日誌交付許可

將日誌交付許可授予發起人角色 （呼叫 的 IAM 主體CreateReplicator)，而非服務執行角色。這些許可不涉及來源或目標叢集。您只需要啟用目的地的程式碼片段。

Amazon CloudWatch Logs 目的地

當 cloudWatchLogs.enabled 在 logDelivery 組態true中時，新增下列陳述式。

{
    "Sid": "CloudWatchLogsLogDeliveryActions",
    "Effect": "Allow",
    "Action": [
        "logs:CreateLogDelivery",
        "logs:PutResourcePolicy",
        "logs:DescribeResourcePolicies",
        "logs:DescribeLogGroups",
        "logs:ListLogDeliveries"
    ],
    "Resource": [
        "*"
    ]
}

Amazon S3 目的地

當 s3.enabled為 時，新增下列陳述式true。用您的目的地儲存貯體名稱取代 <logBucketName>。

[
    {
        "Sid": "S3LogDeliveryActions",
        "Effect": "Allow",
        "Action": [
            "logs:CreateLogDelivery",
            "logs:ListLogDeliveries"
        ],
        "Resource": [
            "*"
        ]
    },
    {
        "Sid": "S3BucketLogDeliveryActions",
        "Effect": "Allow",
        "Action": [
            "s3:GetBucketPolicy",
            "s3:PutBucketPolicy"
        ],
        "Resource": "arn:aws:s3:::<logBucketName>"
    }
]

Firehose 目的地

當 firehose.enabled為 時，新增下列陳述式true。<accountID> 以您的 AWS 帳戶 ID 取代 。

[
    {
        "Sid": "FirehoseLogDeliveryActions",
        "Effect": "Allow",
        "Action": [
            "logs:CreateLogDelivery",
            "logs:ListLogDeliveries",
            "firehose:TagDeliveryStream"
        ],
        "Resource": [
            "*"
        ]
    },
    {
        "Sid": "FirehoseLogDeliveryServiceLinkedRole",
        "Effect": "Allow",
        "Action": [
            "iam:CreateServiceLinkedRole"
        ],
        "Resource": "arn:aws:iam::<accountID>:role/aws-service-role/delivery.logs.amazonaws.com/AWSServiceRoleForLogDelivery"
    }
]

如需 vended-logs 許可的詳細資訊，請參閱啟用來自 AWS 服務的日誌記錄。