鑒權規則__RAM子用戶訪問_API-Reference_日誌服務-阿裏雲

當子賬號通過 Log Service Open API 對主賬號的資源進行訪問時，Log Service後台向 RAM 進行權限檢查，以確保資源擁有者的確將相關資源的相關權限授予了調用者。

每個不同的 Log Service API 會根據涉及到的資源以及 API 的語義來確定需要檢查哪些資源的權限。具體地，各類 API 的鑒權規則見下表

Action	Resource
log:GetLogStore	acs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/logstore/${logstoreName}
log:ListLogStores	acs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/logstore/*
log:CreateLogStore	acs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/logstore/*
log:DeleteLogStore	acs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/logstore/${logstoreName}
log:UpdateLogStore	acs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/logstore/${logstoreName}

數據寫入以及消費類API，其中獲取數據遊標API GetCursor以及獲取數據API GetLogs共用同一個Action log:GetCursorOrData。

Action	Resource
log:GetCursorOrData	acs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/logstore/${logstoreName}
log:ListShards	acs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/logstore/${logstoreName}
log:PostLogStoreLogs	acs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/logstore/${logstoreName}

Action	Resource
log:CreateConfig	acs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/logtailconfig/*
log:UpdateConfig	acs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/logtailconfig/${logtailConfigName}
log:DeleteConfig	acs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/logtailconfig/${logtailConfigName}
log:GetConfig	acs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/logtailconfig/${logtailConfigName}
log:ListConfig	acs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/logtailconfig/*

Actions	Resources
log:CreateMachineGroup	acs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/machinegroup/*
log:UpdateMachineGroup	acs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/machinegroup/${machineGroupName}
log:DeleteMachineGroup	acs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/machinegroup/${machineGroupName}
log:GetMachineGroup	acs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/machinegroup/${machineGroupName}
log:ListMachineGroup	acs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/machinegroup/*
log:ListMachines	acs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/machinegroup/${machineGroupName}

Actions	Resources
log:ApplyConfigToGroup	acs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/logtailconfig/${logtailConfigName} acs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/machinegroup/${machineGroupName}
log:RemoveConfigFromGroup	acs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/logtailconfig/${logtailConfigName} acs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/machinegroup/${machineGroupName}
log:GetAppliedMachineGroups	acs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/logtailconfig/${logtailConfigName}
log:GetAppliedConfigs	acs:log:${regionName}:${projectOwnerAliUid}:project/${projectName}/machinegroup/${machineGroupName}

最後更新：2016-11-23 16:04:03