Configure unauthenticated access for MetricStore Prometheus interface-Simple Log Service(SLS)-阿里云帮助中心

MetricStore read/write operations require AccessKey (AK) or Security Token Service (STS) authentication by default. You can configure a Project Policy to allow unauthenticated Prometheus interface access to MetricStore.

Important: Unauthenticated access allows any matching request to read or write MetricStore data without credentials. Always restrict access to specific MetricStores and apply VPC or IP range conditions to limit exposure. This configuration uses a Project Policy, which applies at the project level and may affect other stores in the same project.

Before you begin

Call GetProjectPolicy to retrieve existing policies before making changes to avoid overwriting them.

Related API operations

This topic references the following API operations:

MetricStore interfaces: Details of MetricStore-related HTTP API
Project Policy interfaces:

Policy structure

Policies use JSON format with the following structure:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Principal": "<Principal>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

Field descriptions:

Field	Description
Version	The policy version number. Fixed at `1`.
Statement	One or more permission statements. Each includes the fields below.
Effect	Valid values: `Allow` and `Deny`.
Action	Operations to allow or deny. Listed in Actions.
Principal	Optional. The entity the policy applies to. Set to `["*"]` for all users, typical for unauthenticated access.
Resource	Resources affected by the policy, expressed as Alibaba Cloud Resource Names (ARNs). Formats listed in Resources.
Condition	Optional. Conditions under which the policy takes effect. Detailed in Conditions.

Condition field structure

The Condition field has three elements:

Condition operator: The evaluation operator. Different condition types support different operators.
Condition_key: The attribute to evaluate.
Condition_value: The value to match against.

Actions

Available actions for MetricStore Prometheus interface access:

Permission type	Action
Prometheus protocol write	`log:RemoteWritePrometheus`
Prometheus protocol query	`log:QueryPrometheusMetrics`

Resources

Specify target resources using Alibaba Cloud Resource Names (ARNs):

Resource scope	ARN format	Description
All resources in a specific project	`acs:log:::project/{projectName}/*`	`*` matches all resources under the project.
A specific MetricStore	`acs:log:::project/{projectName}/logstore/{metricstore}`	Recommended. Scopes the policy to a single MetricStore.

Conditions

Restrict the origin of unauthenticated requests with conditions:

Condition type	Condition key	Example value	Description
Specific VPC	`acs:SourceVpc`	`["vpc-xxx1", "vpc-xxx2"]`	Limits unauthenticated access to specific VPCs.
Specific IP range	`acs:IpAddress`	`["xx.xx.xx.xx", "xx.xx.xx.0/24"]`	Limits unauthenticated access to specific IP addresses or CIDR ranges.

Best practices

Scope resources to the MetricStore level. Avoid the project-level wildcard *.
Apply VPC or IP range conditions to restrict the source of unauthenticated access.
Combine multiple conditions in a single statement, such as VPC and IP range together.
A single policy can include multiple resources or conditions for different scenarios.

Policy examples

The following examples progress from the most restrictive (recommended) to the least restrictive configuration.

Example 1: Write-only access from a specific VPC to a specific MetricStore

Most restrictive: write-only permission, scoped to one MetricStore, limited to one VPC.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": ["log:RemoteWritePrometheus"],
            "Principal": ["*"],
            "Resource": ["acs:log:*:*:project/test-project/logstore/test-metricstore"],
            "Condition": {
                "StringEquals": {
                    "acs:SourceVpc": ["vpc-xxx"]
                }
            }
        }
    ]
}

Example 2: Read/write access from a specific VPC to a specific MetricStore

Grants read and write access, restricted to a specific VPC and one MetricStore.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": ["log:RemoteWritePrometheus", "log:QueryPrometheusMetrics"],
            "Principal": ["*"],
            "Resource": ["acs:log:*:*:project/{projectName}/logstore/{metricstore}"],
            "Condition": {
                "StringEquals": {
                    "acs:SourceVpc": ["vpc-xxx1", "vpc-xxx2"]
                }
            }
        }
    ]
}

Example 3: Read/write access from a specific IP range to a specific MetricStore

Uses IP-based restrictions instead of VPC-based restrictions.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": ["log:RemoteWritePrometheus", "log:QueryPrometheusMetrics"],
            "Principal": ["*"],
            "Resource": ["acs:log:*:*:project/{projectName}/logstore/{metricstore}"],
            "Condition": {
                "StringEquals": {
                    "acs:IpAddress": ["xx.xx.xx.xx", "xx.xx.xx.0/24"]
                }
            }
        }
    ]
}

Example 4: Read/write access for a specific MetricStore without conditions

Grants read and write access to one MetricStore with no network restrictions. Any source can access without credentials.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": ["log:RemoteWritePrometheus", "log:QueryPrometheusMetrics"],
            "Principal": ["*"],
            "Resource": ["acs:log:*:*:project/test-project/logstore/test-metricstore"]
        }
    ]
}

Example 5: Read/write access for all MetricStores in a project without conditions

Least restrictive: read and write access to all MetricStores in a project with no network restrictions.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": ["log:RemoteWritePrometheus", "log:QueryPrometheusMetrics"],
            "Principal": ["*"],
            "Resource": ["acs:log:*:*:project/test-project/*"]
        }
    ]
}