RAM存取控制權限原則參考-Log Service-阿里雲 - Simple Log Service

存取控制（RAM）是阿里雲提供的系統管理使用者身份與資源存取權限的服務。使用 RAM 可以讓您避免與其他使用者共用阿里雲帳號密鑰，並可按需為使用者授予最小許可權。RAM 中使用權限原則描述授權的具體內容。

本文為您介紹 Simple Log Service 為 RAM 權限原則定義的操作（Action）、資源（Resource）和條件（Condition）。 Simple Log Service 的 RAM 代碼（RamCode）為 log ，支援的授權粒度為 RESOURCE 。

權限原則通用結構

權限原則支援 JSON 格式，其通用結構如下：

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

各欄位含義如下：

Effect：權限原則效果。取值：Allow（允許）、Deny（拒絕）。
Action：授予允許或拒絕許可權的具體操作。具體資訊，請參見操作（Action）。
Resource：受操作影響的具體對象，您可以使用資源 ARN 來描述指定資源。具體資訊，請參見資源（Resource）。
Condition：指授權生效的條件。可選欄位。具體資訊，請參見條件（Condition）。
- Condition_operator：條件運算子，不同類型的條件對應不同的條件運算子。具體資訊，請參見權限原則基本元素。
- Condition_key：條件關鍵字。
- Condition_value：條件關鍵字對應的值。

操作（Action）

下表是Simple Log Service定義的操作，這些操作可以在 RAM 權限原則語句的Action元素中使用，用來授予執行該操作的許可權。下面對錶中的具體項提供說明：

操作：是指具體的許可權點。
API：是指操作對應的 API 介面。
存取層級：是指每個操作的存取層級，取值為寫入（Write）、讀取（Read）或列出（List）。
資源類型：是指操作中支援授權的資源類型。具體說明如下：
- 對於必選的資源類型，用前面加 * 表示。
- 對於不支援資源級授權的操作，用全部資源表示。
條件關鍵字：是指雲產品自身定義的條件關鍵字。該列不體現適用於任何操作的通用條件關鍵字。
關聯操作：是指成功執行操作所需要的其他許可權。操作者必須同時具備關聯操作的許可權，操作才能成功。

操作	API	存取層級	資源類型	條件關鍵字	關聯操作
log:CreateAlert	CreateAlert	create	All Resource ``	無	無
log:DeleteMetricStore	DeleteMetricStore	delete	*MetricStore `acs:log:{#regionId}:{#accountId}:project/{#project}/metricstore/{#name}`	無	無
log:GetStoreView	GetStoreView	get	All Resource ``	無	無
log:GetConfig	GetConfig	get	*Project `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/logtailconfig/{#LogtailConfigName}`	log:TLSVersion	無
log:GetMetricStore	GetMetricStore	get	*MetricStore `acs:log:{#regionId}:{#accountId}:project/{#project}/metricstore/{#name}`	無	無
log:CreateSavedSearch	CreateSavedSearch	create	*Project `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/savedsearch/{#SavedSearchName}`	log:TLSVersion	無
log:ListOSSHDFSExports	ListOSSHDFSExports	list	All Resource ``	無	無
log:ListGCSIngestions	ListGCSIngestions	list	All Resource ``	無	無
log:GetMetricStoreMeteringMode	GetMetricStoreMeteringMode	get	All Resource ``	無	無
log:ListMaterializedViews	ListMaterializedViews	list	MaterializedView `acs:log:{#regionId}:{#accountId}:project/{#project}/materializedview/`	無	無
log:CreateGCSIngestion	CreateGCSIngestion	create	All Resource ``	無	無
log:ListTagResources	ListTagResources	get	*Project `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}`	log:TLSVersion	無
log:EnableAlert	EnableAlert	none	All Resource ``	無	無
log:CreateDownloadJob	CreateDownloadJob	create	*Project `acs:log:{#regionId}:{#accountId}:project/{#project}/downloadjob/{#downloadJobName}`	無	無
log:DeleteCollectionPolicy	DeleteCollectionPolicy	delete	*CollectionPolicy `acs:log::{#accountId}:collectionpolicy/{#policyName}`	log:TLSVersion	無
log:ListProject	ListProject	get	Project `acs:log:{#regionId}:{#accountId}:project/`	log:TLSVersion	無
log:GetAppliedMachineGroups	GetAppliedMachineGroups	get	*Project `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/logtailconfig/{#LogtailConfigName}`	log:TLSVersion	無
log:StartETL	StartETL	none	*Project `acs:log:{#regionId}:{#accountId}:project/{#project}/etl/{#etlName}`	無	無
log:UpdateProject	UpdateProject	update	*Project `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}`	log:TLSVersion	無
log:GetGCSIngestion	GetGCSIngestion	get	All Resource ``	無	無
log:ListLogtailPipelineConfig	ListLogtailPipelineConfig	list	All Resource ``	log:TLSVersion	無
log:CreateSqlInstance	CreateSqlInstance	create	*Project `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}`	無	無
log:GetMachineGroup	GetMachineGroup	get	*Project `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/machinegroup/{#MachineGroupName}`	log:TLSVersion	無
log:CreateLogStore	CreateLogStore	create	*LogStore `acs:log:{#regionId}:{#accountId}:project/{#project}/logstore/{#logstoreName}`	log:TLSVersion log:Encrypted	無
log:CreateConfig	CreateConfig	create	*Project `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/logtailconfig/{#LogtailConfigName}`	log:TLSVersion	無
log:UpdateOSSExport	UpdateOSSExport	update	All Resource ``	無	無
log:UpdateMaxComputeExport	UpdateMaxComputeExport	update	All Resource ``	無	無
log:GetCursorOrData	GetCursorTime	get	*LogStore `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/logstore/{#LogstoreName}`	log:TLSVersion	無
log:StopETL	StopETL	none	*Project `acs:log:{#regionId}:{#accountId}:project/{#project}/etl/{#etlName}`	無	無
log:GetAzureBlobIngestion	GetAzureBlobIngestion	get	*AzureBlobIngestion `acs:log:{#regionId}:{#accountId}:project/{#project}/azureblobingestion/{#azureBlobIngestionName}`	無	無
log:CreateScheduledSQL	CreateScheduledSQL	create	*Project `acs:log:{#regionId}:{#accountId}:project/{#project}/scheduledsql/{#scheduledSQLName}`	無	無
log:UpdateETL	UpdateETL	update	*Project `acs:log:{#regionId}:{#accountId}:project/{#project}/etl/{#etlName}`	無	無
log:DeleteSavedSearch	DeleteSavedSearch	delete	*Project `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/savedsearch/{#SavedSearchName}`	log:TLSVersion	無
log:UpdateMetricStore	UpdateMetricStore	update	*MetricStore `acs:log:{#regionId}:{#accountId}:project/{#project}/metricstore/{#name}`	無	無
log:GetProject	GetProject	get	*Project `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}`	log:TLSVersion	無
log:PutIngestProcessor	PutIngestProcessor	update	*IngestProcessor `acs:log:{#regionId}:{#accountId}:project/{#project}/ingestprocessor/{#processorName}`	log:TLSVersion	無
log:GetApiKey	GetApiKey	get	*Project `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/apikey/{#ApiKeyName}`	無	無
log:GetScheduledSQL	GetScheduledSQL	get	*Project `acs:log:{#regionId}:{#accountId}:project/{#project}/scheduledsql/{#scheduledSQLName}`	無	無
log:DescribeService	GetSlsService	get	*Service `acs:log::{#AccountId}:service`	log:TLSVersion	無
log:DeleteLogtailPipelineConfig	DeleteLogtailPipelineConfig	delete	All Resource ``	log:TLSVersion	無
log:UpdateScheduledSQL	UpdateScheduledSQL	update	*Project `acs:log:{#regionId}:{#accountId}:project/{#project}/scheduledsql/{#scheduledSQLName}`	無	無
log:DeleteDownloadJob	DeleteDownloadJob	delete	*Project `acs:log:{#regionId}:{#accountId}:project/{#project}/downloadjob/{#downloadJobName}`	無	無
log:DeleteScheduledSQL	DeleteScheduledSQL	delete	*Project `acs:log:{#regionId}:{#accountId}:project/{#project}/scheduledsql/{#scheduledSQLName}`	無	無
log:CreateConsumerGroup	CreateConsumerGroup	create	*LogStore `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/logstore/{#logstoreName}/consumergroup/{#ConsumerGroup}`	log:TLSVersion	無
log:ConsumerGroupHeartBeat	ConsumerGroupHeartBeat	none	All Resource ``	log:TLSVersion	無
log:CallAiTools	CallAiTools	none	All Resource ``	無	無
log:UpdateMachineGroupMachine	UpdateMachineGroupMachine	update	All Resource ``	log:TLSVersion	無
log:GetLogtailPipelineConfig	GetLogtailPipelineConfig	get	All Resource ``	log:TLSVersion	無
log:GetLogStore	GetLogStore	get	*LogStore `acs:log:{#regionId}:{#accountId}:project/{#project}/logstore/{#logstore}`	log:TLSVersion	無
log:CreateProject	CreateProject	create	*Project `acs:log:{#regionId}:{#accountId}:project/{#projectName}`	log:TLSVersion	無
log:ConsumerGroupUpdateCheckPoint	ConsumerGroupUpdateCheckPoint	update	All Resource ``	log:TLSVersion	無
log:GetETL	GetETL	get	*Project `acs:log:{#regionId}:{#accountId}:project/{#project}/etl/{#etlName}`	無	無
log:ListStoreViews	ListStoreViews	list	All Resource ``	無	無
log:CreateAgentInstanceConfig	CreateAgentInstanceConfig	create	All Resource ``	log:TLSVersion	無
log:DeleteDomain	DeleteDomain	delete	*Project `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/domain/{#DomainName}`	log:TLSVersion	無
log:UpdateMachineGroup	UpdateMachineGroup	update	*Project `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/machinegroup/{#MachineGroupName}`	log:TLSVersion	無
log:ListConsumerGroup	ListConsumerGroup	get	LogStore `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/logstore/{#LogstoreName}/consumergroup/`	log:TLSVersion	無
log:ListMachines	ListMachines	get	*Project `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/machinegroup/{#MachineGroupName}`	log:TLSVersion	無
log:GetDashboard	GetDashboard	get	*Project `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/dashboard/{#DashboardName}`	log:TLSVersion	無
log:StopOSSIngestion	StopOSSIngestion	none	All Resource ``	無	無
log:ListOSSExports	ListOSSExports	list	All Resource ``	無	無
log:DisableAlert	DisableAlert	none	All Resource ``	無	無
log:DeleteS3Ingestion	DeleteS3Ingestion	delete	All Resource ``	無	無
log:UpdateLogStoreMeteringMode	UpdateLogStoreMeteringMode	update	All Resource ``	log:TLSVersion	無
log:DeleteIndex	DeleteIndex	delete	*LogStore `acs:log:{#regionId}:{#accountId}:project/{#project}/logstore/{#logstore}`	log:TLSVersion	無
log:GetLogStoreMeteringMode	GetLogStoreMeteringMode	get	All Resource ``	無	無
log:RefreshToken	RefreshToken	create	All Resource ``	log:TLSVersion	無
log:UpdateIndex	UpdateIndex	update	*LogStore `acs:log:{#regionId}:{#accountId}:project/{#project}/logstore/{#logstore}`	log:TLSVersion	無
log:GetIndex	GetIndex	get	*LogStore `acs:log:{#regionId}:{#accountId}:project/{#project}/logstore/{#logstore}`	log:TLSVersion	無
log:GetS3Ingestion	GetS3Ingestion	get	All Resource ``	無	無
log:ListETLs	ListETLs	list	Project `acs:log:{#regionId}:{#accountId}:project/{#project}/etl/`	無	無
log:DeleteConfig	DeleteConfig	delete	All Resource ``	log:TLSVersion	無
log:CreateAzureBlobIngestion	CreateAzureBlobIngestion	create	All Resource ``	無	無
log:GetOSSIngestion	GetOSSIngestion	get	All Resource ``	無	無
log:StartOSSIngestion	StartOSSIngestion	none	All Resource ``	無	無
log:ListAlerts	ListAlerts	list	Alert `acs:log:{#regionId}:{#accountId}:project/{#project}/alert/`	無	無
log:CreateMetricStore	CreateMetricStore	create	*MetricStore `acs:log:{#regionId}:{#accountId}:project/{#project}/metricstore/{#name}`	無	無
log:CreateApiKey	CreateApiKey	create	*Project `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/apikey/{#ApiKeyName}`	無	無
log:GetLogStoreConfig	GetLogStoreConfig	get	*LogStore `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/logstore/{#LogstoreName}`	無	無
log:GetSqlInstance	GetSqlInstance	none	*Project `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}`	無	無
log:DeleteLogStore	DeleteLogStore	delete	*LogStore `acs:log:{#regionId}:{#accountId}:project/{#project}/logstore/{#logstore}`	log:TLSVersion	無
log:EnableService	OpenSlsService	create	*Service `acs:log::{#AccountId}:service`	log:TLSVersion	無
log:GetMLServiceResults	GetMLServiceResults	none	All Resource ``	無	無
log:ListShards	ListShards	get	*LogStore `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/logstore/{#LogstoreName}`	log:TLSVersion	無
log:CreateETL	CreateETL	create	*Project `acs:log:{#regionId}:{#accountId}:project/{#project}/etl/{#etlName}`	無	無
log:UpsertCollectionPolicy	UpsertCollectionPolicy	create	*CollectionPolicy `acs:log::{#accountId}:collectionpolicy/{#policyName}`	log:TLSVersion	無
log:GetStoreViewIndex	GetStoreViewIndex	get	All Resource ``	無	無
log:GetConsumeProcessor	GetConsumeProcessor	get	*ConsumeProcessor `acs:log:{#regionId}:{#accountId}:project/{#project}/consumeprocessor/{#processorName}`	log:TLSVersion	無
log:CreateOSSIngestion	CreateOSSIngestion	create	All Resource ``	無	無
log:ListAgentInstanceConfigs	ListAgentInstanceConfigs	list	All Resource ``	log:TLSVersion	無
log:CreateTicket	CreateTicket	create	All Resource ``	log:TLSVersion	無
log:RemoveConfigFromGroup	RemoveConfigFromMachineGroup	delete	Project `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/machinegroup/{#MachineGroupName}` Project `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/logtailconfig/{#LogtailConfigName}`	log:TLSVersion	無
log:UpdateLogStoreEncryption	UpdateLogStoreEncryption	update	*LogStore `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/logstore/{#LogstoreName}`	無	無
log:PutConsumeProcessor	PutConsumeProcessor	create	*ConsumeProcessor `acs:log:{#regionId}:{#accountId}:project/{#project}/consumeprocessor/{#processorName}`	log:TLSVersion	無
log:DeleteDashboard	DeleteDashboard	delete	All Resource ``	log:TLSVersion	無
log:ChangeResourceGroup	ChangeResourceGroup	update	*Project `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}`	log:TLSVersion	無
log:ListScheduledSQLs	ListScheduledSQLs	none	All Resource ``	無	無
log:ListLogStores	ListLogStores	get	LogStore `acs:log:{#regionId}:{#accountId}:project/{#project}/logstore/`	log:TLSVersion	無
log:UpdateLogStore	UpdateLogStore	update	*LogStore `acs:log:{#regionId}:{#accountId}:project/{#project}/logstore/{#logstore}`	log:TLSVersion log:Encrypted	無
log:ListDownloadJobs	ListDownloadJobs	list	Project `acs:log:{#regionId}:{#accountId}:project/{#project}/downloadjob/`	無	無
log:StopOSSExport	StopOSSExport	none	All Resource ``	無	無
log:GetAgentInstanceConfig	GetAgentInstanceConfig	get	*AgentInstanceConfig `acs:log:{#regionId}:{#accountId}:agentinstanceconfig/{#configType}`	log:TLSVersion	無
log:CreateDomain	CreateDomain	create	*Project `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/domain/{#DomainName}`	log:TLSVersion	無
log:CreateStoreView	CreateStoreView	create	All Resource ``	無	無
log:ListConsumeProcessors	ListConsumeProcessors	list	ConsumeProcessor `acs:log:{#regionId}:{#accountId}:project/{#project}/consumeprocessor/`	log:TLSVersion	無
log:GetIngestProcessor	GetIngestProcessor	get	*IngestProcessor `acs:log:{#regionId}:{#accountId}:project/{#project}/ingestprocessor/{#processorName}`	log:TLSVersion	無
log:EnableScheduledSQL	EnableScheduledSQL	none	*Project `acs:log:{#regionId}:{#accountId}:project/{#project}/scheduledsql/{#scheduledSQLName}`	無	無
log:DeleteProject	DeleteProject	delete	*Project `acs:log:{#regionId}:{#accountId}:project/{#project}`	log:TLSVersion	無
log:ListCollectionPolicies	ListCollectionPolicies	list	CollectionPolicy `acs:log::{#accountId}:collectionpolicy/`	log:TLSVersion	無
log:UntagResources	UntagResources	delete	*Project `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}`	log:TLSVersion	無
log:GetMaterializedView	GetMaterializedView	get	All Resource ``	無	無
log:ListMetricStores	ListMetricStores	list	MetricStore `acs:log:{#regionId}:{#accountId}:project/{#project}/metricstore/`	無	無
log:GetCursorOrData	GetCursor	get	*LogStore `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/logstore/{#LogstoreName}`	log:TLSVersion	無
log:GetAppliedConfigs	GetAppliedConfigs	get	*Project `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/machinegroup/{#MachineGroupName}`	log:TLSVersion	無
log:ListIngestProcessors	ListIngestProcessors	list	IngestProcessor `acs:log:{#regionId}:{#accountId}:project/{#project}/ingestprocessor/`	log:TLSVersion	無
log:ListAnnotationDataSets	ListAnnotationDataSets	none	All Resource ``	無	無
log:DeleteStoreView	DeleteStoreView	delete	All Resource ``	無	無
log:DeleteMachineGroup	DeleteMachineGroup	delete	*Project `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/machinegroup/{#MachineGroupName}`	log:TLSVersion	無
log:ApplyConfigToGroup	ApplyConfigToMachineGroup	update	Project `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/machinegroup/{#MachineGroupName}` Project `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/logtailconfig/{#LogtailConfigName}`	log:TLSVersion	無
log:CreateMaxComputeExport	CreateMaxComputeExport	create	All Resource ``	無	無
log:ListMachineGroup	ListMachineGroup	get	Project `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/machinegroup/`	log:TLSVersion	無
log:DisableScheduledSQL	DisableScheduledSQL	none	*Project `acs:log:{#regionId}:{#accountId}:project/{#project}/scheduledsql/{#scheduledSQLName}`	無	無
log:CreateMachineGroup	CreateMachineGroup	create	*Project `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/machinegroup/{#MachineGroupName}`	log:TLSVersion	無
log:CreateLogging	CreateLogging	create	*Project `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/logging`	log:TLSVersion	無
log:ListSavedSearch	ListSavedSearch	get	Project `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/savedsearch/`	log:TLSVersion	無
log:DeleteLogging	DeleteLogging	delete	*Project `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/logging`	log:TLSVersion	無
log:GetMaxComputeExport	GetMaxComputeExport	get	All Resource ``	無	無
log:UpdateDashboard	UpdateDashboard	update	*Project `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/dashboard/{#DashboardName}`	log:TLSVersion	無
log:CreateDashboard	CreateDashboard	create	All Resource ``	log:TLSVersion	無
log:GetCollectionPolicy	GetCollectionPolicy	get	*CollectionPolicy `acs:log::{#accountId}:collectionpolicy/{#policyName}`	log:TLSVersion	無
log:GetOSSHDFSExport	GetOSSHDFSExport	get	All Resource ``	無	無
log:CreateIndex	CreateIndex	create	*LogStore `acs:log:{#regionId}:{#accountId}:project/{#project}/logstore/{#logstore}`	log:TLSVersion	無
log:DeleteConsumerGroup	DeleteConsumerGroup	delete	*LogStore `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/logstore/{#logstoreName}/consumergroup/{#ConsumerGroup}`	log:TLSVersion	無
log:PutProjectPolicy	PutProjectPolicy	create	All Resource ``	log:TLSVersion	無
log:UpdateOSSIngestion	UpdateOSSIngestion	update	All Resource ``	無	無
log:UpdateLogtailPipelineConfig	UpdateLogtailPipelineConfig	update	All Resource ``	log:TLSVersion	無
log:ListOSSIngestions	ListOSSIngestions	list	All Resource ``	無	無
log:UpdateStoreView	UpdateStoreView	update	All Resource ``	無	無
log:GetSavedSearch	GetSavedSearch	get	*Project `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/savedsearch/{#SavedSearchName}`	log:TLSVersion	無
log:CreateS3Ingestion	CreateS3Ingestion	create	All Resource ``	無	無
log:StartOSSExport	StartOSSExport	none	All Resource ``	無	無
log:UpdateMetricStoreMeteringMode	UpdateMetricStoreMeteringMode	update	All Resource ``	無	無
log:DeleteIngestProcessor	DeleteIngestProcessor	delete	*IngestProcessor `acs:log:{#regionId}:{#accountId}:project/{#project}/ingestprocessor/{#processorName}`	log:TLSVersion	無
log:UpdateConfig	UpdateConfig	update	*Project `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/logtailconfig/{#LogtailConfigName}`	log:TLSVersion	無
log:GetLogging	GetLogging	get	*Project `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/logging`	log:TLSVersion	無
log:DeleteConsumeProcessor	DeleteConsumeProcessor	delete	*ConsumeProcessor `acs:log:{#regionId}:{#accountId}:project/{#project}/consumeprocessor/{#processorName}`	log:TLSVersion	無
log:UpdateConsumerGroup	UpdateConsumerGroup	update	*LogStore `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/logstore/{#logstoreName}/consumergroup/{#ConsumerGroup}`	log:TLSVersion	無
log:DeleteOSSIngestion	DeleteOSSIngestion	delete	All Resource ``	無	無
log:UpdateAlert	UpdateAlert	update	All Resource ``	無	無
log:UpdateSavedSearch	UpdateSavedSearch	update	*Project `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/savedsearch/{#SavedSearchName}`	log:TLSVersion	無
log:UpdateAgentInstanceConfig	UpdateAgentInstanceConfig	update	*AgentInstanceConfig `acs:log:{#regionId}:{#accountId}:agentinstanceconfig/{#configType}`	log:TLSVersion	無
log:UpdateLogStoreProcessor	UpdateLogStoreProcessor	update	*LogStore `acs:log:{#regionId}:{#accountId}:project/{#project}/logstore/{#logstore}`	無	無
log:ListS3Ingestions	ListS3Ingestions	list	All Resource ``	無	無
log:UpdateLogging	UpdateLogging	update	*Project `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/logging`	log:TLSVersion	無
log:ListAiTools	ListAiTools	list	All Resource ``	無	無
log:TagResources	TagResources	create	*Project `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}`	log:TLSVersion	無
log:GetAnnotationLabel	GetAnnotationLabel	none	All Resource ``	無	無
log:GetProjectPolicy	GetProjectPolicy	get	All Resource ``	log:TLSVersion	無
log:GetJobInstance	GetJobInstance	get	All Resource ``	無	無
log:DeleteOSSExport	DeleteOSSExport	delete	All Resource ``	無	無
log:CreateLogtailPipelineConfig	CreateLogtailPipelineConfig	create	All Resource ``	log:TLSVersion	無
log:GetAlert	GetAlert	get	All Resource ``	無	無
log:GetOSSExport	GetOSSExport	get	All Resource ``	無	無
log:UpdateSqlInstance	UpdateSqlInstance	update	*Project `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}`	無	無
log:DeleteAlert	DeleteAlert	delete	All Resource ``	無	無
log:ListConfig	ListConfig	list	Project `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/logtailconfig/`	log:TLSVersion	無
log:GetDownloadJob	GetDownloadJob	get	*Project `acs:log:{#regionId}:{#accountId}:project/{#project}/downloadjob/{#downloadJobName}`	無	無
log:CreateOSSExport	CreateOSSExport	create	All Resource ``	無	無
log:ListJobInstances	ListJobInstances	get	All Resource ``	無	無
log:DeleteProjectPolicy	DeleteProjectPolicy	delete	All Resource ``	log:TLSVersion	無
log:DeleteETL	DeleteETL	delete	*Project `acs:log:{#regionId}:{#accountId}:project/{#project}/etl/{#etlName}`	無	無
log:SplitShard	SplitShard	update	*LogStore `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/logstore/{#LogstoreName}`	log:TLSVersion	無
log:CreateMaterializedView	CreateMaterializedView	create	All Resource ``	無	無
log:MergeShard	MergeShard	update	*LogStore `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/logstore/{#LogstoreName}`	log:TLSVersion	無
log:ListDashboard	ListDashboard	list	Project `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/dashboard/`	log:TLSVersion	無
log:ListDomains	ListDomains	get	Project `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/domain/`	log:TLSVersion	無
log:DeleteMaterializedView	DeleteMaterializedView	delete	All Resource ``	無	無

資源（Resource）

下表是Simple Log Service定義的資源，這些資源可以在 RAM 權限原則語句的Resource元素中使用，用來授予對該資源執行具體操作的許可權。其中，資源 ARN 是資源在阿里雲上的唯一標識。具體說明如下：

{#}為變數標識，需要您替換為實際值。例如：{#ramcode}需要您替換為實際的雲端服務RAM代碼。
*表示全部。例如：
- {#resourceType}為*時：表示全部資源。
- {#regionId}為*時：表示全部地區。
- {#accountId}為*時：表示全部阿里雲帳號。

資源類型	資源 ARN
LogStore	acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/logstore/{#LogstoreName} acs:log:{#regionId}:{#accountId}:project/{#project}/logstore/{#logstoreName} acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/logstore/{#logstoreName}/consumergroup/{#ConsumerGroup} acs:log:${regionId}:${accountId}:project/{#ProjectName}/logstore/{#LogstoreName}/consumergroup/{#ConsumerGroupName} acs:log:{#regionId}:{#accountId}:project/{#project}/logstore/{#logstore} acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/logstore/{#LogstoreName}/consumergroup/* acs:log:{#Region}:{#AccountId}:project/{#ProjectName}/logstore/{#LogstoreName} acs:log:{#regionId}:{#accountId}:project/{#project}/logstore/* acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/logstore/{l#ogstoreName}/consumergroup/{#ConsumerGroup}
MetricStore	acs:log:{#regionId}:{#accountId}:project/{#project}/metricstore/{#name} acs:log:{#regionId}:{#accountId}:project/{#project}/metricstore/* acs:log:{#regionId}:{#accountId}:project/{#project}/metricstore/{#metricstore}
Project	acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/logtailconfig/{#LogtailConfigName} acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/savedsearch/{#SavedSearchName} acs:log:{#regionId}:{#accountId}:project/{#ProjectName} acs:log:{#regionId}:{#accountId}:project/{#project}/downloadjob/{#downloadJobName} acs:log:{#regionId}:{#accountId}:project/* acs:log:{#regionId}:{#accountId}:project/{#project}/etl/{#etlName} acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/machinegroup/{#MachineGroupName} acs:log:{#regionId}:{#accountId}:project/{#project}/scheduledsql/{#scheduledSQLName} acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/apikey/{#ApiKeyName} acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/machinegroup/{MachineGroup} acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/domain/{#DomainName} acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/dashboard/{#DashboardName} acs:log:{#regionId}:{#accountId}:project/{#project}/etl/* acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/logtailconfig/{#LogtailConfigName} acs:log:{#regionId}:{#accountId}:project/{#ProjectName}//dashboard/{#DashboardName} acs:log:{#regionId}:{#accountId}:project/{#project}/scheduledsql/* acs:log:{#regionId}:{#accountId}:project/{#project}/downloadjob/* acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/apikey/* acs:log:{#regionId}:{#accountId}:project/{#project} acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/machinegroup/* acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/logging acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/savedsearch/* acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/dashboard/{#DashboardName} acs:log:{#regionId}:{#accountId}:project/{#project}/scheduledsql/{#jobName} acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/logtailconfig/* acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/dashboard/* acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/domain/*
MaterializedView	acs:log:{#regionId}:{#accountId}:project/{#project}/materializedview/*
CollectionPolicy	acs:log::{#accountId}:collectionpolicy/{#policyName} acs:log::{#accountId}:collectionpolicy/*
AzureBlobIngestion	acs:log:{#regionId}:{#accountId}:project/{#project}/azureblobingestion/{#azureBlobIngestionName} acs:log:{#regionId}:{#accountId}:project/{#project}/azureblobingestion/*
IngestProcessor	acs:log:{#regionId}:{#accountId}:project/{#project}/ingestprocessor/{#processorName} acs:log:{#regionId}:{#accountId}:project/{#project}/ingestprocessor/*
Service	acs:log::{#AccountId}:service
AgentInstanceConfig	acs:log:{#regionId}:{#accountId}:agentinstanceconfig/* acs:log:{#regionId}:{#accountId}:agentinstanceconfig/{#configType}
Ticket	acs:log::{#accountId}:ticket/*
Alert	acs:log:{#regionId}:{#accountId}:project/{#project}/alert/*
Region	acs:log:{#regionId}:{#accountId}:*
ConsumeProcessor	acs:log:{#regionId}:{#accountId}:project/{#project}/consumeprocessor/{#processorName} acs:log:{#regionId}:{#accountId}:project/{#project}/consumeprocessor/*
ESIngestion	acs:log:{#regionId}:{#accountId}:project/{#project}/elasticsearchingestion/*
S3Ingestion	acs:log:{#regionId}:{#accountId}:project/{#project}/s3ingestion/*

條件（Condition）

下表是Simple Log Service 定義的產品級條件關鍵字，這些條件關鍵字可以在 RAM 權限原則語句的Condition元素中使用，用來描述授予許可權的條件。以下僅列舉產品級的條件關鍵字，阿里雲定義的通用條件關鍵字也同樣適用Simple Log Service。

其中，資料類型決定了您可以使用哪些條件運算子將請求中的值與權限原則語句中的值進行比較。您必須使用與資料類型匹配的條件運算子，否則無法匹配策略語句，授權行為無效。資料類型與條件運算子的對應關係，請參見條件操作類型。

條件關鍵字	描述	類型
log:TLSVersion	TLS的版本。	String
log:Encrypted	建立或修改Logstore時是否指定加密設定。	Boolean

Simple Log Service：授權信息

權限原則通用結構

操作（Action）

資源（Resource）

條件（Condition）

相關操作