tencent cloud

To enable CLS to ship logs to Cloud Object Storage (COS) or CKafka, you need to grant CLS the COS or CKafka write permission. That is, you need to grant the QcloudCOSAccessForCLSRole or QcloudCKAFKAAccessForCLSRole policy permission to the unique service role CLS_QcsRole of CLS.

This document describes how to grant collaborators or sub-accounts the permission to configure shipping tasks.

Granting Permissions in the Console

To enable collaborators or sub-accounts to configure a shipping task in the CLS console, you need to use the root account to grant them the necessary permissions as shown below:

Authorization by root account

1. Log in to the CAM console with the root account and choose Users > User List on the left sidebar.

2. On the User List page, click the target username to go to the user details page.

3. On the user details page, select Associate Policy.

4. In the User Permissions step on the Add Policy page, click Select policies from the policy list.

5. Select the preset policies, including QcloudCLSFullAccess, QcloudCamSubaccountsAuthorizeRoleFullAccess, QcloudCOSReadOnlyAccess, or QcloudCkafkaReadOnlyAccess, for the collaborator or sub-account.

   Note

   The root account must complete the authorization process. Otherwise, the collaborator or sub-account cannot configure shipping tasks properly.

6. Click Next.

7. Confirm the configuration in the Review step and click OK.