AI 助理
备案控制台
官方文档
输入文档关键字查找
首页 日志服务 安全合规 使用RAM进行访问控制 使用资源组进行精细化资源控制

使用资源组进行精细化资源控制

更新时间：
产品详情
我的收藏

当您使用资源组对资源进行分组管理时，可以结合访问控制（RAM），在单个阿里云账号内实现资源的隔离和精细化权限管理。本文总结了日志服务对资源组的支持情况，以及资源组级别的授权操作步骤。

说明

  • 只有支持资源组的资源类型和支持资源组级别授权的操作，资源组级别授权才能生效。

  • 对于不支持资源组的资源类型，授予资源组范围的权限将无效。在选择资源范围时，请选择账号级别，进行账号级别授权。具体操作，请参见不支持资源组级别授权的操作。

资源组授权的工作原理

您可以使用资源组（Resource Group）对阿里云账号内的资源进行分组管理。例如，为不同的项目创建对应的资源组，并将资源转移到对应的组中，以便集中管理各项目的资源。更多信息，请参见什么是资源组。

在完成资源分组后，您可以为不同的RAM授权主体（RAM用户、RAM用户组或RAM角色）授予指定资源组范围的权限，从而限定这个授权主体只能管理该资源组内的资源。更多信息，请参见资源分组和授权。

这种授权方式的优点有：

  • 权限精细化：确保每个身份能获得最准确的资源访问权限，避免账号下的多个项目的资源混合管理。

  • 良好的扩展性：后续新增资源时，只需将其加入该资源组，RAM身份便会自动获得新资源的相应权限，无需再次授权。

为RAM用户授予资源组级别的权限

下面以RAM用户为例，介绍授予指定资源组内日志服务资源权限的操作步骤。

1. 前置步骤

  1. 创建待使用的RAM用户，可参考：创建RAM用户

  2. 创建资源组并将已有资源划分到目标资源组，可参考：创建资源组，资源自动转组及资源手动转组。

2. 进行资源组级别授权

您可以通过以下任一方式进行资源组级别授权。

方式一：在资源管理控制台中授权

通过资源组的权限管理功能为指定 RAM 用户授权。详情操作可参见为RAM身份授予资源组范围的权限。

  • 登录资源组控制台。

  • 在资源组页面，单击目标资源组操作列的权限管理。

  • 在权限管理页签，单击新增授权。

  • 在新增授权面板，设置授权主体和权限策略。

    • 授权主体：选择已有RAM用户。

    • 权限策略：选择系统策略或已创建的自定义策略，参考创建自定义权限策略。

  • 单击确认新增授权。

方式二：在 RAM 控制台中授权

通过RAM控制台为指定 RAM 用户进行资源组级别授权。详细操作可参见为RAM用户授权。

  • 使用阿里云账号（主账号）或RAM管理员登录RAM控制台。

  • 在左侧导航栏，选择身份管理 > 用户。在用户页面，单击目标RAM用户操作列的添加权限。

  • 在新增授权面板，为RAM用户添加权限。

    • 资源范围：选择资源组级别。

    • 授权主体：选择已有 RAM 用户或前面步骤创建的 RAM 用户。

    • 权限策略：选择系统策略或已创建的自定义策略，参考创建自定义权限策略。

  • 单击确认新增授权。

支持资源组的资源类型

日志服务支持资源组的资源类型如下表所示：

云服务

云服务代码

资源类型

日志服务

log

project : 项目
说明

对于暂不支持资源组的资源类型，如有需要，您可以在资源组控制台提交反馈。

image

不支持资源组级别授权的操作

日志服务中不支持资源组级别授权的操作（Action）如下：

操作（Action）

操作描述

log:AccessDashboardSharing

-

log:AnalyzeProductLog

-

log:BalancePartitions

-

log:BatchGetGlobalProject

-

log:BatchGetIndex

-

log:BatchGetStore

-

log:CallAiTools

-

log:CheckArmsAuthorization

-

log:CheckUserPermission

-

log:CreateAccount

-

log:CreateAgentInstanceConfig

-

log:CreateAnnotationDataSet

-

log:CreateAnnotationLabel

-

log:CreateApp

-

log:CreateCMSInnerExternalStore

-

log:CreateCluster

-

log:CreateDashboardSharing

-

log:CreateDataExpression

-

log:CreateEntityStore

-

log:CreateRecordingRule

-

log:CreateResourceRecord

-

log:CreateTicket

-

log:DeleteAccount

-

log:DeleteAgentInstanceConfig

-

log:DeleteCollectionPolicy

-

log:DeleteDashboardSharing

-

log:DeleteEntityStore

-

log:DeleteRecordingRule

-

log:DeleteResource

-

log:DeleteResourceRecord

-

log:DescribeService

-

log:DisableWorker

-

log:EnableService

-

log:EnableWorker

-

log:GetAccount

-

log:GetAccount

-

log:GetAccount

-

log:GetAgentInstanceConfig

-

log:GetAgentInstanceConfig

-

log:GetAgentInstanceConfig

-

log:GetAgentInstanceConfig

-

log:GetAgentInstanceConfig

-

log:GetAnnotationLabel

-

log:GetAnnotationLabel

-

log:GetAnnotationLabel

-

log:GetApp

-

log:GetApp

-

log:GetApp

-

log:GetAsyncSQL

-

log:GetAsyncSQL

-

log:GetAsyncSQL

-

log:GetCMSInnerExternalStore

-

log:GetCMSInnerExternalStore

-

log:GetCMSInnerExternalStore

-

log:GetCluster

-

log:GetCluster

-

log:GetCluster

-

log:GetCollectionPolicy

-

log:GetCollectionPolicy

-

log:GetCollectionPolicy

-

log:GetCursor

-

log:GetCursor

-

log:GetCursor

-

log:GetDataExpression

-

log:GetDataExpression

-

log:GetDataExpression

-

log:GetDiagnosis

-

log:GetDiagnosis

-

log:GetDiagnosis

-

log:GetEcsAliUid

-

log:GetEcsAliUid

-

log:GetEcsAliUid

-

log:GetEntityStore

-

log:GetEntityStore

-

log:GetEntityStore

-

log:GetGlobalProject

-

log:GetGlobalProject

-

log:GetGlobalProject

-

log:GetLogs

-

log:GetLogs

-

log:GetLogs

-

log:GetMLServiceResults

-

log:GetMLServiceResults

-

log:GetMLServiceResults

-

log:GetMLServiceResults

-

log:GetMLServiceResults

-

log:GetPartitions

-

log:GetPartitions

-

log:GetPartitions

-

log:GetProductDataCollection

-

log:GetProductDataCollection

-

log:GetProductDataCollection

-

log:GetProductDataCollection

-

log:GetProjectInfo

-

log:GetProjectInfo

-

log:GetProjectInfo

-

log:GetRecordingRule

-

log:GetRecordingRule

-

log:GetRecordingRule

-

log:GetResource

-

log:GetResource

-

log:GetResource

-

log:GetResource

-

log:GetResourceRecord

-

log:GetResourceRecord

-

log:GetResourceRecord

-

log:GetResourceRecord

-

log:GetRoleFlags

-

log:GetRoleFlags

-

log:GetRoleFlags

-

log:GetShards

-

log:GetShards

-

log:GetShards

-

log:GetShardsInPartition

-

log:GetShardsInPartition

-

log:GetShardsInPartition

-

log:GetWorkerFlags

-

log:GetWorkerFlags

-

log:GetWorkerFlags

-

log:GetWorkers

-

log:GetWorkers

-

log:GetWorkers

-

log:ListAccounts

-

log:ListAccounts

-

log:ListAccounts

-

log:ListAgentInstanceConfigs

-

log:ListAgentInstanceConfigs

-

log:ListAgentInstanceConfigs

-

log:ListAiTools

-

log:ListAiTools

-

log:ListAiTools

-

log:ListAnnotationData

-

log:ListAnnotationData

-

log:ListAnnotationData

-

log:ListAnnotationDataSets

-

log:ListAnnotationDataSets

-

log:ListAnnotationDataSets

-

log:ListAnnotationLabels

-

log:ListAnnotationLabels

-

log:ListAnnotationLabels

-

log:ListClusters

-

log:ListClusters

-

log:ListClusters

-

log:ListCollectionPolicies

-

log:ListCollectionPolicies

-

log:ListCollectionPolicies

-

log:ListDashboardSharing

-

log:ListDashboardSharing

-

log:ListDashboardSharing

-

log:ListGlobalProjects

-

log:ListGlobalProjects

-

log:ListGlobalProjects

-

log:ListNextResourceRecords

-

log:ListNextResourceRecords

-

log:ListNextResourceRecords

-

log:ListProjects

-

log:ListProjects

-

log:ListProjects

-

log:ListResourceRecords

-

log:ListResourceRecords

-

log:ListResourceRecords

-

log:ListResourceRecords

-

log:ListResources

-

log:ListResources

-

log:ListResources

-

log:ListResources

-

log:ListTagResource

-

log:ListTagResource

-

log:ListTagResource

-

log:LockWorker

-

log:MovePartition

-

log:MoveShard

-

log:OpenSlsService

-

log:PutAccount

-

log:PutAnnotationData

-

log:PutLogs

-

log:PutOpenEvent

-

log:QueryPartition

-

log:QueryPartition

-

log:QueryProject

-

log:QueryProject

-

log:QueryPrometheusMetrics

-

log:QueryPrometheusMetrics

-

log:QueryPrometheusMetrics

-

log:QueryPrometheusMetrics

-

log:QueryPrometheusMetrics

-

log:RefreshToken

-

log:RemoteWritePrometheus

-

log:SetGeneralDataAccessConfig

-

log:SetWorkerFlags

-

log:SubmitAsyncSQL

-

log:UnlockWorker

-

log:UpdateAccount

-

log:UpdateAgentInstanceConfig

-

log:UpdateApp

-

log:UpdateCluster

-

log:UpdateDashboardSharing

-

log:UpdateDataExpression

-

log:UpdateLogStoreInternalConfig

-

log:UpdateProjectOwner

-

log:UpdateProjectQuota

-

log:UpdateProjectV2

-

log:UpdateResource

-

log:UpdateResourceRecord

-

log:UpsertCollectionPolicy

-

log:UpsertResourceRecord

-

log:VerifySignature

-

对于不支持资源组授权的操作，授权时资源范围选择资源组级别将无效。如果仍需要RAM用户有上述操作权限，您需要创建自定义权限策略，授权时资源范围选择账号级别。

image.png以下是两个自定义权限策略示例，您可以根据实际需要调整策略内容。

  • 允许不支持资源组级别授权的全部只读操作：Action中列举不支持资源组级别授权的所有只读操作。

    {
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "log:CallAiTools",
        "log:DescribeService",
        "log:GetAccount",
        "log:GetAccount",
        "log:GetAccount",
        "log:GetAgentInstanceConfig",
        "log:GetAgentInstanceConfig",
        "log:GetAgentInstanceConfig",
        "log:GetAgentInstanceConfig",
        "log:GetAgentInstanceConfig",
        "log:GetAnnotationLabel",
        "log:GetAnnotationLabel",
        "log:GetAnnotationLabel",
        "log:GetApp",
        "log:GetApp",
        "log:GetApp",
        "log:GetAsyncSQL",
        "log:GetAsyncSQL",
        "log:GetAsyncSQL",
        "log:GetCMSInnerExternalStore",
        "log:GetCMSInnerExternalStore",
        "log:GetCMSInnerExternalStore",
        "log:GetCluster",
        "log:GetCluster",
        "log:GetCluster",
        "log:GetCollectionPolicy",
        "log:GetCollectionPolicy",
        "log:GetCollectionPolicy",
        "log:GetCursor",
        "log:GetCursor",
        "log:GetCursor",
        "log:GetDataExpression",
        "log:GetDataExpression",
        "log:GetDataExpression",
        "log:GetDiagnosis",
        "log:GetDiagnosis",
        "log:GetDiagnosis",
        "log:GetEcsAliUid",
        "log:GetEcsAliUid",
        "log:GetEcsAliUid",
        "log:GetEntityStore",
        "log:GetEntityStore",
        "log:GetEntityStore",
        "log:GetGlobalProject",
        "log:GetGlobalProject",
        "log:GetGlobalProject",
        "log:GetLogs",
        "log:GetLogs",
        "log:GetLogs",
        "log:GetMLServiceResults",
        "log:GetMLServiceResults",
        "log:GetMLServiceResults",
        "log:GetMLServiceResults",
        "log:GetMLServiceResults",
        "log:GetPartitions",
        "log:GetPartitions",
        "log:GetPartitions",
        "log:GetProductDataCollection",
        "log:GetProductDataCollection",
        "log:GetProductDataCollection",
        "log:GetProductDataCollection",
        "log:GetProjectInfo",
        "log:GetProjectInfo",
        "log:GetProjectInfo",
        "log:GetRecordingRule",
        "log:GetRecordingRule",
        "log:GetRecordingRule",
        "log:GetResource",
        "log:GetResource",
        "log:GetResource",
        "log:GetResource",
        "log:GetResourceRecord",
        "log:GetResourceRecord",
        "log:GetResourceRecord",
        "log:GetResourceRecord",
        "log:GetRoleFlags",
        "log:GetRoleFlags",
        "log:GetRoleFlags",
        "log:GetShards",
        "log:GetShards",
        "log:GetShards",
        "log:GetShardsInPartition",
        "log:GetShardsInPartition",
        "log:GetShardsInPartition",
        "log:GetWorkerFlags",
        "log:GetWorkerFlags",
        "log:GetWorkerFlags",
        "log:GetWorkers",
        "log:GetWorkers",
        "log:GetWorkers",
        "log:ListAccounts",
        "log:ListAccounts",
        "log:ListAccounts",
        "log:ListAgentInstanceConfigs",
        "log:ListAgentInstanceConfigs",
        "log:ListAgentInstanceConfigs",
        "log:ListAiTools",
        "log:ListAiTools",
        "log:ListAiTools",
        "log:ListAnnotationData",
        "log:ListAnnotationData",
        "log:ListAnnotationData",
        "log:ListAnnotationDataSets",
        "log:ListAnnotationDataSets",
        "log:ListAnnotationDataSets",
        "log:ListAnnotationLabels",
        "log:ListAnnotationLabels",
        "log:ListAnnotationLabels",
        "log:ListClusters",
        "log:ListClusters",
        "log:ListClusters",
        "log:ListCollectionPolicies",
        "log:ListCollectionPolicies",
        "log:ListCollectionPolicies",
        "log:ListDashboardSharing",
        "log:ListDashboardSharing",
        "log:ListDashboardSharing",
        "log:ListGlobalProjects",
        "log:ListGlobalProjects",
        "log:ListGlobalProjects",
        "log:ListNextResourceRecords",
        "log:ListNextResourceRecords",
        "log:ListNextResourceRecords",
        "log:ListProjects",
        "log:ListProjects",
        "log:ListProjects",
        "log:ListResourceRecords",
        "log:ListResourceRecords",
        "log:ListResourceRecords",
        "log:ListResourceRecords",
        "log:ListResources",
        "log:ListResources",
        "log:ListResources",
        "log:ListResources",
        "log:ListTagResource",
        "log:ListTagResource",
        "log:ListTagResource",
        "log:QueryPartition",
        "log:QueryPartition",
        "log:QueryProject",
        "log:QueryProject",
        "log:QueryPrometheusMetrics",
        "log:QueryPrometheusMetrics",
        "log:QueryPrometheusMetrics",
        "log:QueryPrometheusMetrics",
        "log:QueryPrometheusMetrics"
      ],
      "Resource": "*"
    }
  ]
}

  • 允许不支持资源组级别授权的全部操作：Action中列举不支持资源组级别授权的全部操作。

    {
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "log:AccessDashboardSharing",
        "log:AnalyzeProductLog",
        "log:BalancePartitions",
        "log:BatchGetGlobalProject",
        "log:BatchGetIndex",
        "log:BatchGetStore",
        "log:CallAiTools",
        "log:CheckArmsAuthorization",
        "log:CheckUserPermission",
        "log:CreateAccount",
        "log:CreateAgentInstanceConfig",
        "log:CreateAnnotationDataSet",
        "log:CreateAnnotationLabel",
        "log:CreateApp",
        "log:CreateCMSInnerExternalStore",
        "log:CreateCluster",
        "log:CreateDashboardSharing",
        "log:CreateDataExpression",
        "log:CreateEntityStore",
        "log:CreateRecordingRule",
        "log:CreateResourceRecord",
        "log:CreateTicket",
        "log:DeleteAccount",
        "log:DeleteAgentInstanceConfig",
        "log:DeleteCollectionPolicy",
        "log:DeleteDashboardSharing",
        "log:DeleteEntityStore",
        "log:DeleteRecordingRule",
        "log:DeleteResource",
        "log:DeleteResourceRecord",
        "log:DescribeService",
        "log:DisableWorker",
        "log:EnableService",
        "log:EnableWorker",
        "log:GetAccount",
        "log:GetAccount",
        "log:GetAccount",
        "log:GetAgentInstanceConfig",
        "log:GetAgentInstanceConfig",
        "log:GetAgentInstanceConfig",
        "log:GetAgentInstanceConfig",
        "log:GetAgentInstanceConfig",
        "log:GetAnnotationLabel",
        "log:GetAnnotationLabel",
        "log:GetAnnotationLabel",
        "log:GetApp",
        "log:GetApp",
        "log:GetApp",
        "log:GetAsyncSQL",
        "log:GetAsyncSQL",
        "log:GetAsyncSQL",
        "log:GetCMSInnerExternalStore",
        "log:GetCMSInnerExternalStore",
        "log:GetCMSInnerExternalStore",
        "log:GetCluster",
        "log:GetCluster",
        "log:GetCluster",
        "log:GetCollectionPolicy",
        "log:GetCollectionPolicy",
        "log:GetCollectionPolicy",
        "log:GetCursor",
        "log:GetCursor",
        "log:GetCursor",
        "log:GetDataExpression",
        "log:GetDataExpression",
        "log:GetDataExpression",
        "log:GetDiagnosis",
        "log:GetDiagnosis",
        "log:GetDiagnosis",
        "log:GetEcsAliUid",
        "log:GetEcsAliUid",
        "log:GetEcsAliUid",
        "log:GetEntityStore",
        "log:GetEntityStore",
        "log:GetEntityStore",
        "log:GetGlobalProject",
        "log:GetGlobalProject",
        "log:GetGlobalProject",
        "log:GetLogs",
        "log:GetLogs",
        "log:GetLogs",
        "log:GetMLServiceResults",
        "log:GetMLServiceResults",
        "log:GetMLServiceResults",
        "log:GetMLServiceResults",
        "log:GetMLServiceResults",
        "log:GetPartitions",
        "log:GetPartitions",
        "log:GetPartitions",
        "log:GetProductDataCollection",
        "log:GetProductDataCollection",
        "log:GetProductDataCollection",
        "log:GetProductDataCollection",
        "log:GetProjectInfo",
        "log:GetProjectInfo",
        "log:GetProjectInfo",
        "log:GetRecordingRule",
        "log:GetRecordingRule",
        "log:GetRecordingRule",
        "log:GetResource",
        "log:GetResource",
        "log:GetResource",
        "log:GetResource",
        "log:GetResourceRecord",
        "log:GetResourceRecord",
        "log:GetResourceRecord",
        "log:GetResourceRecord",
        "log:GetRoleFlags",
        "log:GetRoleFlags",
        "log:GetRoleFlags",
        "log:GetShards",
        "log:GetShards",
        "log:GetShards",
        "log:GetShardsInPartition",
        "log:GetShardsInPartition",
        "log:GetShardsInPartition",
        "log:GetWorkerFlags",
        "log:GetWorkerFlags",
        "log:GetWorkerFlags",
        "log:GetWorkers",
        "log:GetWorkers",
        "log:GetWorkers",
        "log:ListAccounts",
        "log:ListAccounts",
        "log:ListAccounts",
        "log:ListAgentInstanceConfigs",
        "log:ListAgentInstanceConfigs",
        "log:ListAgentInstanceConfigs",
        "log:ListAiTools",
        "log:ListAiTools",
        "log:ListAiTools",
        "log:ListAnnotationData",
        "log:ListAnnotationData",
        "log:ListAnnotationData",
        "log:ListAnnotationDataSets",
        "log:ListAnnotationDataSets",
        "log:ListAnnotationDataSets",
        "log:ListAnnotationLabels",
        "log:ListAnnotationLabels",
        "log:ListAnnotationLabels",
        "log:ListClusters",
        "log:ListClusters",
        "log:ListClusters",
        "log:ListCollectionPolicies",
        "log:ListCollectionPolicies",
        "log:ListCollectionPolicies",
        "log:ListDashboardSharing",
        "log:ListDashboardSharing",
        "log:ListDashboardSharing",
        "log:ListGlobalProjects",
        "log:ListGlobalProjects",
        "log:ListGlobalProjects",
        "log:ListNextResourceRecords",
        "log:ListNextResourceRecords",
        "log:ListNextResourceRecords",
        "log:ListProjects",
        "log:ListProjects",
        "log:ListProjects",
        "log:ListResourceRecords",
        "log:ListResourceRecords",
        "log:ListResourceRecords",
        "log:ListResourceRecords",
        "log:ListResources",
        "log:ListResources",
        "log:ListResources",
        "log:ListResources",
        "log:ListTagResource",
        "log:ListTagResource",
        "log:ListTagResource",
        "log:LockWorker",
        "log:MovePartition",
        "log:MoveShard",
        "log:OpenSlsService",
        "log:PutAccount",
        "log:PutAnnotationData",
        "log:PutLogs",
        "log:PutOpenEvent",
        "log:QueryPartition",
        "log:QueryPartition",
        "log:QueryProject",
        "log:QueryProject",
        "log:QueryPrometheusMetrics",
        "log:QueryPrometheusMetrics",
        "log:QueryPrometheusMetrics",
        "log:QueryPrometheusMetrics",
        "log:QueryPrometheusMetrics",
        "log:RefreshToken",
        "log:RemoteWritePrometheus",
        "log:SetGeneralDataAccessConfig",
        "log:SetWorkerFlags",
        "log:SubmitAsyncSQL",
        "log:UnlockWorker",
        "log:UpdateAccount",
        "log:UpdateAgentInstanceConfig",
        "log:UpdateApp",
        "log:UpdateCluster",
        "log:UpdateDashboardSharing",
        "log:UpdateDataExpression",
        "log:UpdateLogStoreInternalConfig",
        "log:UpdateProjectOwner",
        "log:UpdateProjectQuota",
        "log:UpdateProjectV2",
        "log:UpdateResource",
        "log:UpdateResourceRecord",
        "log:UpsertCollectionPolicy",
        "log:UpsertResourceRecord",
        "log:VerifySignature"
      ],
      "Resource": "*"
    }
  ]
}
重要

获得账号级别权限的RAM用户或RAM角色，能够操作整个账号范围内的相关资源。请务必确认所授予的权限是否符合预期，遵从最小授权原则谨慎分配权限。

常见问题

如何查看当前资源属于哪个资源组？

  • 方式一：单击资源名称，进入资源的详情页面，即可查看到当前资源的资源组。

  • 方式二：登录资源管理控制台，单击资源中心 > 资源搜索，在左侧选择目标资源所属账号（默认为当前账号），通过筛选条件定位目标资源，即可查看其所属资源组。

如何查看当前产品在某个资源组下的所有资源？

  • 方式一：登录资源管理控制台，单击资源中心 > 资源搜索，然后在左侧的资源所属账号（默认为当前账号）下选择单击目标资源组名称，最后在右侧的选择资源类型中选择当前产品，即可查看当前产品在某个资源组下的所有资源。

  • 方式二：登录资源管理控制台，单击资源组 > 资源组，然后找到目标资源组，单击其所在行的操作列下的资源管理，最后在资源管理页面上方的产品下拉框中选择当前产品，即可查看当前产品在某个资源组下的所有资源。

如何批量修改多个资源的资源组？

登录资源管理控制台，单击资源组 > 资源组，在目标资源组所在行的操作列下，单击资源管理以进入资源管理页面。通过筛选条件定位多个目标资源，批量勾选第一列的复选框后单击下方转移资源组，并按页面提示完成资源组修改。

上一篇：使用RAM进行访问控制下一篇：简介