Docs

Torch Log Service

Permission management

Authorizable resources

The resource (Resource) in permission policy language defines the specific objects to be authorized, and is used to manage IAM user access to different resource objects. This topic lists the types of IAM-authorized resources supported by TLS.

Tip

Variables such as {$region} and {$accountid} must be replaced with your actual parameter information.

Resources in TLS have a hierarchical relationship.

The project is the root resource in TLS. Topics, collection configurations, schedule SQL tasks, processing tasks, delivery configurations, dashboards, alarm policies, and consumer groups are all child resources at the same level.

Import tasks are child resources of log topics.

Password-free links are child resources of dashboards.

Host groups, alarm groups, alarm notification templates, alarm Webhook integration settings, Trace instances, and log projects are all at the same level.

Resource type	Description of resource scope	TRN
Log project (Project)	All projects, or specified projects.	trn:tls:{$region}:{$accountid}:project/* trn:tls:{$region}:{$accountid}:project/{$projectid}
Log topic (Topic)	All topics under a designated project, or specified topics.	trn:tls:{$region}:{$accountid}:project/{$projectid}/topic/* trn:tls:{$region}:{$accountid}:project/{$projectid}/topic/{$topicid}
Collection configuration (Rule)	All collection configurations under a designated project, or specified collection configurations.	trn:tls:{$region}:{$accountid}:project/{$projectid}/rule/* trn:tls:{$region}:{$accountid}:project/{$projectid}/rule/{$ruleid}
Schedule SQL task (ScheduleSqlTask)	All schedule SQL tasks under a designated project, or designated schedule SQL tasks.	trn:tls:{$region}:{$accountid}:project/{$projectid}/schedule_sql/* trn:tls:{$region}:{$accountid}:project/{$projectid}/schedule_sql/{$schedulesqltaskid}
Dashboard	All dashboards under a designated project, or designated dashboards.	trn:tls:{$region}:{$accountid}:project/{$projectid}/dashboard/* trn:tls:{$region}:{$accountid}:project/{$projectid}/dashboard/{$dashboardid}
Password-free link (DashboardShares)	All password-free links under the designated dashboard, or specified password-free links.	trn:tls:{$region}:{{accountId}}:project/{{projectId}}/dashboard/{{dashboardID}}/share/* trn:tls:{$region}:{{accountId}}:project/{{projectId}}/dashboard/{{dashboardID}}/share/{{ticketID}}
Alarm policy( Alarm)	All alarm policies under a designated project, or specified alarm policies.	trn:tls:{$region}:{$accountid}:project/{$projectid}/alarm/* trn:tls:{$region}:{$accountid}:project/{$projectid}/alarm/{$alarmid}
Consumer Group (ConsumerGroup)	Specified consumer group under designated project, or all consumer groups.	trn:tls:{$region}:{$accountid}:project/{$projectid}/consumergroup/* trn:tls:{$region}:{$accountid}:project/{$projectid}/consumergroup/{$consumergroupid}
Import Task (ImportTask)	Specified import task under designated project, or all import tasks.	trn:tls:{$region}:{$accountid}:topic/{$topicid}/import_task/* trn:tls:{$region}:{$accountid}:topic/{$topicid}/import_task/{$import_task_id}
Transformation task (ETL)	Specified transformation tasks under designated project, or all transformation tasks.	trn:tls:{$region}:{$accountid}:project/{$projectid}/etl/* trn:tls:{$region}:{$accountid}:project/{$projectid}/etl/{$etltaskid}
Delivery configuration (Shipper)	Specified shipping configuration under designated project, or all shipping configurations.	trn:tls:{$region}:{$accountid}:project/{$projectid}/shipper/* trn:tls:{$region}:{$accountid}:project/{$projectid}/shipper/{$shipperid}
Host group (HostGroup)	All host groups, or specified host groups.	trn:tls:{$region}:{$accountid}:hostgroup/* trn:tls:{$region}:{$accountid}:hostgroup/{$hostgroupid}
AlarmNotifyGroup	All alarm groups, or specified alarm groups.	trn:tls:{$region}:{$accountid}:alarmnotifygroup/* trn:tls:{$region}:{$accountid}:alarmnotifygroup/{$alarmnotifygroupid}
ContentTemplate	All alarm notification content templates, or specified alarm notification content templates.	trn:tls:{$region}:{$accountid}:alarm_content_template_type/* trn:tls:{$region}:{$accountid}:alarm_content_template_type/{$contenttemplateid}
Alarm Webhook integration configuration (WebhookIntegration)	All Webhook integration configurations, or specified Webhook integration configuration.	trn:tls:{$region}:{$accountid}:alarm_webhook_integration_type/* trn:tls:{$region}:{$accountid}:alarm_webhook_integration_type/{$webhookintegrationid}
Trace instance (TraceInstance)	All Trace instances, or specified Trace instances.	trn:tls:{$region}:{$accountid}:traceins/* trn:tls:{$region}:{$accountid}:traceins/{$traceinsid}

Each resource is specified using parameters in the resource description method. Details are provided below.

Parameters	Description
${region}	Region ID.
{$accountid}	Volcanoengine account ID.
{$projectid}	Project ID.
{$topicid}	Log topic ID.
{$ruleid}	Collection configuration ID.
{$traceinsid}	Trace instance ID.
{$dashboardid}	Dashboard ID.
{$alarmid}	Alarm policy ID.
{$consumergroupid}	Consumer group ID.
{$import_task_id}	Import task ID.
{$etltaskid}	Processing task ID.
{$shipperid}	Delivery configuration ID.
{$hostgroupid}	Host group ID.
{$alarmnotifygroupid}	Alarm group ID.
{$contenttemplateid}	Alarm notification content template ID.
{$webhookintegrationid}	Alert Webhook integration configuration ID.
{$schedulesqltaskid}	Scheduled SQL task ID.

Last updated: 2026.10.16 16:06:54