How to ship Simple Log Service data to OSS using a default role-阿里云帮助中心

AliyunLogDefaultRole is a system role with permissions to read Logstore data and ship it to an OSS bucket. Grant this role to an OSS shipping task (new version) to read from the source Logstore and ship data to the destination bucket.

Ship data within an Alibaba Cloud account

If your Simple Log Service Logstore and OSS bucket belong to the same Alibaba Cloud account, you only need to complete the Cloud Resource Access Authorization.

After authorization, the OSS shipping task (new version) uses AliyunLogDefaultRole to read from the source Logstore and ship data to the destination OSS bucket. When you create the task, enter the Alibaba Cloud Resource Name (ARN) of AliyunLogDefaultRole (for example, acs:ram::10****12:role/aliyunlogdefaultrole) in the OSS Write RAM Role and Logstore Read RAM Role fields. For more information, see Obtain the ARN of AliyunLogDefaultRole. The OSS Write RAM Role parameter controls write access to OSS, and the Logstore Read RAM Role parameter controls read access from the Logstore. For each parameter, select Default Role or Custom Role. The ARN is then automatically populated in a format such as acs:ram::China UID:role/logrole.

Ship data across Alibaba Cloud accounts

If the source Logstore and the destination OSS bucket belong to different Alibaba Cloud accounts (for example, Logstore in Account A and bucket in Account B), both accounts must first complete Cloud Resource Access Authorization separately. Then, follow these steps.

Log on to the RAM console with Alibaba Cloud account B.
In the left-side navigation pane, choose Identities > Role.
Modify the trust policy of the AliyunLogDefaultRole role.
1. On the Roles page, click AliyunLogDefaultRole.
2. On the Trust Policy tab, click Edit Trust Policy.
3. Replace the existing trust policy with the following content and then click Save Trust Policy.
  In the Service parameter, add ID_of_Account_A@log.aliyuncs.com. Replace ID_of_Account_A with the actual ID of Alibaba Cloud account A. You can find your Alibaba Cloud account ID in the Account Center.
  
  The following policy allows Alibaba Cloud Account A to obtain a temporary Security Token Service (STS) token to manage the cloud resources of Alibaba Cloud Account B:
```
{
  "Statement": [
   {
     "Action": "sts:AssumeRole",
     "Effect": "Allow",
     "Principal": {
       "Service": [
         "ID of Alibaba Cloud Account A@log.aliyuncs.com",
         "log.aliyuncs.com"
       ]
     }
   }
  ],
  "Version": "1"
}
```
After authorization, the OSS shipping task (new version) uses AliyunLogDefaultRole from Account A to read from the source Logstore, and AliyunLogDefaultRole from Account B to ship data to the destination OSS bucket. When you create the task, in the OSS Write RAM Role field, enter the ARN of AliyunLogDefaultRole from Account B (for example, acs:ram::11**13:role/aliyunlogdefaultrole), and in the Logstore Read RAM Role field, enter the ARN of AliyunLogDefaultRole from Account A (for example, acs:ram::10**12:role/aliyunlogdefaultrole). For more information, see Obtain the ARN of AliyunLogDefaultRole.

Obtain the ARN of the AliyunLogDefaultRole role

Log on to the RAM console.
In the left-side navigation pane, choose Identities > Role.
On the Roles page, find the AliyunLogDefaultRole role and click the name of the role.
On the role details page, copy the ARN from the Basic Information section.

Record the ARN. You need to enter it when you create a data shipping job that uses a default role to ship data to OSS.