Grant a RAM user permissions to manage consumer processors

Procedure

1. Log on to the RAM console by using your Alibaba Cloud account or a RAM user who has administrative rights.

2. Create a custom policy. On the JSON tab of the Create Policy page, replace the existing script in the code editor with the following policy document. For more information, see Using the script editor.

   Important

   Replace Project-Name and Logstore-Name in the following script with the names of the Simple Log Service (SLS) project and Logstore that are used for data processing. To view the project and Logstore names, see Manage a project and Manage a Logstore.

   Read-only permissions

   {
       "Version": "1",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "log:GetConsumeProcessor",
                   "log:ListConsumeProcessors"
               ],
               "Resource": "acs:log:*:*:project/Project-Name/ConsumeProcessor/*"
           }
       ]
   }

   Read/write permissions

   {
       "Version": "1",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "log:PutConsumeProcessor",
                   "log:GetConsumeProcessor",
                   "log:ListConsumeProcessors",
                   "log:DeleteConsumeProcessor"
               ],
               "Resource": "acs:log:*:*:project/Project-name/ConsumeProcessor/*"
           }
       ]
   }

3. Attach the created custom policy to the RAM user. For more information, see Manage RAM user permissions.

References

Custom policies provide fine-grained access control but require you to manage the policy content. Alternatively, you can grant system policies to a RAM identity. System policies are easier to use but grant a wider range of permissions, which may introduce security risks. For information about the system policies supported by SLS, see System policies for SLS.