文档

管理服务关联角色AliyunServiceRoleForSLSAudit

更新时间:

您可以授予日志服务应用(例如日志审计服务、EBS Lens等)使用SLS日志服务关联角色(AliyunServiceRoleForSLSAudit)来获取其他云服务中的资源。本文介绍AliyunServiceRoleForSLSAudit角色的应用场景和权限策略。

应用场景

当您在日志服务应用(例如日志审计服务、EBS Lens等)中进行日志采集时,日志服务会调用相关云产品的OpenAPI接口获取采集账号下的云产品信息。此过程中,日志服务需要通过AliyunServiceRoleForSLSAudit角色获取云产品的部分读取及日志采集相关的部分修改权限。更多信息,请参见服务关联角色

AliyunServiceRoleForSLSAudit角色说明

说明 您在开通日志服务时,自动创建AliyunServiceRoleForSLSAudit角色。
  • 角色名称:AliyunServiceRoleForSLSAudit
  • 角色权限策略:AliyunServiceRolePolicyForSLSAudit
  • 权限说明:
    {
        "Version": "1",
        "Statement": [
            {
                "Action": [
                    "resourcemanager:ListAccounts",
                    "resourcemanager:GetAccount",
                    "resourcemanager:GetResourceDirectory",
                    "resourcemanager:GetFolder",
                    "resourcemanager:ListFoldersForParent",
                    "resourcemanager:ListAccountsForParent",
                    "rds:DescribeRegions",
                    "rds:DescribeSqlLogInstances",
                    "rds:DescribeDBInstanceAttribute",
                    "rds:ListTagResources",
                    "rds:DisableSqlLogDistribution",
                    "rds:EnableSqlLogDistribution",
                    "rds:ModifySQLCollectorPolicy",
                    "rds:DescribeSQLCollectorRetention",
                    "polardb:DescribeRegions",
                    "polardb:DescribeDBClusters",
                    "polardb:DescribeSqlLogClusters",
                    "polardb:ModifyDBClusterAuditLogCollector",
                    "polardb:DescribeDBClusterAttribute",
                    "polardb:DescribeSQLExplorerRetention",
                    "kvstore:DescribeRegions",
                    "kvstore:DescribeInstances",
                    "kvstore:DescribeRedisLogConfig",
                    "kvstore:ModifyAuditLogConfig",
                    "kvstore:DescribeInstanceAttribute",
                    "kvstore:DescribeEngineVersion",
                    "kvstore:InitializeKvstorePermission",
                    "drds:DescribeDrdsInstances",
                    "drds:DescribeDrdsDBs",
                    "drds:EnableSqlAuditExtraWrite",
                    "drds:DisableSqlAuditExtraWrite",
                    "drds:DescribeDrdsRegions",
                    "drds:DescribeDrdsSqlAuditStatus",
                    "slb:DescribeRegions",
                    "slb:DescribeLoadBalancers",
                    "slb:DescribeLoadBalancerAttribute",
                    "slb:SetAccessLogsDownloadAttribute",
                    "slb:DeleteAccessLogsDownloadAttribute",
                    "slb:DescribeAccessLogsDownloadAttribute",
                    "slb:ListTagResources",
                    "alb:DescribeRegions",
                    "alb:ListLoadBalancers",
                    "alb:EnableLoadBalancerAccessLog",
                    "alb:DisableLoadBalancerAccessLog",
                    "alb:GetLoadBalancerAttribute",
                    "cs:GetClustersByUid",
                    "cs:GetClusters",
                    "kms:DescribeKeyStores",
                    "oss:GetBucketInfo",
                    "oss:ListBuckets",
                    "oss:GetBucketTagging",
                    "oss:GetBucketWorm",
                    "oss:GetBucketLifecycle",
                    "oss:GetBucketReferer",
                    "ecs:DescribeDisks",
                    "ecs:DescribeSnapshots",
                    "ecs:DescribeRegions",
                    "ecs:DescribeInstances",
                    "mse:GetGateway",
                    "cen:ListTransitRouters",
                    "cen:ListTransitRouterPeerAttachments",
                    "cen:ListTransitRouterVbrAttachments",
                    "vpc:DescribeVpcs",
                    "vpc:GetNatGatewayAttribute",
                    "vpc:DescribeNatGateways",
                    "vpc:DescribeRegions",
                    "hbase:DescribeInstance",
                    "lindorm:GetLindormInstance"
                ],
                "Resource": "*",
                "Effect": "Allow"
            },
            {
                "Action": [
                    "oos:StartExecution",
                    "oos:ListExecutions"
                ],
                "Resource": [
                    "acs:oos:*:*:template/ACS-LOG-BulkyInstallLogtail",
                    "acs:oos:*:*:execution/*"
                ],
                "Effect": "Allow"
            },
            {
                "Action": [
                    "ecs:InvokeCommand",
                    "ecs:DescribeInvocations",
                    "ecs:DescribeInvocationResults",
                    "ecs:DescribeCloudAssistantStatus"
                ],
                "Resource": [
                    "acs:ecs:*:*:instance/*",
                    "acs:ecs:*:*:command/cmd-ACS-LOG-InstallLogtail-*"
                ],
                "Effect": "Allow"
            },
            {
                "Action": [
                    "log:CreateProject",
                    "log:GetProject",
                    "log:ListProject",
                    "log:ListLogStores",
                    "log:GetLogStore",
                    "log:GetLogStoreLogs",
                    "log:PostLogStoreLogs",
                    "log:BatchPostLogStoreLogs",
                    "log:CreateIndex",
                    "log:UpdateIndex",
                    "log:CreateDashboard",
                    "log:UpdateDashboard",
                    "log:CreateLogStore",
                    "log:CreateSavedSearch",
                    "log:UpdateSavedSearch",
                    "log:CreateJob",
                    "log:UpdateJob",
                    "log:ListShards",
                    "log:GetCursorOrData",
                    "log:GetConsumerGroupCheckPoint",
                    "log:UpdateConsumerGroup",
                    "log:ConsumerGroupHeartBeat",
                    "log:ConsumerGroupUpdateCheckPoint",
                    "log:ListConsumerGroup",
                    "log:CreateConsumerGroup",
                    "log:GetLogging",
                    "log:CreateLogging",
                    "log:UpdateLogging",
                    "log:DeleteLogging",
                    "log:PostProjectQuery",
                    "log:GetProjectQuery",
                    "log:PutProjectQuery",
                    "log:DeleteProjectQuery",
                    "log:GetMachineGroup",
                    "log:ListMachineGroup"
                ],
                "Resource": [
                    "acs:log:*:*:project/*"
                ],
                "Effect": "Allow"
            },
            {
                "Action": [
                    "log:GetApp",
                    "log:UpdateApp",
                    "log:CreateApp"
                ],
                "Resource": [
                    "acs:log:*:*:app/audit"
                ],
                "Effect": "Allow"
            },
            {
                "Action": "ram:CreateServiceLinkedRole",
                "Resource": "*",
                "Effect": "Allow",
                "Condition": {
                    "StringEquals": {
                        "ram:ServiceName": [
                            "r-kvstore.aliyuncs.com",
                            "logdelivery.alb.aliyuncs.com"
                        ]
                    }
                }
            },
            {
                "Action": "ram:DeleteServiceLinkedRole",
                "Resource": "*",
                "Effect": "Allow",
                "Condition": {
                    "StringEquals": {
                        "ram:ServiceName": "audit.log.aliyuncs.com"
                    }
                }
            }
        ]
    }