Log Service API 的鉴权规则是什么？_问答-阿里云开发者社区

Log Service API 发生子账号访问主账号资源时的鉴权规则

当子账号通过 Log Service Open API 对主账号的资源进行访问时，Log Service 后台向 RAM 进行权限检查，以确保资源拥有者的确将相关资源的相关权限授予了调用者。
每个不同的 Log Service API 会根据涉及到的资源以及 API 的语义来确定需要检查哪些资源的权限。具体地，各类 API 的鉴权规则见下表。

logstore

Action	Resource
log:GetLogStore	acs:log:[backcolor=transparent]${regionName}:[backcolor=transparent]${projectOwnerAliUid}:project/[backcolor=transparent]${projectName}/logstore/[backcolor=transparent]${logstoreName}
log:ListLogStores	acs:log:[backcolor=transparent]${regionName}:[backcolor=transparent]${projectOwnerAliUid}:project/[backcolor=transparent]${projectName}/logstore/*
log:CreateLogStore	acs:log:[backcolor=transparent]${regionName}:[backcolor=transparent]${projectOwnerAliUid}:project/[backcolor=transparent]${projectName}/logstore/*
log:DeleteLogStore	acs:log:[backcolor=transparent]${regionName}:[backcolor=transparent]${projectOwnerAliUid}:project/[backcolor=transparent]${projectName}/logstore/[backcolor=transparent]${logstoreName}
log:UpdateLogStore	acs:log:[backcolor=transparent]${regionName}:[backcolor=transparent]${projectOwnerAliUid}:project/[backcolor=transparent]${projectName}/logstore/[backcolor=transparent]${logstoreName}

loghub

数据写入以及消费类 API，其中获取数据游标 API GetCursor 以及获取数据 API GetLogs 共用同一个 Action（log:GetCursorOrData）。

Action	Resource
log:GetCursorOrData	acs:log:[backcolor=transparent]${regionName}:[backcolor=transparent]${projectOwnerAliUid}:project/[backcolor=transparent]${projectName}/logstore/[backcolor=transparent]${logstoreName}
log:ListShards	acs:log:[backcolor=transparent]${regionName}:[backcolor=transparent]${projectOwnerAliUid}:project/[backcolor=transparent]${projectName}/logstore/[backcolor=transparent]${logstoreName}
log:PostLogStoreLogs	acs:log:[backcolor=transparent]${regionName}:[backcolor=transparent]${projectOwnerAliUid}:project/[backcolor=transparent]${projectName}/logstore/[backcolor=transparent]${logstoreName}

config

Action	Resource
log:CreateConfig	acs:log:[backcolor=transparent]${regionName}:[backcolor=transparent]${projectOwnerAliUid}:project/[backcolor=transparent]${projectName}/logtailconfig/*
log:UpdateConfig	acs:log:[backcolor=transparent]${regionName}:[backcolor=transparent]${projectOwnerAliUid}:project/[backcolor=transparent]${projectName}/logtailconfig/[backcolor=transparent]${logtailConfigName}
log:DeleteConfig	acs:log:[backcolor=transparent]${regionName}:[backcolor=transparent]${projectOwnerAliUid}:project/[backcolor=transparent]${projectName}/logtailconfig/[backcolor=transparent]${logtailConfigName}
log:GetConfig	acs:log:[backcolor=transparent]${regionName}:[backcolor=transparent]${projectOwnerAliUid}:project/[backcolor=transparent]${projectName}/logtailconfig/[backcolor=transparent]${logtailConfigName}
log:ListConfig	acs:log:[backcolor=transparent]${regionName}:[backcolor=transparent]${projectOwnerAliUid}:project/[backcolor=transparent]${projectName}/logtailconfig/*

machinegroup

Actions	Resources
log:CreateMachineGroup	acs:log:[backcolor=transparent]${regionName}:[backcolor=transparent]${projectOwnerAliUid}:project/[backcolor=transparent]${projectName}/machinegroup/*
log:UpdateMachineGroup	acs:log:[backcolor=transparent]${regionName}:[backcolor=transparent]${projectOwnerAliUid}:project/[backcolor=transparent]${projectName}/machinegroup/[backcolor=transparent]${machineGroupName}
log:DeleteMachineGroup	acs:log:[backcolor=transparent]${regionName}:[backcolor=transparent]${projectOwnerAliUid}:project/[backcolor=transparent]${projectName}/machinegroup/[backcolor=transparent]${machineGroupName}
log:GetMachineGroup	acs:log:[backcolor=transparent]${regionName}:[backcolor=transparent]${projectOwnerAliUid}:project/[backcolor=transparent]${projectName}/machinegroup/[backcolor=transparent]${machineGroupName}
log:ListMachineGroup	acs:log:[backcolor=transparent]${regionName}:[backcolor=transparent]${projectOwnerAliUid}:project/[backcolor=transparent]${projectName}/machinegroup/*
log:ListMachines	acs:log:[backcolor=transparent]${regionName}:[backcolor=transparent]${projectOwnerAliUid}:project/[backcolor=transparent]${projectName}/machinegroup/[backcolor=transparent]${machineGroupName}

config 和 machinegroup 交互类 API

Actions	Resources
log:ApplyConfigToGroup	acs:log:[backcolor=transparent]${regionName}:[backcolor=transparent]${projectOwnerAliUid}:project/[backcolor=transparent]${projectName}/logtailconfig/[backcolor=transparent]${logtailConfigName} acs:log:[backcolor=transparent]${regionName}:[backcolor=transparent]${projectOwnerAliUid}:project/[backcolor=transparent]${projectName}/machinegroup/[backcolor=transparent]${machineGroupName}
log:RemoveConfigFromGroup	acs:log:[backcolor=transparent]${regionName}:[backcolor=transparent]${projectOwnerAliUid}:project/[backcolor=transparent]${projectName}/logtailconfig/[backcolor=transparent]${logtailConfigName} acs:log:[backcolor=transparent]${regionName}:[backcolor=transparent]${projectOwnerAliUid}:project/[backcolor=transparent]${projectName}/machinegroup/[backcolor=transparent]${machineGroupName}
log:GetAppliedMachineGroups	acs:log:[backcolor=transparent]${regionName}:[backcolor=transparent]${projectOwnerAliUid}:project/[backcolor=transparent]${projectName}/logtailconfig/[backcolor=transparent]${logtailConfigName}

[tr=rgb(239, 251, 255)][td]log:GetAppliedConfigs acs:log:[backcolor=transparent]${regionName}:[backcolor=transparent]${projectOwnerAliUid}:project/[backcolor=transparent]${projectName}/machinegroup/[backcolor=transparent]${machineGroupName}

Log Service API 的鉴权规则是什么？

相关课程

相关电子书

相关实验场景

Log Service API 的鉴权规则是什么？

相关课程

相关文章

相关电子书

相关实验场景