How to grant a RAM user permissions to manage a data transformation job-阿里云帮助中心

This topic describes how to grant a Resource Access Management (RAM) user permissions to manage a data transformation job.

Prerequisites

A RAM user is created. For more information, see Create a RAM user.

Background information

Use your Alibaba Cloud account to grant a RAM user permissions to manage a data transformation job.

Create, delete, and modify a data transformation job.
Read data from a source Logstore to preview the results of a data transformation job.

You can grant a RAM user permissions to transform data in Simple Log Service in one of the following ways.

Custom policy: Provides fine-grained permissions. You can modify the content of a custom policy.

Custom policies

Log on to the RAM console by using your Alibaba Cloud account or a RAM user who has administrative rights.

Create a custom policy. On the JSON tab of the Create Policy page, replace the existing script in the code editor with the following policy document. For more information, see Using the script editor.

Important

Replace Project name and Logstore name in the policy document based on your business requirements.

{
    "Version":"1",
    "Statement":[
        {
            "Effect":"Allow",
            "Action":[
                "log:CreateLogStore",
                "log:CreateIndex",
                "log:UpdateIndex",
                "log:Get*"
            ],
            "Resource":"acs:log:*:*:project/Project name/logstore/internal-etl-log"
        },
        {
            "Action":[
                "log:List*"
            ],
            "Resource":"acs:log:*:*:project/Project name/logstore/*",
            "Effect":"Allow"
        },
        {
            "Action":[
                "log:Get*",
                "log:List*"
            ],
            "Resource":[
                "acs:log:*:*:project/Project name/logstore/Logstore name"
            ],
            "Effect":"Allow"
        },
        {
            "Effect":"Allow",
            "Action":[
                "log:GetDashboard",
                "log:CreateDashboard",
                "log:UpdateDashboard"
            ],
            "Resource":"acs:log:*:*:project/Project name/dashboard/internal-etl-insight*"
        },
        {
            "Effect":"Allow",
            "Action":"log:CreateDashboard",
            "Resource":"acs:log:*:*:project/Project name/dashboard/*"
        },
        {
            "Effect":"Allow",
            "Action":[
                "log:*"
            ],
            "Resource":"acs:log:*:*:project/Project name/job/*"
        },{
            "Effect":"Allow",
            "Action":[
                "log:*"
            ],
            "Resource":"acs:log:*:*:project/Project name/etl/*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ram:PassRole",
                "ram:GetRole",
                "ram:ListRoles"
            ],
            "Resource": "*"
         }
    ]
}

Attach the created custom policy to the RAM user. For more information, see Manage RAM user permissions.