Simple Log Service:Authorization for monitoring data across projects

Scenarios

Step 1: Configure authorization

1. Specify a query statement. For more information, see Create an Alert Rule.

2. Configure an authorization method.

   Default authorization

   For monitoring data within the same project using an alert rule, the Default authorization method is suitable.

   In the Advanced Configuration tab, set the Authorization Method to Default.

   Built-in role authorization

   For monitoring data in different projects within the same Alibaba Cloud account, assign the Built-in Role to Simple Log Service.

   In the Advanced Configuration tab, select Authorization Method as Built-in Role. If this is the first time you are configuring this, use the Alibaba Cloud account to complete the authorization as prompted on the page. After authorization, Simple Log Service will create a RAM role named AliyunSLSAlertMonitorRole and assume it to read data from the source Logstore.

   Custom role authorization (within an account)

   For monitoring data across multiple Alibaba Cloud accounts, assign a Custom Role to Simple Log Service.

   1. Create a RAM role with Alibaba Cloud Service as the trusted entity and select Simple Log Service as the trusted service.

   2. Create a custom policy. On the JSON tab, replace the existing contents in the editor with the following script. For more information, see Create a custom policy in script edit mode.

      Important

      Adjust the Project name as needed. For more granular permissions, such as authorizing only the creation of monitoring rules for a specific project, include the project in the Resource field of the policy, like acs:log:*:*:project/my-project.

      {
        "Statement": [
          {
            "Action": [
              "log:ListProject"
            ],
            "Effect": "Allow",
            "Resource": [
              "acs:log:*:*:*"
            ]
          },
          {
            "Action": [
              "log:ListLogStores",
              "log:GetLogStoreLogs",
              "log:GetIndex"
            ],
            "Effect": "Allow",
            "Resource": [
              "acs:log:*:*:project/Project名称/*"
            ]
          }
        ],
        "Version": "1"
      }

   3. Add the created custom policy to the RAM role. For more information, see Grant permissions to a RAM role.

   What to do next

   1. Obtain the ARN of the RAM role. For more information, see View a RAM role.

   2. For Custom Role authorization, input the RAM role identity. For details, see Create Alerting and Monitoring System Rule.

      

   Custom role authorization (across accounts)

   For monitoring data in different Logstores and Metricstores across multiple Alibaba Cloud accounts, assign a custom role to Simple Log Service. For instance, create an alert rule in Alibaba Cloud Account A to monitor data in Alibaba Cloud Account B's Logstores and Metricstores.

   In Alibaba Cloud Account B, perform the following:

   1. Create a RAM role with Alibaba Cloud Service as the trusted entity and select Simple Log Service as the trusted service.

   2. Modify the RAM role's trust policy. For details, see Modify the Trust Policy of the RAM Role.

      Important

      Substitute the actual ID of Alibaba Cloud Account A. The Alibaba Cloud account ID can be found in the Account Center.

      {
          "Statement": [
              {
                  "Action": "sts:AssumeRole",
                  "Effect": "Allow",
                  "Principal": {
                      "Service": [
                          "ID of Alibaba Cloud Account A@log.aliyuncs.com",
                          "log.aliyuncs.com"
                      ]
                  }
              }
          ],
          "Version": "1"
      }

   3. Create a custom policy. On the JSON tab, replace the existing contents in the editor with the following script. For more information, see Create a custom policy in script edit mode.

      Important

      Replace the script content accordingly. Adjust the Project name as needed. For more granular permissions, such as authorizing only the creation of monitoring rules for a specific project, include the project in the Resource field of the policy, like acs:log:*:*:project/my-project.

      {
        "Statement": [
          {
            "Action": [
              "log:ListProject"
            ],
            "Effect": "Allow",
            "Resource": [
              "acs:log:*:*:*"
            ]
          },
          {
            "Action": [
              "log:ListLogStores",
              "log:GetLogStoreLogs",
              "log:GetIndex"
            ],
            "Effect": "Allow",
            "Resource": [
              "acs:log:*:*:project/ProjectName/*"
            ]
          }
        ],
        "Version": "1"
      }

   4. Add the created custom policy to the RAM role. For more information, see Grant permissions to a RAM role.

   5. Obtain the ARN of the RAM role. For more information, see View a RAM role.

   What to do next

   1. Obtain the ARN of the RAM role. For more information, see View a RAM role.

   2. In Alibaba Cloud Account A, create an alert using Custom Role authorization with the Role ARN from the RAM role in Alibaba Cloud Account B. For more information, see Create Alerting and Monitoring Rules.

      

{
     "Action": "ram:PassRole",
     "Effect": "Allow",
     "Resource": "acs:ram::ID of Alibaba Cloud Account:Role ARN"
 }