Simple Log Service:Authorization rules

Policy elements

For more information about the concepts and syntax of policies, see Policy elements.

Procedure

1. Create an account administrator.

   An Alibaba Cloud account has full management permissions on the resources within the account. You cannot impose limits such as limits on source IP addresses and time periods of access by using an Alibaba Cloud account. If an Alibaba Cloud account is shared by multiple users, you cannot identify a specific user in audit logs. If an Alibaba Cloud account is disclosed, security risks may arise. We recommend that you do not use an Alibaba Cloud account to perform daily O&M operations.

   You can use an Alibaba Cloud account to create a RAM user in RAM and attach the AdministratorAccess policy to the RAM user. Then, you can use the RAM user as an account administrator to manage all cloud resources that belong to the Alibaba Cloud account. You can use the account administrator to create multiple RAM users for access control.

2. Create a custom policy.

   RAM provides two types of policies: system policies and custom policies. System policies are created and updated by Alibaba Cloud. You can use system policies, but you cannot modify them. If system policies cannot meet your requirements, you can create a custom policy to perform fine-grained access control.

3. Create a RAM user or RAM role and grant the required permissions.

   • Create a RAM user and grant permissions to the user.

     You can create RAM users and grant the RAM users the permissions to access different resources.

     If multiple users in your enterprise need to access resources, you can use RAM to assign permissions to the users by following the principle of least privilege. This prevents the users from sharing the username and password or AccessKey pair of an Alibaba Cloud account and reduces security risks.

   • Create a RAM user group and grant permissions to the group.

     RAM user groups are physical identities. You can create RAM user groups to classify RAM users and grant permissions to the RAM users that have the same responsibilities. This simplifies the management of RAM users and their permissions.

   • Create a RAM role and attach the required policies to the role.

     A RAM role is a virtual identity to which policies can be attached. A RAM role does not have permanent identity credentials, such as a logon password or an AccessKey pair. A RAM role can be used only after the role is assumed by a trusted entity. After a RAM role is assumed by a trusted entity, the trusted entity can obtain a Security Token Service (STS) token. Then, the trusted entity can use the STS token to access Alibaba Cloud resources as the RAM role. For more information about how to use a RAM role, see Assume a RAM role.

Action

The Action element is in the log:${API name} format. ${API name} specifies the name of a Simple Log Service API operation. For more information about the API operations provided by Simple Log Service, see List of operations by function.

When you create a policy, separate multiple actions with commas (,). You can use asterisks (*) as wildcard characters. Example: log:Create*. Create* specifies an API operation name that starts with Create, such as CreateProduct, CreateThingModel, and CreateProductTopic.

Resource

Resources in Simple Log Service are organized into a hierarchy. Projects are root resources. Logstores, Logtail configurations, and machine groups are parallel sub-resources of projects. Log shipping jobs and consumer groups are sub-resources of Logstores.

Parameters