple Log Service:Authorize a RAM role to read log data from a logstore

Authorize a custom role to read log data

Procedure

After you authorize a RAM role to read log data from a logstore, you can assign the RAM role to a MaxCompute data shipping job to allow the job to read log data from the logstore.

1. Log on to the Alibaba Cloud Management Console by using an Alibaba Cloud account or a Resource Access Management (RAM) user.

2. Create a RAM role to be assumed by the Alibaba Cloud service. For more information, see Create a RAM role for a trusted Alibaba Cloud service.

   Important

   • When you create a RAM role, you must set the Select Trusted Entity parameter to Alibaba Cloud Service and the Select Trusted Service parameter to Log Service.

   • Check the trust policy of the RAM role. Make sure that the Service element contains at least "log.aliyuncs.com".

     {
       "Statement": [
         {
           "Action": "sts:AssumeRole",
           "Effect": "Allow",
           "Principal": {
             "Service": [
               "log.aliyuncs.com"
             ]
           }
         }
       ],
       "Version": "1"
     }

3. Create a custom policy that grants the permissions to read data from a Logstore.

   You can use a policy document that uses exact match or fuzzy match for authorization.

   Exact match for authorization

   On the Create Policy page, click the JSON tab. Replace the existing contents in the editor with the following script. For more information, see Create a custom policy on the JSON tab.

   Important

   Replace Project name and Logstore name in the policy document based on your business requirements.

   {
       "Version":"1",
       "Statement":[
           {
               "Action":[
                   "log:GetCursorOrData",
                   "log:ListShards"
               ],
               "Resource":[
                   "acs:log:*:*:project/Project name/logstore/Logstore name"
               ],
               "Effect":"Allow"
           }
       ]
   }

   Fuzzy match for authorization

   On the Create Policy page, click the JSON tab. Replace the existing contents in the editor with the following script. For more information, see Create a custom policy on the JSON tab.

   Important

   • In this example, the names of the projects are log-project-dev-a, log-project-dev-b, and log-project-dev-c, and the names of the Logstores are website_a_log, website_b_log, and website_c_log.

   • Replace log-project-dev-* and website_*_log* in the policy document based on your business requirements.

   {
       "Version":"1",
       "Statement":[
           {
               "Action":[
                   "log:GetCursorOrData",
                   "log:ListShards"
               ],
               "Resource":[
                   "acs:log:*:*:project/log-project-dev-*/logstore/website_*_log*"
               ],
               "Effect":"Allow"
           }
       ]
   }

4. Attach the created custom policy to the RAM role. For more information, see Grant permissions to a RAM role.