Configure authorization for data monitoring across projects

Scenarios

Video tutorial

Step 1: Configure authorization

1. Specify a query statement. For more information, see Create an alert rule.

2. Configure an authorization method.

   Use the default authorization method

   To monitor different Logstores and Metricstores within the same Project, use the Default authorization method.

   On the Advanced Settings tab, set Authorization Method to Default.

   Use a built-in role

   To monitor Logstores and Metricstores across multiple projects within an Alibaba Cloud account, assign a built-in role to Simple Log Service.

   On the Advanced Settings tab, set Authorization Method to Built-in Role. If this is your first time, use the Alibaba Cloud account owner to complete the authorization as prompted. After authorization, Simple Log Service creates a RAM role named AliyunSLSAlertMonitorRole and assumes this role to read data from the source Logstores.

   Use a custom role (within an Alibaba Cloud account)

   To monitor different Logstores or Metricstores within the same Alibaba Cloud account with fine-grained permission control, use a Custom Role.

   1. Create a RAM role for a trusted Alibaba Cloud service, and select Simple Log Service as the trusted service.

   2. Create a custom policy. On the JSON tab of the Create Policy page, replace the existing script in the code editor with the following policy document. For more information, see Using the script editor.

      Important

      Replace ProjectName in the following script with your actual Project name. For more granular permissions, such as allowing alert rules to be created only in a specific Project, you can specify the Project in the Resource element of the policy, for example, acs:log:*:*:project/my-project.

      {
        "Statement": [
          {
            "Action": [
              "log:ListProject"
            ],
            "Effect": "Allow",
            "Resource": [
              "acs:log:*:*:*"
            ]
          },
          {
            "Action": [
              "log:ListLogStores",
              "log:GetLogStoreLogs",
              "log:GetIndex"
            ],
            "Effect": "Allow",
            "Resource": [
              "acs:log:*:*:project/Project name/*"
            ]
          }
        ],
        "Version": "1"
      }

   3. Attach the created custom policy to the RAM role. For more information, see Manage permissions for a RAM role.

   What to do next

   1. Obtain the Alibaba Cloud Resource Name (ARN) of the RAM role. For more information, see View a RAM role.

   2. When you use Custom Role authorization, enter the ARN of the RAM role. For more information, see Create an alert rule.

      On the Advanced Settings tab, set Authorization method to Custom Role, and then enter the ARN in the Role ARN input box.

   Use a custom role (across multiple Alibaba Cloud accounts)

   Monitor Logstores or Metricstores across multiple Alibaba Cloud accounts. For example, create an alert rule in Account A that monitors data in the Logstores or Metricstores of Account B.

   Use Alibaba Cloud Account B to perform the following steps:

   1. Create a RAM role for a trusted Alibaba Cloud service, and select Simple Log Service as the trusted service.

   2. Modify the trust policy of the RAM role. For more information, see Edit the trust policy of a RAM role.

      Important

      Replace The ID of Alibaba Cloud account A with the ID of account A. You can find the account ID in the account center.

      {
          "Statement": [
              {
                  "Action": "sts:AssumeRole",
                  "Effect": "Allow",
                  "Principal": {
                      "Service": [
                          "ID of Alibaba Cloud Account A@log.aliyuncs.com",
                          "log.aliyuncs.com"
                      ]
                  }
              }
          ],
          "Version": "1"
      }

   3. Create a custom policy. On the JSON tab of the Create Policy page, replace the existing script in the code editor with the following policy document. For more information, see Using the script editor.

      Important

      Replace ProjectName with your actual Project name. For more granular permissions, such as allowing alert rules to be created only in a specific Project, you can specify the Project in the Resource element of the policy, for example, acs:log:*:*:project/my-project.

      {
        "Statement": [
          {
            "Action": [
              "log:ListProject"
            ],
            "Effect": "Allow",
            "Resource": [
              "acs:log:*:*:*"
            ]
          },
          {
            "Action": [
              "log:ListLogStores",
              "log:GetLogStoreLogs",
              "log:GetIndex"
            ],
            "Effect": "Allow",
            "Resource": [
              "acs:log:*:*:project/Project name/*"
            ]
          }
        ],
        "Version": "1"
      }

   4. Attach the created custom policy to the RAM role. For more information, see Manage permissions for a RAM role.

   5. Obtain the Alibaba Cloud Resource Name (ARN) of the RAM role. For more information, see View a RAM role.

   What to do next

   1. Obtain the Alibaba Cloud Resource Name (ARN) of the RAM role. For more information, see View a RAM role.

   2. When you create an alert rule in Alibaba Cloud account A, select Custom Role for authorization and enter the ARN of the RAM role from Alibaba Cloud account B in the Role ARN field. For more information, see Create an alert rule.

{
     "Action": "ram:PassRole",
     "Effect": "Allow",
     "Resource": "acs:ram::ID of Alibaba Cloud Account:Role ARN"
 }