系統權限策略

自定義權限策略

1. 使用阿里云賬號（主賬號）或RAM管理員登錄RAM控制臺。

2. 創建權限策略。

   您可以授予RAM用戶使用CloudLens for ALB的只讀權限或讀寫權限。

   只讀權限

   只允許查看CloudLens for ALB中的各個頁面。

   在創建權限策略頁面，單擊腳本編輯頁簽，并使用以下腳本替換配置框中的原有內容。具體操作，請參見通過腳本編輯模式創建自定義權限策略。

   {
       "Statement": [
           {
               "Action": [
                   "log:GetLogStore",
                   "log:ListLogStores",
                   "log:GetIndex",
                   "log:GetLogStoreHistogram",
                   "log:GetLogStoreLogs",
                   "log:GetDashboard",
                   "log:ListDashboard",
                   "log:ListSavedSearch",
                   "log:GetProjectLogs"
               ],
               "Resource": [
                   "acs:log:*:*:project/*/logstore/*",
                   "acs:log:*:*:project/*/dashboard/*",
                   "acs:log:*:*:project/*/savedsearch/*"
               ],
               "Effect": "Allow"
           },
           {
               "Action": "log:GetProductDataCollection",
               "Resource": [
                   "acs:log:*:*:project/*/logstore/*",
                   "acs:alb:*:*:loadbalancer/*"
               ],
               "Effect": "Allow"
           },
           {
               "Action": "log:ListProject",
               "Resource": "acs:log:*:*:project/*",
               "Effect": "Allow"
           }
       ],
       "Version": "1"
   }

   讀寫權限

   允許操作CloudLens for ALB中的各個功能。

   在創建權限策略頁面，單擊腳本編輯頁簽，并使用以下腳本替換配置框中的原有內容。具體操作，請參見通過腳本編輯模式創建自定義權限策略。

   {
       "Statement": [
           {
               "Action": [
                   "log:GetLogStore",
                   "log:ListLogStores",
                   "log:GetIndex",
                   "log:GetLogStoreHistogram",
                   "log:GetLogStoreLogs",
                   "log:GetDashboard",
                   "log:ListDashboard",
                   "log:ListSavedSearch",
                   "log:CreateLogStore",
                   "log:CreateIndex",
                   "log:UpdateIndex",
                   "log:ListLogStores",
                   "log:GetLogStore",
                   "log:GetLogStoreLogs",
                   "log:CreateDashboard",
                   "log:CreateChart",
                   "log:UpdateDashboard",
                   "log:UpdateLogStore",
                   "log:GetProjectLogs"
               ],
               "Resource": [
                   "acs:log:*:*:project/*/logstore/*",
                   "acs:log:*:*:project/*/dashboard/*",
                   "acs:log:*:*:project/*/savedsearch/*"
               ],
               "Effect": "Allow"
           },        
           {
               "Action": [
                   "log:GetProductDataCollection",
                   "log:OpenProductDataCollection",
                   "log:CloseProductDataCollection"
               ],
               "Resource": [
                   "acs:log:*:*:project/*/logstore/*",
                   "acs:alb:*:*:loadbalancer/*"
               ],
               "Effect": "Allow"
           },
           {
               "Action": [
                   "log:SetGeneralDataAccessConfig"
               ],
               "Resource": [
                   "acs:log:*:*:resource/sls.general_data_access.alb.global_conf.standard_channel/record"
               ],
               "Effect": "Allow"
           },
           {
               "Action": "ram:CreateServiceLinkedRole",
               "Resource": "*",
               "Effect": "Allow",
               "Condition": {
                   "StringEquals": {
                       "ram:ServiceName": "audit.log.aliyuncs.com"              }
               }
           },
           {
               "Action": "log:ListProject",
               "Resource": "acs:log:*:*:project/*",
               "Effect": "Allow"
           }
       ],
       "Version": "1"
   }

3. 為RAM用戶添加創建的自定義權限策略。具體操作，請參見為RAM用戶授權。