Manage the AliyunServiceRoleForSLSAudit service-linked role - Simple Log Service

To obtain the resources of other cloud services by using a Simple Log Service application, such as Log Audit Service or EBS Lens, you can assign the AliyunServiceRoleForSLSAudit service-linked role to the application. This topic describes the scenarios and policy of the AliyunServiceRoleForSLSAudit service-linked role.

Scenarios

When you collect the logs from specific cloud services in a Simple Log Service application, such as Log Audit Service or EBS Lens, Simple Log Service calls the API operations of the cloud services to obtain the information of the cloud services. To collect the required information, Simple Log Service must assume the AliyunServiceRoleForSLSAudit service-linked role to obtain the required permissions to read the data of resources from the cloud services and modify the settings of log collection. For more information, see Service-linked roles.

Description

Note

When you activate Simple Log Service, a service-linked role named AliyunServiceRoleForSLSAlert is automatically created.

Role name: AliyunServiceRoleForSLSAudit.
Policy attached to the role: AliyunServiceRolePolicyForSLSAudit.

Policy document:

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "resourcemanager:ListAccounts",
                "resourcemanager:GetAccount",
                "resourcemanager:GetResourceDirectory",
                "resourcemanager:GetFolder",
                "resourcemanager:ListFoldersForParent",
                "resourcemanager:ListAccountsForParent",
                "rds:DescribeRegions",
                "rds:DescribeSqlLogInstances",
                "rds:DescribeDBInstanceAttribute",
                "rds:ListTagResources",
                "rds:DisableSqlLogDistribution",
                "rds:EnableSqlLogDistribution",
                "rds:ModifySQLCollectorPolicy",
                "rds:DescribeSQLCollectorRetention",
                "polardb:DescribeRegions",
                "polardb:DescribeDBClusters",
                "polardb:DescribeSqlLogClusters",
                "polardb:ModifyDBClusterAuditLogCollector",
                "polardb:DescribeDBClusterAttribute",
                "polardb:DescribeSQLExplorerRetention",
                "kvstore:DescribeRegions",
                "kvstore:DescribeInstances",
                "kvstore:DescribeRedisLogConfig",
                "kvstore:ModifyAuditLogConfig",
                "kvstore:DescribeInstanceAttribute",
                "kvstore:DescribeEngineVersion",
                "kvstore:InitializeKvstorePermission",
                "drds:DescribeDrdsInstances",
                "drds:DescribeDrdsDBs",
                "drds:EnableSqlAuditExtraWrite",
                "drds:DisableSqlAuditExtraWrite",
                "drds:DescribeDrdsRegions",
                "drds:DescribeDrdsSqlAuditStatus",
                "slb:DescribeRegions",
                "slb:DescribeLoadBalancers",
                "slb:DescribeLoadBalancerAttribute",
                "slb:SetAccessLogsDownloadAttribute",
                "slb:DeleteAccessLogsDownloadAttribute",
                "slb:DescribeAccessLogsDownloadAttribute",
                "slb:ListTagResources",
                "alb:DescribeRegions",
                "alb:ListLoadBalancers",
                "alb:EnableLoadBalancerAccessLog",
                "alb:DisableLoadBalancerAccessLog",
                "alb:GetLoadBalancerAttribute",
                "cs:GetClustersByUid",
                "cs:GetClusters",
                "kms:DescribeKeyStores",
                "oss:GetBucketInfo",
                "oss:ListBuckets",
                "oss:GetBucketTagging",
                "oss:GetBucketWorm",
                "oss:GetBucketLifecycle",
                "oss:GetBucketReferer",
                "ecs:DescribeDisks",
                "ecs:DescribeSnapshots",
                "ecs:DescribeRegions",
                "ecs:DescribeInstances",
                "mse:GetGateway",
                "cen:ListTransitRouters",
                "cen:ListTransitRouterPeerAttachments",
                "cen:ListTransitRouterVbrAttachments",
                "vpc:DescribeVpcs",
                "vpc:GetNatGatewayAttribute",
                "vpc:DescribeNatGateways",
                "vpc:DescribeRegions",
                "hbase:DescribeInstance",
                "lindorm:GetLindormInstance"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "oos:StartExecution",
                "oos:ListExecutions"
            ],
            "Resource": [
                "acs:oos:*:*:template/ACS-LOG-BulkyInstallLogtail",
                "acs:oos:*:*:execution/*"
            ],
            "Effect": "Allow"
        },
        {
            "Action": [
                "ecs:InvokeCommand",
                "ecs:DescribeInvocations",
                "ecs:DescribeInvocationResults",
                "ecs:DescribeCloudAssistantStatus"
            ],
            "Resource": [
                "acs:ecs:*:*:instance/*",
                "acs:ecs:*:*:command/cmd-ACS-LOG-InstallLogtail-*"
            ],
            "Effect": "Allow"
        },
        {
            "Action": [
                "log:CreateProject",
                "log:GetProject",
                "log:ListProject",
                "log:ListLogStores",
                "log:GetLogStore",
                "log:GetLogStoreLogs",
                "log:PostLogStoreLogs",
                "log:BatchPostLogStoreLogs",
                "log:CreateIndex",
                "log:UpdateIndex",
                "log:CreateDashboard",
                "log:UpdateDashboard",
                "log:CreateLogStore",
                "log:CreateSavedSearch",
                "log:UpdateSavedSearch",
                "log:CreateJob",
                "log:UpdateJob",
                "log:ListShards",
                "log:GetCursorOrData",
                "log:GetConsumerGroupCheckPoint",
                "log:UpdateConsumerGroup",
                "log:ConsumerGroupHeartBeat",
                "log:ConsumerGroupUpdateCheckPoint",
                "log:ListConsumerGroup",
                "log:CreateConsumerGroup",
                "log:GetLogging",
                "log:CreateLogging",
                "log:UpdateLogging",
                "log:DeleteLogging",
                "log:PostProjectQuery",
                "log:GetProjectQuery",
                "log:PutProjectQuery",
                "log:DeleteProjectQuery",
                "log:GetMachineGroup",
                "log:ListMachineGroup"
            ],
            "Resource": [
                "acs:log:*:*:project/*"
            ],
            "Effect": "Allow"
        },
        {
            "Action": [
                "log:GetApp",
                "log:UpdateApp",
                "log:CreateApp"
            ],
            "Resource": [
                "acs:log:*:*:app/audit"
            ],
            "Effect": "Allow"
        },
        {
            "Action": "ram:CreateServiceLinkedRole",
            "Resource": "*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": [
                        "r-kvstore.aliyuncs.com",
                        "logdelivery.alb.aliyuncs.com"
                    ]
                }
            }
        },
        {
            "Action": "ram:DeleteServiceLinkedRole",
            "Resource": "*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": "audit.log.aliyuncs.com"
                }
            }
        }
    ]
}