当RAM用户通过日志服务API对阿里云账号的资源进行访问时，日志服务后台对RAM用户进行权限检查，以确保资源拥有者的确将相关资源的相关权限授予了调用者。本文列举RAM用户通过日志服务API访问阿里云账号资源时的鉴权规则。

Logstore

每个不同的日志服务API会根据涉及到的资源以及API的语义来确定需要检查哪些资源的权限。具体各类API的鉴权规则见下表。

ActionResource
log:GetLogStoreacs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/logstore/${logstoreName}
log:ListLogStoresacs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/logstore/*
log:CreateLogStoreacs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/logstore/*
log:DeleteLogStoreacs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/logstore/${logstoreName}
log:UpdateLogStoreacs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/logstore/${logstoreName}

loghub

数据写入以及消费类API，其中获取数据游标API GetCursor以及获取数据API GetLogs共用同一个 Action（log:GetCursorOrData）。
ActionResource
log:GetCursorOrDataacs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/logstore/${logstoreName}
log:ListShardsacs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/logstore/${logstoreName}
log:PostLogStoreLogsacs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/logstore/${logstoreName}

config

ActionResource
log:CreateConfigacs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/logtailconfig/*
log:UpdateConfigacs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/logtailconfig/${logtailConfigName}
log:DeleteConfigacs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/logtailconfig/${logtailConfigName}
log:GetConfigacs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/logtailconfig/${logtailConfigName}
log:ListConfigacs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/logtailconfig/*

machinegroup

ActionsResources
log:CreateMachineGroupacs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/machinegroup/*
log:UpdateMachineGroupacs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/machinegroup/${machineGroupName}
log:DeleteMachineGroupacs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/machinegroup/${machineGroupName}
log:GetMachineGroupacs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/machinegroup/${machineGroupName}
log:ListMachineGroupacs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/machinegroup/*
log:ListMachinesacs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/machinegroup/${machineGroupName}

config和machinegroup交互类API

ActionsResources
log:ApplyConfigToGroupacs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/logtailconfig/${logtailConfigName} acs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/machinegroup/${machineGroupName}
log:RemoveConfigFromGroupacs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/logtailconfig/${logtailConfigName} acs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/machinegroup/${machineGroupName}
log:GetAppliedMachineGroupsacs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/logtailconfig/${logtailConfigName}
log:GetAppliedConfigsacs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/machinegroup/${machineGroupName}