Authentication rules

Basic elements of an access policy

For more information about the concepts and syntax of access policies, see Basic elements of an access policy.

Authorization flow

1. Create an account administrator.

   An Alibaba Cloud account, also known as a root account, has full management permissions for all resources within the account. You cannot restrict these permissions using conditions, such as source IP addresses or access times. If multiple users share the account, you cannot identify the specific user from the operation logs. A leaked Alibaba Cloud account is a high security risk. Do not use your Alibaba Cloud account for daily operations management.

   You can create a RAM user in RAM and grant the AdministratorAccess permissions to the user. This user acts as an account administrator and can manage all cloud resources under the account. You can then use this administrator to create other RAM users and assign different permissions to them.

2. Create a custom policy.

   RAM provides two types of access policies: system policies and custom policies. System policies are provided by Alibaba Cloud and can be viewed but not modified. If system policies do not meet your authorization needs, you can create custom policies to implement fine-grained permission management.

3. Create and authorize a RAM user or RAM role:

   • Create and authorize a RAM user.

     You can create RAM users and grant permissions to them. This allows different RAM users to have different permissions to access resources.

     If multiple users in your enterprise need to access resources, you can use RAM to assign the least privilege required to each user. This practice helps you avoid sharing the logon password or AccessKey pair of your Alibaba Cloud account and reduces security risks.

   • Create and authorize a RAM user group.

     You can use RAM user groups to classify and authorize RAM users who have the same responsibilities. This helps you manage RAM users and their permissions more efficiently.

   • Create and authorize a RAM role.

     A RAM role is a virtual user to which you can grant a set of access policies. Unlike a RAM user, a RAM role does not have permanent identity credentials, such as a logon password or an AccessKey pair. A RAM role must be assumed by a trusted entity. After the role is assumed, the trusted entity obtains temporary identity credentials for the RAM role. These credentials are provided in the form of a Security Token Service (STS) token. The trusted entity can then use the STS token to access authorized resources. For the steps to use a RAM role, see Assume a RAM role.

Action

The format of an action is log:${API_Name}, where ${API_Name} is the name of a Simple Log Service API. For a list of all public cloud APIs for Simple Log Service, see API overview.

When you create an authorization policy for Simple Log Service, you can separate multiple actions with commas (,). You can use the asterisk (*) as a wildcard character. For example, in log:Create*, Create* matches all API names that start with Create, such as CreateProduct, CreateThingModel, and CreateProductTopic.

Resource

Resources in Simple Log Service are hierarchical. A project is the root resource. Logstores, configs, and machine groups are sub-resources of a project and are at the same level. Shippers and consumer groups are sub-resources of a Logstore.

Parameter descriptions