Docs

Torch Log Service

Data transformation

Configure cross-account data transformation permissions

When processing TLS data in Volcanoengine Account A and writing the transformed results to TLS in Account B, you need to first follow this guide to create a custom role with cross-account transformation permissions.

Configuration instructions

To enable cross-account data transformation, complete the following configuration steps in Volcanoengine Account B.

Create a custom permission policy, for example, tls-etl-access. Make sure this policy has query and write permissions for the target Topic.

Create a custom role, for example, TLSCrossAccountTransformation.

Grant permissions to the role. Assign the tls-etl-access policy to the TLSCrossAccountTransformation role you have created.

After authorization is completed, you can create transformation tasks in Account A. During the transformation process, the task will act as the specified role to process TLS data in Account A and write it to TLS in Account B.

Description

If Account B is an IAM account, grant it query and write permissions for the target Topic first.

Steps

Use account B to log in to the Access Control IAM Console .

Create a custom permission policy.

In the left navigation pane, click Permission policy.

On the Permission policy page, click Create Policy.

On the Create Policy page, set the Policy name (for example, tls-etl-access). Then, in the JSON editor, enter the following policy script and click Submit.

{
"Statement": [
{
"Effect": "Allow",
"Action": [
"tls:DescribeTopic",
"tls:PutLogs"
],
"Resource": [
"*"
]
}
]
}

Create a role.

In the left navigation bar, click Role Management.

On the Role management page, click Create New Role.

In the Create New Role panel, complete the following configuration.

Set Select trusted identity to account, set Select identity to Other accounts, set account ID to the ID of account A, and then click Next.

Set the role name and then click Next.

The role name must begin with TLSCrossAccount, such as TLSCrossAccountTransformation.

Select the tls-etl-access permission policy for the role, and then click Submit.

Edit the role's trust relationship.

On the Role Management page, click the role created in the previous step.

On the Trust relationship tab, click Edit trust policy.

Change trn's root to role/ServiceRoleForTLS, and then click Save.

Record TRN of the role.

You will need to enter this role's TRN when creating a cross-account data transformation task. For details, see Create data transformation task.

Last updated: 2026.05.20 15:07:30