Grant a RAM user Scheduled SQL permissions

Procedure

1. Log on to the RAM console by using your Alibaba Cloud account or a RAM user who has administrative rights.

2. Create a custom policy. On the JSON tab of the Create Policy page, replace the existing script in the code editor with the following policy document. For more information, see Create a custom policy.

   Important

   • In the policy, replace <your_project_name> and <your_logstore_name> with the actual names of your Project and Logstore.

   • To allow a RAM user to configure alerts for Scheduled SQL jobs, you must also grant the user permissions to manage alerts. For more information, see Grant a RAM user permissions to manage alerts.

   • The Logstore resource in the policy applies to both Logstores and MetricStores.

   {
     "Version": "1",
     "Statement": [
       {
         "Effect": "Allow",
         "Action": [
           "log:GetJobInstance",
           "log:ModifyJobInstance",
           "log:ModifyJobInstanceState",
           "log:ListJobInstances"
         ],
         "Resource": "acs:log:*:*:project/<your_project_name>/job/*/jobinstance/*"
       },
       {
         "Effect": "Allow",
         "Action": [
           "log:ListJobs",
           "log:GetJob",
           "log:CreateJob",
           "log:UpdateJob",
           "log:DeleteJob"
         ],
         "Resource": "acs:log:*:*:project/<your_project_name>/job/*"
       },
       {
         "Effect": "Allow",
         "Action": [
           "log:ListLogStores",
           "log:ListSavedSearch",
           "log:ListDashboard"
         ],
         "Resource": "acs:log:*:*:project/<your_project_name>/*"
       },
       {
         "Effect": "Allow",
         "Action": [
           "log:GetLogStore",
           "log:GetIndex",
           "log:GetLogStoreHistogram",
           "log:GetLogStoreLogs"
         ],
         "Resource": "acs:log:*:*:project/<your_project_name>/logstore/<your_logstore_name>"
       },
       {
         "Effect": "Allow",
         "Action": [
           "ram:PassRole",
           "ram:GetRole",
           "ram:ListRoles"
         ],
         "Resource": "*"
       },
       {
         "Effect": "Allow",
         "Action": [
           "log:CreateLogStore",
           "log:CreateIndex",
           "log:UpdateIndex"
         ],
         "Resource": [
           "acs:log:*:*:project/sls-alert-*/logstore/internal-alert-center-log"
         ]
       },
       {
         "Effect": "Allow",
         "Action": [
           "log:CreateDashboard",
           "log:CreateChart",
           "log:UpdateDashboard"
         ],
         "Resource": [
           "acs:log:*:*:project/sls-alert-*/dashboard/*"
         ]
       },
       {
         "Effect": "Allow",
         "Action": [
           "log:CreateProject"
         ],
         "Resource": [
           "acs:log:*:*:project/sls-alert-*"
         ]
       }
     ]
   }

3. Attach the created custom policy to the RAM user. For more information, see Grant permissions to a RAM user.