WUYING Workspace allows you to deliver user operation logs to a Logstore in Simple Log Service (SLS). You can then use SLS to audit and monitor user activities, set up alerts for suspicious operations, prevent information leakage, and ensure business data security. This topic describes the required permissions and how to deliver user operation logs.
Background
Before you deliver user operation logs, make sure that you understand the following information:
Simple Log Service (SLS) is a cloud-native observability and analysis platform that provides a large-scale, cost-effective, and real-time service for data such as logs, metrics, and traces. SLS provides comprehensive services, including data collection, processing, query and analysis, visualization, alerting, and shipping to enhance digital capabilities in scenarios such as research and development (R&D), operations and maintenance (O&M), business operations, and security. For more information, see What is Simple Log Service?.
A Logstore is the basic unit in Simple Log Service for log collection, storage, and querying. For more information, see Logstore.
Delivering user operation logs from WUYING Workspace is free of charge. However, this feature relies on Simple Log Service. After logs are delivered, Simple Log Service charges for log storage. For more information about pricing, see Billing overview.
A service-linked role is a role that is linked to a specific cloud service. This type of role helps you configure the required permissions for the cloud service to operate as expected and reduces risks from misconfigurations. For more information about service-linked roles, see Service-linked roles.
When you use the log delivery feature of WUYING Workspace for the first time, the system automatically creates a service-linked role and attaches a policy to it. The role details are as follows:
Role name: AliyunServiceRoleForGwsLogDelivery
Policy: AliyunServiceRolePolicyForGwsLogDelivery
Permission description: WUYING Workspace uses the service-linked role (AliyunServiceRoleForGwsLogDelivery) to access Logstores in Simple Log Service to deliver logs.
If you no longer need the service-linked role (AliyunServiceRoleForGwsLogDelivery), you can delete it. Before deleting the role, you must first delete the cloud computer resources that depend on it from the console or by calling an API. This action cancels log delivery. For more information, see Delete a RAM role.
Prerequisites
You have activated and authorized Simple Log Service. For more information, see Use Logtail to collect and analyze ECS text logs.
Steps
Log on to the EDS enterprise console.
In the left-side navigation pane, choose Security & Audits > Logs.
Click the User Operation Logs tab, and then click Deliver to Logstore in the upper-right corner.
If you are using this feature for the first time, click OK in the Elastic Desktop Service Service-linked Role dialog box.
In the Deliver to Logstore panel, configure the Logstore. You can create a new Logstore or select an existing one. When you are finished, click OK.
FAQ
Why can't a RAM user automatically create the service-linked role (AliyunServiceRoleForGwsLogDelivery)?
A RAM user requires the CreateServiceLinkedRole permission to automatically create or delete the service-linked role (AliyunServiceRoleForGwsLogDelivery). If a RAM user cannot automatically create the service-linked role, you must attach the following policy to the RAM user.
Replace Alibaba Cloud account ID with the ID of your Alibaba Cloud account.
{
"Statement": [
{
"Action": [
"ram:CreateServiceLinkedRole"
],
"Resource": "acs:ram:*:Alibaba Cloud account ID:role/*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": [
"log-delivery.gws.aliyuncs.com"
]
}
}
}
],
"Version": "1"
}