Docs

Torch Log Service

Use other systems to analyze logs

Embed externally built systems into TLS console

TLS provides a console embedding feature, which supports embedding the query and analysis page and dashboard page into the self-built web pages of external systems. You can log in to some pages of the TLS console without password in the external system and perform related actions. This article describes the steps to embed the TLS console into an external system.

Background information

The console's embedding feature leverages Security Token Service (STS) to enable custom identity proxy for users. You can grant IAM users access to specific data and pages, use this identity to create temporary credentials via STS, and obtain a temporary login token. When you access embedded TLS console pages, authentication is performed via the temporary login token encapsulated in the URL. No IAM user account and password are required during the access process, and the login is seamless.

Steps

1 Obtain a temporary security token

When logging in to a self-built external system, you need to access Volcengine STS from the external system's server to get a temporary security token issued by STS. When accessing STS, you need to create an IAM role and grant log service resource access permissions for the IAM role. You also need to create an IAM user to assume the specified IAM role and send an AssumeRole request as the IAM user to obtain a temporary security token. This temporary security token can be used to access TLS resources within the IAM role's permission scope. For more details, see Access logging services through STS.

The process for creating an IAM role, granting permissions, and obtaining a temporary security token is as follows. For details, see Access logging services through STS.

Create an IAM role.

Grant TLS permissions to the IAM role.

On the embedded TLS console page, you can grant the IAM role the system default permission TLSReadOnlyAccess, which allows the role to view all TLS resources and pages. You can also create custom authorization policies based on the list of TLS operations and resources that can be authorized. For details, see Authorizable operation and delegated resources.

Create an IAM user.

Grant the IAM user permissions to assume an IAM role and call AssumeRole.

Set a trust policy for the IAM role to allow the specified IAM user to assume this role.

Grant the IAM user STSAssumeRoleAccess permission.

Call the AssumeRole API to obtain temporary security credentials.

Notice

The DurationSeconds request parameter in the AssumeRole API specifies the validity period of the temporary security token. After it expires, you need to call the API again to obtain a new temporary security token, which is required to request a login Token.

2 Obtain login Token

The login Token (SigninToken) is a temporary access Token provided by the STS service. External system servers must use the login Token to generate password-free access links for TLS.

Call the STS API getSigninTokenWithSTS to obtain the login Token. In the request, temporary AK, SK, and sessionToken are required to specify, all of which are temporary security tokens obtained from 1 Obtain a temporary security token Create a sub-user.

Notice

The login Token is valid for 15 minutes by default and can not be changed. Make sure to build and authenticate the access link before the Token expires. After expiration, you must request a new login Token from getSigninTokenWithSTS.

After completing a login with the login Token, it becomes invalid. If you refresh the page, you will need to request a new login Token.

Example:

3 Generate password-free access link

The password-free access link format for TLS console is as follows.

Parameters in the link are described in the following table.

Parameters	Description
signinToken	The login token obtained in Step 2.
redirectURI	Supports access links for embedded TLS pages. Currently, the query and analysis page and dashboard page support embedded TLS. Notice Before using the following redirectURI link, encode the link with encodeURL first. That is to say, you need to replace ${regionId}, ${projectId}, and ${dashboardId} in the link with actual values, and then encode the URL using encodeURL. TLS supports integrating with custom third-party web pages through various UI parameters for display. For details, see Set Console Embedded Parameters. Query and analysis page https://console.volc-embed.com/tls/region:tls+${regionId}/project/${projectId}/search? Dashboard page https://console.volc-embed.com/tls/region:tls+${regionId}/project/${projectId}/dashboard/${dashboardId}

4 Embed pages in external systems

Embed TLS console into third-party custom web pages using iFrame. You can refer to the following examples to embed the TLS console page into external systems. The src value should be set to the password-free access link generated in step 3.p

Notice

To avoid access issues caused by browser compatibility, we recommend using Chrome to visit this page.

FAQs

How to set the login session duration for embedded pages

After logging into log service console page via a third-party system's web page without a password, the login status will be maintained for a period of time. After expiration, the application server needs to reacquire and refresh the Token so that the user can log in again.

The login duration of the embedded page is specified by the sessionDuration parameter in the getSigninTokenWithSTS API. When calling the getSigninTokenWithSTS API, set the login duration for the embedded page using the sessionDuration request parameter. The sessionDuration is measured in seconds and can be set from 900 to 43,200.

The login session duration for embedded pages (sessionDuration) follows the DurationSeconds parameter of the AssumeRole API by default, which is set to 1 hour. By default, the ExpiredTime returned by the AssumeRole API is both the expiration time of the temporary security token and the end time of the login session.

Code examples

Node.js

Python

Last updated: 2026.03.12 18:50:42