Simple Log Service:Grant a RAM role the permissions to access Logstores across Alibaba Cloud accounts

Log on to the RAM console by using Alibaba Cloud Account A.

Create a policy that grants the permissions to analyze data in a source Logstore.

1. In the left-side navigation pane, choose Permissions > Policies.

2. Click Create Policy.

3. On the Create Policy page, click the JSON tab.

   Replace the existing script in the code editor with one of the following policy documents.

   • Policy that uses exact names to match resources

     In this example, the name of the source project is log-project-prod. The name of the source Logstore is website_log. You can replace the names with the actual names of your projects and Logstores.

     Important

     When you create a policy, you can specify either a Logstore or a Metricstore after the logstore keyword. If you want to manage Metricstores, you can also refer to the following policy document to create a policy.

     {
         "Version":"1",
         "Statement":[
             {
                 "Action":[
                     "log:PostProjectQuery"
                 ],
                 "Resource":[
                     "acs:log:*:*:project/log-project-prod/logstore/website_log",
                     "acs:log:*:*:project/log-project-prod/logstore/website_log/*"
                 ],
                 "Effect":"Allow"
             },
             {
                 "Action":[
                     "log:GetProjectQuery",
                     "log:PutProjectQuery",
                     "log:DeleteProjectQuery"
                 ],
                 "Resource":[
                     "acs:log:*:*:project/log-project-prod"
                 ],
                 "Effect":"Allow"
             }
         ]
     }

   • Policy that uses wildcard characters to match resources

     In this example, the names of the source projects are log-project-dev-a, log-project-dev-b, and log-project-dev-c. The names of the source Logstores are website_a_log, website_b_log, and website_c_log. You can replace the names with the actual names of your projects and Logstores.

     {
         "Version":"1",
         "Statement":[
             {
                 "Action":[
                     "log:PostProjectQuery"
                 ],
                 "Resource":[
                     "acs:log:*:*:project/log-project-dev-*/logstore/website_*_log",
                     "acs:log:*:*:project/log-project-dev-*/logstore/website_*_log/*"
                 ],
                 "Effect":"Allow"
             },
             {
                 "Action":[
                     "log:GetProjectQuery",
                     "log:PutProjectQuery",
                     "log:DeleteProjectQuery"
                 ],
                 "Resource":[
                     "acs:log:*:*:project/log-project-dev-*"
                 ],
                 "Effect":"Allow"
             }
         ]
     }

4. Click Next to edit policy information, configure the following parameters, and then click OK.

   Parameter	Description
   Name	Enter a name for the policy. Example: log-scheduled-sql-policy.
   Description	Enter a description for the policy.

Grant permissions to RAM Role A.

1. In the left-side navigation pane, choose Identities > Roles.

2. Find RAM Role A and click Grant Permission in the Actions column.

3. Click Custom Policy in the Select Policy section and select the policy that you created in Step 2. Then, click OK. In this example, the log-scheduled-sql-policy policy is selected.

4. Confirm the authorization result. Then, click Complete.

Obtain the Alibaba Cloud Resource Name (ARN) of RAM Role A.

Log on to the RAM console by using Alibaba Cloud Account B.

Create a policy that grants the permissions to write data to a destination Logstore.

1. In the left-side navigation pane, choose Permissions > Policies.

2. On the Policies page, click Create Policy.

3. On the Create Policy page, click the JSON tab.

   Replace the existing script in the code editor with one of the following policy documents.

   • Policy that uses exact names to match resources

     In this example, the name of the destination project is log-project-prod. The name of the destination Logstore is website_log_output. You can replace the names with the actual names of your projects and Logstores.

     Important

     When you create a policy, you can specify either a Logstore or a Metricstore after the logstore keyword. If you want to manage Metricstores, you can also refer to the following policy document to create a policy.

     {
       "Version": "1",
       "Statement": [
         {
           "Action": [
             "log:Post*",
             "log:BatchPost*"
           ],
            "Resource": "acs:log:*:*:project/log-project-prod/logstore/website_log_output",
           "Effect": "Allow"
         }
       ]
     }

   • Policy that uses wildcard characters to match resources

     In this example, the names of the destination projects are log-project-dev-a, log-project-dev-b, and log-project-dev-c. The names of the destination Logstores are website_a_log_output, website_b_log_output, and website_c_log_output. You can replace the names with the actual names of your projects and Logstores.

     {
       "Version": "1",
       "Statement": [
         {
           "Action": [
             "log:Post*",
             "log:BatchPost*"
           ],
            "Resource": "acs:log:*:*:project/log-project-dev-*/logstore/website_*_log_output",
           "Effect": "Allow"
         }
       ]
     }

4. Click Next to edit policy information, configure the following parameters, and then click OK.

   Parameter	Description
   Name	Enter a name for the policy. Example: log-sink-write-policy.
   Description	Enter a description for the policy.

Grant permissions to RAM Role B.

1. In the left-side navigation pane, choose Identities > Roles.

2. Find RAM Role B and click Grant Permission in the Actions column.

3. Click Custom Policy in the Select Policy section and select the policy that you created in Step 2. Then, click OK. In this example, the log-sink-write-policy policy is selected.

4. Confirm the authorization result. Then, click Complete.

Modify the trust policy of RAM Role B.

1. On the Roles page, click the name of RAM Role B.

2. On the Trust Policy tab, click Edit Trust Policy.

3. Modify the trust policy.

   Add ID of Alibaba Cloud Account A to the Service element. Replace the ID based on your business scenario. You can view the ID of your Alibaba Cloud account in the Account Center console.

   The following policy allows Alibaba Cloud Account A to obtain a temporary Security Token Service (STS) token to manage the cloud resources of Alibaba Cloud Account B:

   {
       "Statement": [
           {
               "Action": "sts:AssumeRole",
               "Effect": "Allow",
               "Principal": {
                   "Service": [
                       "log.aliyuncs.com",
                       "ID of Alibaba Cloud Account A@log.aliyuncs.com"
                   ]
               }
           }
       ],
       "Version": "1"
   }

4. Click Save trust policy document.

Obtain the ARN of RAM Role B.