Before using TLS as an IAM user, you must first use your Volcano Engine account to grant the required permissions. TLS supports custom permission policies. This topic provides examples of custom access policies for various common scenarios in TLS.

Feature modules	Access policy examples
Basic resources	View project information Star TLS resources Manage projects and topics
Data collection	Access key configuration for collection Collect Trace data Manage collection configurations and host groups
Query and analysis	Query and analyze logs All permissions for query module TLS Agent
Dashboard	Manage dashboard
Alert	Manage alarm policies and notification groups
Data processing	Manage data transformation tasks
Data consumption and shipping	Has TOS shipping management permission for all log topics
Data import	Data import
Log application	Access log application tasks

Basic resources

View project information

With the following permission policy, IAM users can view all project information under the current account.

Star TLS resources

With the following permission policy, IAM users can mark the specified TLS resources as favorites.

Manage projects and topics

With the following permission policy, IAM users can manage all projects and topics under the current account, including creating, querying, deleting, and updating topics and projects.

Data collection

Access key configuration for collection

LogCollector requires access keys with at least the following permissions for collection configuration.

Collect Trace data

After receiving the following permission policies, IAM users can manage Trace instances, write collected Trace data to the corresponding log topic, and query and analyze Trace data via API.

Manage collection configurations and host groups

After receiving the following permission policies, IAM users can manage collection configurations and host groups, including the followings: querying the project list and topic list; creating, deleting, modifying, and querying collection configurations or host groups; and binding or unbinding collection configurations to host groups.

Query and analysis

Query and analyze logs

After receiving the following permission policies, IAM users can query log data via OpenAPI or the console. In this example, the specified IAM user can only query and analyze the c425****83d7 project in the Beijing region and the 6b30****4888 log topic.

All permissions for query module

After being granted the following permission policies, IAM users can manage index, query logs, download logs, and other query-related permissions.

TLS Agent

After being granted the following permission policies, IAM users can use TLS Agent feature.

Dashboard

Manage dashboard

After being granted the following permission policies, IAM users can manage all dashboards under the current account, including creating, deleting, modifying, and querying dashboards.

Alert

Manage alarm policies and notification groups

After being granted the following permission policies, IAM users can manage all alarm policies and notification groups under the current account, including querying projects and log topics, as well as creating, deleting, modifying, and querying alarm policies and notification groups.

Data processing

Manage data transformation tasks

After being granted the following permission policies, IAM users can manage all data transformation tasks under the current account, including querying projects and log topics, and creating, deleting, modifying, and querying data transformation tasks.

Data consumption and shipping

Has TOS shipping management permission for all log topics

After being granted the following permission policies, IAM users can operate TOS shipping features, including querying projects and log topics, and creating, modifying, querying, deleting, and retrying shipping tasks.

Data import

After being granted the following permission policies, IAM users can manage all data import tasks under the current account, including querying projects and log topics, as well as creating, deleting, modifying, and querying data import tasks.

Log application

Access log application tasks

After being granted the following permission policies, IAM users can manage all log application tasks under the current account, including creating, deleting, modifying, and querying log application tasks. Data pivot tasks can also be created and managed for CloudLens for TOS.

Torch Log Service