If the Log Service belongs to Volcano Engine account A, and the Kafka version of Message Queue belongs to Volcano Engine account B, when you need to ship data from Log Service across accounts to Kafka, refer to this document to create a custom role with cross-account log shipping permissions.

Configuration description

Create a custom role in account B and grant it the TLSShipperKafkaAccess policy permission. The TLSShipperKafkaAccess policy permission is a system preset policy that includes the necessary permissions for Log Service to ship data to Kafka. After authorization, the Log Service shipping task can assume this role to ship Log Service data from account A to Kafka in account B.

tip

If account B is an IAM account, first grant TLSShipperKafkaAccess permission to account B.

Procedure

Create a role.

In the left navigation pane, click Role Management.

On the Role Management page, click Create Role.

Complete the following configurations in the Create Role panel.

Set Select Trusted Identity Type to Account, set Select Identity to Other Account, enter the account ID of Account A in Account ID, then click Next.

Set the role name, then click Next.

The role name must start with TLSCrossAccount, for example, TLSCrossAccountShipKafka.

Select the TLSShipperKafkaAccess permission for the role, then click Submit.

Modify the trust relationship for the role.

On the Role Management page, click the role created in the previous step.

On the Trust Relationship tab, click Edit Trust Policy.

Change the root in trn to role/ServiceRoleForTLS, then click Save.

Record the role TRN.

You need to enter the role TRN when creating a cross-account log shipping task. For detailed instructions, refer to log shipping logs to message queue Kafka version

Last updated: 2025.10.13 18:07:34

Public security network record in Beijing: No. 11010802032137