How to implement RAM authorization in different scenarios-阿里云帮助中心

This topic describes how to configure Resource Access Management (RAM) permissions for shipping logs from a Logstore to an Object Storage Service (OSS) bucket that belongs to the same or a different Alibaba Cloud account.

Important

The old version of shipping logs to OSS is discontinued. Refer to the new version.

Use a RAM user to create an OSS data shipping job (recommended)

Important

Each OSS data shipping job can be configured for only one OSS bucket. To ship logs to OSS buckets that belong to two different Alibaba Cloud accounts, you must create two data shipping jobs.

Ship data within the same Alibaba Cloud account

The Logstore and the OSS bucket belong to the same Alibaba Cloud account.

Procedure

Create a RAM user named ram-user. For more information, see Create a RAM user.

Grant the RAM user ram-user the permissions to read data from the Logstore and ship the data to OSS.

Create a custom policy named ShipLogsToOSS. The following code shows the policy document. For more information, see Create custom policies.

Note

Replace Project name and Logstore name in the script with your project name and Logstore name.

{
  "Version": "1",
  "Statement": [{
    "Effect": "Allow",
    "Action": [
      "log:GetLogStore",
      "log:GetIndex",
      "log:GetLogStoreHistogram",
      "log:GetLogStoreLogs"
    ],
    "Resource": [
      "acs:log:*:*:project/Project name/logstore/Logstore name",
      "acs:log:*:*:project/Project name/logstore/internal-diagnostic_log"
    ]
  },
    {
      "Effect": "Allow",
      "Action": [
        "log:CreateJob",
        "log:UpdateJob",
        "log:DeleteJob",
        "log:ListJobs",
        "log:GetJob"
      ],
      "Resource": "acs:log:*:*:project/Project name/job/*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "log:ListLogStores",
        "log:ListDashboard",
        "log:ListSavedSearch"
      ],
      "Resource": "acs:log:*:*:project/Project name/*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "ram:PassRole",
        "ram:GetRole",
        "ram:ListRoles"
      ],
      "Resource": "*"
    }
  ]
}

What to do next

Log on to the Simple Log Service console as the RAM user and create an OSS data shipping job. For more information, see Create an OSS data shipping job (Previous Version).

Ship data across Alibaba Cloud accounts

The Logstore and the OSS bucket belong to different Alibaba Cloud accounts. For example, the Logstore belongs to Account A and the OSS bucket belongs to Account B.

Procedure

Using Account B, modify the trust policy of the AliyunLogDefaultRole role to allow Account A to write data to the OSS bucket of Account B.
Using Account A, create a RAM user named ram-user-a. For more information, see Create a RAM user.

Grant the RAM user ram-user-a the permissions to read data from the Logstore and ship the data to OSS.

Create a custom policy named ShipLogsToOSS. The following code shows the policy document. Replace {ID of Alibaba Cloud Account B} with the ID of Alibaba Cloud Account B. For more information, see Create custom policies.

{
  "Version": "1",
  "Statement": [{
    "Effect": "Allow",
    "Action": [
      "log:GetLogStore",
      "log:GetIndex",
      "log:GetLogStoreHistogram",
      "log:GetLogStoreLogs"
    ],
    "Resource": [
      "acs:log:*:*:project/Project name/logstore/Logstore name",
      "acs:log:*:*:project/Project name/logstore/internal-diagnostic_log"
    ]
  },
    {
      "Effect": "Allow",
      "Action": [
        "log:CreateJob",
        "log:UpdateJob",
        "log:DeleteJob",
        "log:ListJobs",
        "log:GetJob"
      ],
      "Resource": "acs:log:*:*:project/Project name/job/*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "log:ListLogStores",
        "log:ListDashboard",
        "log:ListSavedSearch"
      ],
      "Resource": "acs:log:*:*:project/Project name/*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "ram:PassRole",
        "ram:GetRole",
        "ram:ListRoles"
      ],
      "Resource": "acs:ram::{ID of Alibaba Cloud Account B}:role/aliyunlogdefaultrole"
    }
  ]
}

Attach the ShipLogsToOSS policy to the RAM user ram-user-a. For more information, see Manage the permissions of a RAM user.

What to do next

Log on to the Simple Log Service console as the RAM user and create an OSS data shipping job. For more information, see Create an OSS data shipping job (Previous Version).

Use an Alibaba Cloud account to create an OSS data shipping job

Important

An Alibaba Cloud account has permissions to manage all cloud resources in the account. To minimize security risks, we recommend that you use a RAM user to perform operations.
Each OSS data shipping job can be configured for only one OSS bucket. To ship logs to OSS buckets that belong to two different Alibaba Cloud accounts, you must create two data shipping jobs.

Ship data within the same Alibaba Cloud account

The Logstore and the OSS bucket belong to the same Alibaba Cloud account.

Procedure

Create a RAM role (AliyunLogDefaultRole). For more information, see Resource access authorization.

What to do next

Log on to the Simple Log Service console using your Alibaba Cloud account (root account) and create an OSS data shipping job. For more information, see Create an OSS data shipping job (Previous Version).

Ship data across Alibaba Cloud accounts

The Logstore and the OSS bucket belong to different Alibaba Cloud accounts. For example, the Logstore belongs to Account A and the OSS bucket belongs to Account B.

Procedure

Using Account B, create a RAM role (AliyunLogDefaultRole). For more information, see Resource access authorization.
Using Account B, modify the trust policy of the AliyunLogDefaultRole role to allow Account A to write data to the OSS bucket of Account B.

What to do next

Modify the trust policy of the AliyunLogDefaultRole role

To ship logs from a Logstore in Alibaba Cloud Account A to an OSS bucket in Account B, you must modify the trust policy of the AliyunLogDefaultRole role. Perform the following steps:

On the Resource access authorization page, use Account B to create the AliyunLogDefaultRole role.
Log on to the RAM console using Account B.
In the navigation pane on the left, choose Identity Management > Roles.
In the list of RAM roles, click AliyunLogDefaultRole.
On the Trust Policy tab, click Edit Trust Policy.
Note
In the Service configuration item, add {ID of Alibaba Cloud Account A}@log.aliyuncs.com. Replace {ID of Alibaba Cloud Account A} with the ID of your Alibaba Cloud account. You can obtain your Alibaba Cloud account ID in the Account Center.
```
{
"Statement": [
 {
   "Action": "sts:AssumeRole",
   "Effect": "Allow",
   "Principal": {
     "Service": [
       "{ID of Alibaba Cloud Account A}@log.aliyuncs.com",
       "log.aliyuncs.com"
     ]
   }
 }
],
"Version": "1"
}
```