Invoke ALIYUN::RAM::Role to create a RAM role - Resource Orchestration Service

La ressource ALIYUN::RAM::Role crée un rôle RAM.

Syntaxe

{
  "Type": "ALIYUN::RAM::Role",
  "Properties": {
    "RoleName": String,
    "Description": String,
    "AssumeRolePolicyDocument": Map,
    "MaxSessionDuration": Integer,
    "Policies": List,
    "IgnoreExisting": Boolean,
    "DeletionForce": Boolean,
    "PolicyAttachments": Map
  }
}

Propriétés

Nom de la propriété	Type	Obligatoire	Mise à jour possible	Description	Contraintes
AssumeRolePolicyDocument	Map	Oui	Oui	L'identité autorisée à endosser ce rôle RAM.	Politique d’approbation (trust policy). Spécifiez une ou plusieurs entités de confiance pouvant endosser ce rôle RAM. Il peut s'agir d'un compte Alibaba Cloud, d'un service Alibaba Cloud ou d'un fournisseur d'identité.
RoleName	String	Oui	Non	Le nom du rôle RAM.	Longueur : 1 à 64 caractères. Peut contenir des lettres anglaises, des chiffres, des points (.) et des traits d'union (-).
Description	String	Non	Non	La description du rôle RAM.	Longueur maximale : 1 024 caractères.
MaxSessionDuration	Integer	Non	Oui	La durée maximale de session pour le rôle RAM.	Plage de valeurs : 3 600 à 43 200 secondes. Valeur par défaut : 3 600 secondes.
Policies	List	Non	Oui	Les politiques applicables au rôle RAM.	Pour plus d'informations, consultez Présentation des politiques d'accès.
IgnoreExisting	Boolean	Non	Non	Indique s'il faut ignorer les rôles existants.	Valeurs : false : ROS effectue une vérification d'unicité. Si un rôle portant le même nom existe déjà, ROS signale une erreur lors de la création. true : ROS n'effectue pas de vérification d'unicité. Si un rôle portant le même nom existe déjà, ROS ignore le processus de création du rôle. Remarque Si ROS n'a pas créé le rôle, celui-ci est ignoré lors des opérations de mise à jour et de suppression.
DeletionForce	Boolean	Non	Oui	Indique s'il faut détacher de force les stratégies associées au rôle.	Valeur par défaut : false.
PolicyAttachments	Map	Non	Oui	Les noms des politiques système et personnalisées à attacher.	Pour plus d'informations, consultez Propriétés PolicyAttachments.

Syntaxe AssumeRolePolicyDocument

"AssumeRolePolicyDocument": {
  "Version": String,
  "Statement": List
}

Propriétés AssumeRolePolicyDocument

|
**Nom de la propriété**
|
**Type**
|
**Obligatoire**
|
**Mise à jour possible**
|
**Description**
|
**Contraintes**
| | --- | --- | --- | --- | --- | --- | |
Version
|
String
|
Oui
|
Non
|
La version de la politique.
|
Aucune
| |
Statement
|
List
|
Oui
|
Non
|
Les règles spécifiques de la politique.
|
Pour plus d'informations, consultez [Propriétés Statement](#ac35909beabf9).
|

Syntaxe Statement

"Statement": [
  {
    "Condition": Map,
    "Action": String,
    "Effect": String,
    "Principal": Map
  }
]

Propriétés Statement

Nom de la propriété	Type	Obligatoire	Mise à jour possible	Description	Contraintes
Condition	Map	Non	Non	Les conditions.	Aucune
Action	String	Non	Non	Les actions spécifiques ciblées par la politique.	Aucune
Effect	String	Non	Non	L'effet de l'autorisation.	Valeurs : Allow : Autorise l'action. Deny : Refuse l'action.
Principal	Map	Non	Non	Le type d'entité de confiance.	Pour plus d'informations, consultez Propriétés Principal.

Syntaxe Principal

"Principal": {
  "Service": List,
  "Federated": List,
  "RAM": List
}

Propriétés Principal

|
**Nom de la propriété**
|
**Type**
|
**Obligatoire**
|
**Mise à jour possible**
|
**Description**
|
**Contraintes**
| | --- | --- | --- | --- | --- | --- | |
Service
|
List
|
Non
|
Non
|
Services Alibaba Cloud.
|
Aucune
| |
Federated
|
List
|
Non
|
Non
|
Fournisseur d'identité
|
Aucune
| |
RAM
|
List
|
Non
|
Non
|
Comptes Alibaba Cloud.
|
Aucune
|

Syntaxe Policies

"Policies": [
  {
    "Description": String,
    "PolicyName": String,
    "PolicyDocument": Map
  }
]

Propriétés Policies

|
**Nom de la propriété**
|
**Type**
|
**Obligatoire**
|
**Mise à jour possible**
|
**Description**
|
**Contraintes**
| | --- | --- | --- | --- | --- | --- | |
Description
|
String
|
Non
|
Non
|
La description.
|
Longueur : 1 à 1 024 caractères.
| |
PolicyName
|
String
|
Oui
|
Non
|
Le nom de la politique d'accès.
|
Longueur : 1 à 128 caractères. Peut contenir des lettres anglaises, des chiffres et des traits d'union (-).
| |
PolicyDocument
|
Map
|
Oui
|
Oui
|
Le document de politique.
|
Longueur maximale : 2 048 caractères.

Pour plus d'informations, consultez [Propriétés PolicyDocument](#section_po9_tlx_e04).
|

Syntaxe PolicyAttachments

"PolicyAttachments": {
  "System": List,
  "Custom": List
}

Propriétés PolicyAttachments

|
**Nom de la propriété**
|
**Type**
|
**Obligatoire**
|
**Mise à jour possible**
|
**Description**
|
**Contraintes**
| | --- | --- | --- | --- | --- | --- | |
Custom
|
List
|
Non
|
Oui
|
Une liste de noms de politiques personnalisées.
|
Le nombre de politiques doit être inférieur ou égal à 5.
| |
System
|
List
|
Non
|
Oui
|
Une liste de noms de politiques système.
|
Le nombre de politiques doit être inférieur ou égal à 20.
|

Syntaxe PolicyDocument

"PolicyDocument": {
  "Version": String,
  "Statement": List
}

Propriétés PolicyDocument

|
**Nom de la propriété**
|
**Type**
|
**Obligatoire**
|
**Mise à jour possible**
|
**Description**
|
**Contraintes**
| | --- | --- | --- | --- | --- | --- | |
Version
|
String
|
Oui
|
Non
|
La version de la politique d'accès.
|
Aucune
| |
Statement
|
List
|
Oui
|
Non
|
Les règles spécifiques de la politique d'accès.
|
Aucune
|

Valeurs de retour

Fn::GetAtt

RoleId : l'ID du rôle.
RoleName : le nom du rôle.
Arn : le descripteur de ressource du rôle.

Exemples

Scénario 1 : Créer un rôle RAM.

Création rapide

YAML

ROSTemplateFormatVersion: '2015-09-01'
Description: Test RAM Role
Parameters: {}
Resources:
  Role:
    Type: ALIYUN::RAM::Role
    Properties:
      RoleName: TestRole
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
                - actiontrail.aliyuncs.com
        Version: '1'
Outputs:
  RoleId:
    Description: Id of ram role.
    Value:
      Fn::GetAtt:
        - Role
        - RoleId
  Arn:
    Description: Name of alicloud resource.
    Value:
      Fn::GetAtt:
        - Role
        - Arn
  RoleName:
    Description: Name of ram role.
    Value:
      Fn::GetAtt:
        - Role
        - RoleName

JSON

{
  "ROSTemplateFormatVersion": "2015-09-01",
  "Description": "Test RAM Role",
  "Parameters": {
  },
  "Resources": {
    "Role": {
      "Type": "ALIYUN::RAM::Role",
      "Properties": {
        "RoleName": "TestRole",
        "AssumeRolePolicyDocument": {
          "Statement": [
            {
              "Action": "sts:AssumeRole",
              "Effect": "Allow",
              "Principal": {
                "Service": [
                  "actiontrail.aliyuncs.com"
                ]
              }
            }
          ],
          "Version": "1"
        }
      }
    }
  },
  "Outputs": {
    "RoleId": {
      "Description": "Id of ram role.",
      "Value": {
        "Fn::GetAtt": [
          "Role",
          "RoleId"
        ]
      }
    },
    "Arn": {
      "Description": "Name of alicloud resource.",
      "Value": {
        "Fn::GetAtt": [
          "Role",
          "Arn"
        ]
      }
    },
    "RoleName": {
      "Description": "Name of ram role.",
      "Value": {
        "Fn::GetAtt": [
          "Role",
          "RoleName"
        ]
      }
    }
  }
}

Scénario 2 : Créer un rôle RAM, lui attacher une stratégie personnalisée, autoriser des services spécifiés à endosser le rôle et définir les opérations de la stratégie.

Création rapide

YAML

ROSTemplateFormatVersion: '2015-09-01'
Description:
  en: Create a RAM role, attach a custom policy allowing specified services to assume the role, and define policy operations.
Parameters:
  RoleName:
    Type: String
    Label:
      en: Role Name
    Description:
      en: The name of role, Change the name if it already exists,Consist of english letters, numbers or '-',not more than 64 characters.
    ConstraintDescription:
      en: No more than 64 characters,English letters, Numbers, or '-' are allowed.
    Default: test-role
    AllowedPattern: ^[a-zA-Z0-9\-]+$
    MinLength: 1
    MaxLength: 64
  AssumeRolePrincipalServices:
    Type: Json
    Label:
      en: Principal Services
    Description:
      en: The specifies role-trusted services that can be added more than once.
    Default:
      - ecs.aliyuncs.com
  PolicyName:
    Type: String
    Label:
      en: Policy Name
    Description:
      en: The policy name, Change the name if it already exists,<br>Consist of english letters, numbers or '-', 5-128 characters.
    ConstraintDescription:
      en: Consist of english letters, numbers or '-',5-128 characters.
    Default: test-policy-name
    AllowedPattern: ^[a-zA-Z0-9\-]+$
    MinLength: 5
    MaxLength: 128
  SpecificAction:
    Type: String
    Label:
      en: Specific Action
    Description:
      en: 'The specific action of the policy,Separated by English commas; <a href=''https://www.alibabacloud.com/help/document_detail/93738.html'' target=''_blank''><b><font color=''blue''>View Policy elements - Action</font></font></a><br>For example: <br>[oss.*,ecs.*: <font color=''green''>all the action of oss and ecs</font>]<br>[oss.*: <font color=''green''>all the action of oss</font>]<br>[oss.GetObjectUrl: <font color=''green''>action is GetObjectUrl of oss</font>]<br>.'
    Default: oss.*,ecs.*
Resources:
  RamManagedPolicy:
    Type: ALIYUN::RAM::ManagedPolicy
    Properties:
      PolicyDocument:
        Statement:
          - Action:
              Fn::Split:
                - ','
                - Ref: SpecificAction
            Effect: Allow
            Resource:
              - '*'
        Version: '1'
      PolicyName:
        Ref: PolicyName
  RamRole:
    Type: ALIYUN::RAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
                Ref: AssumeRolePrincipalServices
        Version: '1'
      Policies:
        - PolicyDocument:
            Statement:
              - Action:
                  - ros:*
                Effect: Allow
                Resource:
                  - '*'
            Version: '1'
          PolicyName:
            Fn::Join:
              - ''
              - - Policy-
                - Ref: ALIYUN::StackId
      RoleName:
        Ref: RoleName
  RamAttachPolicyToRole:
    Type: ALIYUN::RAM::AttachPolicyToRole
    Properties:
      PolicyName:
        Fn::GetAtt:
          - RamManagedPolicy
          - PolicyName
      PolicyType: Custom
      RoleName:
        Fn::GetAtt:
          - RamRole
          - RoleName
    DependsOn:
      - RamManagedPolicy
      - RamRole
Outputs:
  PolicyName:
    Value:
      Fn::GetAtt:
        - RamManagedPolicy
        - PolicyName
  RoleArn:
    Value:
      Fn::GetAtt:
        - RamRole
        - Arn
  RoleName:
    Value:
      Fn::GetAtt:
        - RamRole
        - RoleName
Metadata:
  ALIYUN::ROS::Interface:
    ParameterGroups:
      - Parameters:
          - RoleName
          - AssumeRolePrincipalServices
          - PolicyName
          - SpecificAction
        Label:
          default: RAM

JSON

{
  "ROSTemplateFormatVersion": "2015-09-01",
  "Description": {
    "en": "Create a RAM role, attach a custom policy allowing specified services to assume the role, and define policy operations."
  },
  "Parameters": {
    "RoleName": {
      "Type": "String",
      "Label": {
        "en": "Role Name"
      },
      "Description": {
        "en": "The name of role, Change the name if it already exists,Consist of english letters, numbers or '-',not more than 64 characters."
      },
      "ConstraintDescription": {
        "en": "No more than 64 characters,English letters, Numbers, or '-' are allowed."
      },
      "Default": "test-role",
      "AllowedPattern": "^[a-zA-Z0-9\\-]+$",
      "MinLength": 1,
      "MaxLength": 64
    },
    "AssumeRolePrincipalServices": {
      "Type": "Json",
      "Label": {
        "en": "Principal Services"
      },
      "Description": {
        "en": "The specifies role-trusted services that can be added more than once."
      },
      "Default": [
        "ecs.aliyuncs.com"
      ]
    },
    "PolicyName": {
      "Type": "String",
      "Label": {
        "en": "Policy Name"
      },
      "Description": {
        "en": "The policy name, Change the name if it already exists,<br>Consist of english letters, numbers or '-', 5-128 characters."
      },
      "ConstraintDescription": {
        "en": "Consist of english letters, numbers or '-',5-128 characters."
      },
      "Default": "test-policy-name",
      "AllowedPattern": "^[a-zA-Z0-9\\-]+$",
      "MinLength": 5,
      "MaxLength": 128
    },
    "SpecificAction": {
      "Type": "String",
      "Label": {
        "en": "Specific Action"
      },
      "Description": {
        "en": "The specific action of the policy,Separated by English commas; <a href='https://www.alibabacloud.com/help/document_detail/93738.html' target='_blank'><b><font color='blue'>View Policy elements - Action</font></font></a><br>For example: <br>[oss.*,ecs.*: <font color='green'>all the action of oss and ecs</font>]<br>[oss.*: <font color='green'>all the action of oss</font>]<br>[oss.GetObjectUrl: <font color='green'>action is GetObjectUrl of oss</font>]<br>."
      },
      "Default": "oss.*,ecs.*"
    }
  },
  "Resources": {
    "RamManagedPolicy": {
      "Type": "ALIYUN::RAM::ManagedPolicy",
      "Properties": {
        "PolicyDocument": {
          "Statement": [
            {
              "Action": {
                "Fn::Split": [
                  ",",
                  {
                    "Ref": "SpecificAction"
                  }
                ]
              },
              "Effect": "Allow",
              "Resource": [
                "*"
              ]
            }
          ],
          "Version": "1"
        },
        "PolicyName": {
          "Ref": "PolicyName"
        }
      }
    },
    "RamRole": {
      "Type": "ALIYUN::RAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Statement": [
            {
              "Action": "sts:AssumeRole",
              "Effect": "Allow",
              "Principal": {
                "Service": {
                  "Ref": "AssumeRolePrincipalServices"
                }
              }
            }
          ],
          "Version": "1"
        },
        "Policies": [
          {
            "PolicyDocument": {
              "Statement": [
                {
                  "Action": [
                    "ros:*"
                  ],
                  "Effect": "Allow",
                  "Resource": [
                    "*"
                  ]
                }
              ],
              "Version": "1"
            },
            "PolicyName": {
              "Fn::Join": [
                "",
                [
                  "Policy-",
                  {
                    "Ref": "ALIYUN::StackId"
                  }
                ]
              ]
            }
          }
        ],
        "RoleName": {
          "Ref": "RoleName"
        }
      }
    },
    "RamAttachPolicyToRole": {
      "Type": "ALIYUN::RAM::AttachPolicyToRole",
      "Properties": {
        "PolicyName": {
          "Fn::GetAtt": [
            "RamManagedPolicy",
            "PolicyName"
          ]
        },
        "PolicyType": "Custom",
        "RoleName": {
          "Fn::GetAtt": [
            "RamRole",
            "RoleName"
          ]
        }
      },
      "DependsOn": [
        "RamManagedPolicy",
        "RamRole"
      ]
    }
  },
  "Outputs": {
    "PolicyName": {
      "Value": {
        "Fn::GetAtt": [
          "RamManagedPolicy",
          "PolicyName"
        ]
      }
    },
    "RoleArn": {
      "Value": {
        "Fn::GetAtt": [
          "RamRole",
          "Arn"
        ]
      }
    },
    "RoleName": {
      "Value": {
        "Fn::GetAtt": [
          "RamRole",
          "RoleName"
        ]
      }
    }
  },
  "Metadata": {
    "ALIYUN::ROS::Interface": {
      "ParameterGroups": [
        {
          "Parameters": [
            "RoleName",
            "AssumeRolePrincipalServices",
            "PolicyName",
            "SpecificAction"
          ],
          "Label": {
            "default": "RAM"
          }
        }
      ]
    }
  }
}

Scénario 3 : Créer un rôle RAM pour gérer ActionTrail, stocker les journaux d'audit dans un compartiment OSS spécifié et configurer un projet SLS.

Création rapide

YAML

ROSTemplateFormatVersion: '2015-09-01'
Description:
  en: Create RAM roles to manage operation auditing, with audit logs stored in a designated OSS bucket, and configure an SLS project for further log processing and analysis.
Parameters:
  RoleName:
    Type: String
    Label:
      en: Role Name
    Description:
      en: Ram role name, 1 to 64 characters in length, beginning with English letters or numbers, hyphens allowed, unique in the account.
    ConstraintDescription:
      en: 1 to 64 characters in length, beginning with English letters or numbers, hyphens allowed.
    Default: ActionTrailTestRole
    MinLength: 1
    MaxLength: 64
  TrailName:
    Type: String
    Label:
      en: Trail Name
    Description:
      en: Trail Name, 6 to 36 characters in length, must start with a letter, and can contain letters, numbers, dashes (-), and underscores (_), unique in the account
    Default: TestTrail
  EventRW:
    Type: String
    Label:
      en: Event RW
    Description:
      en: Read and write types of delivery events
    Default: Write
    AllowedValues:
      - Write
      - Read
      - All
  OssBucketName:
    Type: String
    Label:
      en: Bucket Name
    Description:
      en: Tracking OSS storage space written
    AssociationProperty: ALIYUN::OSS::Bucket::BucketName
    AssociationPropertyMetadata:
      RegionId: ${RegionId}
  OssKeyPrefix:
    Type: String
    Label:
      en: Key Prefix
    Description:
      en: Track the prefix of the OSS storage space file name written, can be empty. 6 to 32 characters in length, must start with a letter, and can contain letters, numbers, dashes (-), slashes (/), and underscores (_)
    Default: ''
  SlsProjectName:
    Type: String
    Label:
      en: Project Name
    Description:
      en: Log service items to track delivery targets
Resources:
  Role:
    Type: ALIYUN::RAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
                - actiontrail.aliyuncs.com
        Version: '1'
      Policies:
        - PolicyDocument:
            Statement:
              - Action:
                  - oss:ListObjects
                  - oss:PutObject
                  - oss:GetBucketLocation
                Effect: Allow
                Resource:
                  - '*'
              - Action:
                  - log:PostLogStoreLogs
                  - log:CreateLogstore
                Effect: Allow
                Resource:
                  - '*'
              - Action:
                  - mns:PublishMessage
                Effect: Allow
                Resource:
                  - '*'
            Version: '1'
          PolicyName:
            Fn::Sub: ActionTrailPolicy-${ALIYUN::StackId}
      RoleName:
        Ref: RoleName
  Trail:
    Type: ALIYUN::ACTIONTRAIL::Trail
    Properties:
      EventRW:
        Ref: EventRW
      Name:
        Ref: TrailName
      OssBucketName:
        Ref: OssBucketName
      OssKeyPrefix:
        Ref: OssKeyPrefix
      RoleName:
        Fn::GetAtt:
          - Role
          - RoleName
      SlsProjectArn:
        Fn::Sub: acs:log:${ALIYUN::Region}::project/${SlsProjectName}
      SlsWriteRoleArn:
        Fn::Sub: acs:ram::${ALIYUN::TenantId}:role/${Role.RoleName}
    DependsOn: Role
Metadata:
  ALIYUN::ROS::Interface:
    ParameterGroups:
      - Parameters:
          - RoleName
        Label:
          default: RAM
      - Parameters:
          - TrailName
          - EventRW
        Label:
          default: Trail
      - Parameters:
          - OssBucketName
          - OssKeyPrefix
        Label:
          default: OSS
      - Parameters:
          - SlsProjectName
        Label:
          default: SLS

JSON

{
  "ROSTemplateFormatVersion": "2015-09-01",
  "Description": {
    "en": "Create RAM roles to manage operation auditing, with audit logs stored in a designated OSS bucket, and configure an SLS project for further log processing and analysis."
  },
  "Parameters": {
    "RoleName": {
      "Type": "String",
      "Label": {
        "en": "Role Name"
      },
      "Description": {
        "en": "Ram role name, 1 to 64 characters in length, beginning with English letters or numbers, hyphens allowed, unique in the account."
      },
      "ConstraintDescription": {
        "en": "1 to 64 characters in length, beginning with English letters or numbers, hyphens allowed."
      },
      "Default": "ActionTrailTestRole",
      "MinLength": 1,
      "MaxLength": 64
    },
    "TrailName": {
      "Type": "String",
      "Label": {
        "en": "Trail Name"
      },
      "Description": {
        "en": "Trail Name, 6 to 36 characters in length, must start with a letter, and can contain letters, numbers, dashes (-), and underscores (_), unique in the account"
      },
      "Default": "TestTrail"
    },
    "EventRW": {
      "Type": "String",
      "Label": {
        "en": "Event RW"
      },
      "Description": {
        "en": "Read and write types of delivery events"
      },
      "Default": "Write",
      "AllowedValues": [
        "Write",
        "Read",
        "All"
      ]
    },
    "OssBucketName": {
      "Type": "String",
      "Label": {
        "en": "Bucket Name"
      },
      "Description": {
        "en": "Tracking OSS storage space written"
      },
      "AssociationProperty": "ALIYUN::OSS::Bucket::BucketName",
      "AssociationPropertyMetadata": {
        "RegionId": "${RegionId}"
      }
    },
    "OssKeyPrefix": {
      "Type": "String",
      "Label": {
        "en": "Key Prefix"
      },
      "Description": {
        "en": "Track the prefix of the OSS storage space file name written, can be empty. 6 to 32 characters in length, must start with a letter, and can contain letters, numbers, dashes (-), slashes (/), and underscores (_)"
      },
      "Default": ""
    },
    "SlsProjectName": {
      "Type": "String",
      "Label": {
        "en": "Project Name"
      },
      "Description": {
        "en": "Log service items to track delivery targets"
      }
    }
  },
  "Resources": {
    "Role": {
      "Type": "ALIYUN::RAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Statement": [
            {
              "Action": "sts:AssumeRole",
              "Effect": "Allow",
              "Principal": {
                "Service": [
                  "actiontrail.aliyuncs.com"
                ]
              }
            }
          ],
          "Version": "1"
        },
        "Policies": [
          {
            "PolicyDocument": {
              "Statement": [
                {
                  "Action": [
                    "oss:ListObjects",
                    "oss:PutObject",
                    "oss:GetBucketLocation"
                  ],
                  "Effect": "Allow",
                  "Resource": [
                    "*"
                  ]
                },
                {
                  "Action": [
                    "log:PostLogStoreLogs",
                    "log:CreateLogstore"
                  ],
                  "Effect": "Allow",
                  "Resource": [
                    "*"
                  ]
                },
                {
                  "Action": [
                    "mns:PublishMessage"
                  ],
                  "Effect": "Allow",
                  "Resource": [
                    "*"
                  ]
                }
              ],
              "Version": "1"
            },
            "PolicyName": {
              "Fn::Sub": "ActionTrailPolicy-${ALIYUN::StackId}"
            }
          }
        ],
        "RoleName": {
          "Ref": "RoleName"
        }
      }
    },
    "Trail": {
      "Type": "ALIYUN::ACTIONTRAIL::Trail",
      "Properties": {
        "EventRW": {
          "Ref": "EventRW"
        },
        "Name": {
          "Ref": "TrailName"
        },
        "OssBucketName": {
          "Ref": "OssBucketName"
        },
        "OssKeyPrefix": {
          "Ref": "OssKeyPrefix"
        },
        "RoleName": {
          "Fn::GetAtt": [
            "Role",
            "RoleName"
          ]
        },
        "SlsProjectArn": {
          "Fn::Sub": "acs:log:${ALIYUN::Region}::project/${SlsProjectName}"
        },
        "SlsWriteRoleArn": {
          "Fn::Sub": "acs:ram::${ALIYUN::TenantId}:role/${Role.RoleName}"
        }
      },
      "DependsOn": "Role"
    }
  },
  "Metadata": {
    "ALIYUN::ROS::Interface": {
      "ParameterGroups": [
        {
          "Parameters": [
            "RoleName"
          ],
          "Label": {
            "default": "RAM"
          }
        },
        {
          "Parameters": [
            "TrailName",
            "EventRW"
          ],
          "Label": {
            "default": "Trail"
          }
        },
        {
          "Parameters": [
            "OssBucketName",
            "OssKeyPrefix"
          ],
          "Label": {
            "default": "OSS"
          }
        },
        {
          "Parameters": [
            "SlsProjectName"
          ],
          "Label": {
            "default": "SLS"
          }
        }
      ]
    }
  }
}

Pour plus d'exemples, consultez modèles publics qui incluent cette ressource.