應用場景

• 訪問日志服務SLS（Log Service）

  當您創建跟蹤并設置了SLS Project地址用于接收操作事件時，操作審計需要向您指定的SLS Project創建Logstore并寫入操作事件。此時需要訪問日志服務SLS的相關權限。

• 訪問對象存儲OSS（Object Storage Service）

  當您創建跟蹤并設置了OSS存儲空間用于接收操作事件時，操作審計需要向您指定的OSS存儲空間寫入操作事件。此時需要訪問對象存儲OSS的相關權限。

• 訪問大數據計算服務MaxCompute（MaxCompute）

  當您創建跟蹤并設置了MaxCompute項目用于接收操作事件時，操作審計需要向您指定的MaxCompute項目表寫入操作事件。此時需要訪問大數據計算服務MaxCompute的相關權限。

權限策略說明

權限策略名稱：AliyunActionTrailDeliveryPolicy

權限策略內容：

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "oss:PutObject",
                "oss:GetBucketInfo",
                "oss:GetBucketLifecycle",
                "oss:GetBucketLocation",
                "kms:ListKeys",
                "kms:Listalias",
                "kms:ListAliasesByKeyId",
                "kms:DescribeKey",
                "kms:GenerateDataKey",
                "kms:Decrypt"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "log:GetProject"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "log:PostLogStoreLogs",
                "log:CreateLogstore",
                "log:GetLogstore",
                "log:CreateIndex",
                "log:UpdateIndex",
                "log:GetIndex",
                "log:GetLogStoreLogs"
            ],
            "Resource": [
                "acs:log:*:*:project/*/logstore/actiontrail_*",
                "acs:log:*:*:project/*/logstore/insights_*"
            ],
            "Effect": "Allow"
        },
        {
            "Action": [
                "log:CreateDashboard",
                "log:UpdateDashboard"
            ],
            "Resource": "acs:log:*:*:project/*/dashboard/*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "log:CreateSavedSearch",
                "log:UpdateSavedSearch"
            ],
            "Resource": [
                "acs:log:*:*:project/*/savedsearch/actiontrail_*",
                "acs:log:*:*:project/*/savedsearch/insights_*"
            ],
            "Effect": "Allow"
        },
        {
            "Effect": "Allow",
            "Action": "odps:updateUsersToAdmin",
            "Resource": "acs:odps:*:*:projects/actiontrail_*"
        }
    ]
}

權限策略說明：操作審計使用此策略訪問SLS和OSS中的資源。權限說明如下表所示。