If the Log Service belongs to Volcano Engine account A and Object Storage TOS belongs to Volcano Engine account B, when you need to ship data from Log Service across accounts to a TOS Bucket, create a custom role with cross-account log shipping permissions according to this document.

Configuration instructions

Create a custom role in account B and grant it the TLSShipperTosAccess policy permission. The TLSShipperTosAccess policy is a system preset policy that grants necessary permissions for Log Service to ship data to TOS. After authorization is complete, the Log Service shipping task can assume this role to ship Log Service data from account A to the TOS Bucket in account B.

tip

If account B is an IAM account, you must first grant TLSShipperTosAccess permission to account B.

Steps

Create a role.

In the left navigation pane, click Role Management.

On the Role Management page, click Create Role.

In the Create Role panel, complete the following configurations.

Set Select Trusted Entity to Account, set Select Entity to Other Account, set Account ID to account A's ID, then click Next.

Set the role name, then click Next.

The role name must start with TLSCrossAccount, for example, TLSCrossAccountShipTOS.

Select the TLSShipperTosAccess permission for the role, then click Submit.

Modify the role's trust relationship.

On the Role Management page, click the role created in the previous step.

Under the Trust Relationship tab, click Edit Trust Policy.

Change the root in trn to role/ServiceRoleForTLS, then click Save.

Record the role TRN.

You need to enter the role TRN when creating a cross-account delivery task. For detailed steps, see deliver in JSON format and deliver in CSV format.

Last updated: 2025.10.13 18:07:34

Public security network record in Beijing: No. 11010802032137