DocsICP FilingConsole
Documentation

Grant a RAM user the permissions to manage a data transformation job: (Legacy method)

Updated at:
Copy as MD
Product
My Favorites

This topic describes how to grant a Resource Access Management (RAM) user permissions to manage a data transformation job.

Prerequisites

A RAM user is created. For more information, see Create a RAM user.

Background information

Use your Alibaba Cloud account to grant a RAM user permissions to manage a data transformation job.

  • Create, delete, and modify a data transformation job.

  • Read data from a source Logstore to preview the results of a data transformation job.

You can grant a RAM user permissions to transform data in Simple Log Service in one of the following ways.

  • Add system policies: You can grant all permissions on Simple Log Service to the RAM user. You cannot modify the system policies. You do not need to configure parameters.

  • Add custom policies: You can create custom policies and attach the policies to the RAM user. This method allows you to perform fine-grained access control, but requires complex configurations.

System policies

  1. Log on to the RAM console using an Alibaba Cloud account or a RAM administrator.

  2. Grant the AliyunRAMFullAccess and AliyunLogFullAccess system policies to the RAM user. For more information, see Grant permissions to a RAM user.

Custom policies

  1. Log on to the RAM console by using your Alibaba Cloud account or a RAM user who has administrative rights.

  2. Create a custom policy. On the JSON tab of the Create Policy page, replace the existing script in the code editor with the following policy document. For more information, see Using the script editor.

    Important

    Replace Project name and Logstore name in the policy document based on your business requirements. 

    {
    "Version":"1",
    "Statement":[
        {
            "Effect":"Allow",
            "Action":[
                "log:CreateLogStore",
                "log:CreateIndex",
                "log:UpdateIndex",
                "log:Get*"
            ],
            "Resource":"acs:log:*:*:project/Project name/logstore/internal-etl-log"
        },
        {
            "Action":[
                "log:List*"
            ],
            "Resource":"acs:log:*:*:project/Project name/logstore/*",
            "Effect":"Allow"
        },
        {
            "Action":[
                "log:Get*",
                "log:List*"
            ],
            "Resource":[
                "acs:log:*:*:project/Project name/logstore/Logstore name"
            ],
            "Effect":"Allow"
        },
        {
            "Effect":"Allow",
            "Action":[
                "log:GetDashboard",
                "log:CreateDashboard",
                "log:UpdateDashboard"
            ],
            "Resource":"acs:log:*:*:project/Project name/dashboard/internal-etl-insight*"
        },
        {
            "Effect":"Allow",
            "Action":"log:CreateDashboard",
            "Resource":"acs:log:*:*:project/Project name/dashboard/*"
        },
        {
            "Effect":"Allow",
            "Action":[
                "log:*"
            ],
            "Resource":"acs:log:*:*:project/Project name/job/*"
        },{
            "Effect":"Allow",
            "Action":[
                "log:*"
            ],
            "Resource":"acs:log:*:*:project/Project name/etl/*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ram:PassRole",
                "ram:GetRole",
                "ram:ListRoles"
            ],
            "Resource": "*"
         }
    ]
}

  3. Attach the created custom policy to the RAM user. For more information, see Manage RAM user permissions.