Docs

Torch Log Service

Permission management

Cross-service access authorization

TLS can assume the ServiceRoleForTLS role to access other cloud resources across services. This topic describes the steps for cross-service access authorization.

Background information

A service-linked role is an IAM role whose trusted entity is Volcanoengine services, designed to solve cross-service authorized access issues. The ServiceRoleForTLS role for TLS is a service-linked role with a set of preset permission policies. It allows TLS to access specified cloud resources under your account. For example, when using the delivery feature of TLS, TLS will assume the ServiceRoleForTLS role to access TOS and retrieve information such as the list of TOS buckets.

Notice

Once the ServiceRoleForTLS role is created, TLS can continue to access the authorized resources until the role is deleted.

The permissions for the ServiceRoleForTLS role are automatically generated by the system and can not be changed. If you need to revoke authorization, delete the role.

Scheduled SQL analysis tasks, password-free alarm details access, dashboard subscription, and TOS delivery all require ServiceRoleForTLS authorization. After you create the ServiceRoleForTLS role in any feature module, you don't need to create it again in other feature modules.

It is recommended to use the Volcanoengine primary account for cross-service access authorization.

When authorizing cross-service access for an IAM user, you must first grant the IAMFullAccess system policy to the IAM user. For details, see Common IAM System Policies.

Steps

This topic uses the example of creating the ServiceRoleForTLS role on the TLS delivery page.

Select the region where log service is located from the top navigation bar.

On the left navigation bar, select Data processing > Log shipping.

On the Log shipping page, click Create TOS shipping configuration.

On the pop-up cross-service access request page, verify the associated role and trust relationship, and then click Authorize.

After successful authorization, you can view the created ServiceRoleForTLS role in the IAM roles list.

Last updated: 2026.04.14 17:44:42