Simple Log Service:Failed to deliver logs to OSS

Problem description

AccessDenied: The bucket you are attempting to access must be addressed using the specified endpoint. Please send all future requests to this endpoint.

Possible cause

This error indicates that the region of the Simple Log Service project does not match the region of the OSS bucket.

Solution

Ensure that the Simple Log Service project and the OSS bucket are in the same region. For more information about endpoints, see Private network.

Problem description

EntityNotExist.Role: The role not exists:

Possible cause

This error indicates that the specified Resource Access Management (RAM) role does not exist. This may be because the provided Alibaba Cloud Resource Name (ARN) is incorrect.

Solution

Ensure that you specify the correct ARN.

For more information, see How to obtain an ARN.

Problem description

You have no right to access this object because of bucket acl.

Possible cause

This error indicates that Simple Log Service has insufficient permissions to access the object. This issue occurs because the access control list (ACL) policy of the OSS bucket prevents Simple Log Service from performing write operations.

Solution

To ensure that the OSS data shipping job runs correctly, adjust the ACL policy to grant the required access permissions. For more information, see Overview of permissions and access control.

Correct use of RAM Deny policies for OSS shipping

RAM authorization currently supports both legacy and new Action and Resource paths, which have an OR relationship. To make a Deny policy effective, the policy must cover both the Job and OSSExport actions. Use the following policy:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": ["log:CreateJob", "log:UpdateJob", "log:DeleteJob"],
      "Resource": "acs:log:*:<accountId>:project/*/job/*"
    },
    {
      "Effect": "Deny",
      "Action": ["log:CreateOSSExport", "log:UpdateOSSExport", "log:StartOSSExport", "log:StopOSSExport", "log:DeleteOSSExport"],
      "Resource": "acs:log:*:<accountId>:project/*/ossexport/*"
    }
  ]
}