This applies to scenarios where Cloud Log Service (CLS) is shared by multiple users and teams. In these scenarios, different users frequently need to log in to the Tencent Cloud console to search and analyze logs, which leads to the following issues:
High account management cost: To enable console access over the public network, Ops personnel must repeatedly create Tencent Cloud accounts for requesters, and are responsible for promptly identifying and deactivating accounts of departed employees.
Deep feature access path: When developers view logs or Ops personnel check dashboards, they face repeated login verifications. Each time, they must start from the cloud products menu and navigate through several pages to access CLS. Users expect instant access without frequent logins and redirections.
To address the above issues, CLS has launched the independent DataSight console, which offers the following features:
Lowered account management cost:
Users can access CLS without a Tencent Cloud account.
Access over the private network is supported for higher security. Access is automatically revoked for departed employees.
Users can be granted different access permissions to CLS based on their roles.
Permission misconfiguration only affects CLS and will not impact other cloud products, thereby reducing permission security control risks.
Streamlined feature access path:
Multiple methods are supported for accessing CLS, such as account/password login, login-free access, and single sign-on (SSO).
Specific pages can be quickly opened, shared, or embedded via access addresses.
Users can access CLS without a Tencent Cloud account.
Reduced Permission Security Control Risk
Users can be granted different access permissions to CLS based on their roles.
Permission misconfiguration only affects CLS and will not impact other cloud products.
Access over the private network is supported.
Streamlined Feature Access Path
Multiple methods are supported for accessing CLS, such as account/password login, anonymous login, and third-party authentication login.
Specific pages can be quickly opened or shared via access addresses.
Operation Steps
Step 1: Create a DataSight Instance
1. Log in to the CLS console. On the Overview page, locate DataSight and click Enable now.
2. On the instance configuration page, select an Access mode. Two options are supported: public network and private network.
Access Mode
Description
Public network
This method allows access to DataSight from the Internet for log viewing and analysis. Only password authentication login is supported.
Intranet
Prerequisite: The user's office network must be interconnected with Tencent Cloud via a secure connection, such as a dedicated connection or a VPN tunnel.
This method allows access to DataSight from the Tencent Cloud private network for log viewing and analysis. Access from the Internet is not available, thus providing enhanced security. Multiple login methods are supported, including password authentication login and anonymous login.
Step 2: Create a Sub-User to Obtain SecretId and SecretKey
1. Log in to the CAM console. On the Users > User List page, click Create User.
2. Select Custom to enter the creation workflow, then select Accessible resources and message reception, and click Next.
3. Configure the sub-user's information, check the box for Programming access, and click Next.
4. Set user permissions. Select Add to group to obtain group permissions. The CLS read-only access permission policy QcloudCLSReadOnlyAccess is recommended. You can also create a custom policy based on your requirements. For the policy configuration, see CLS Access Policy Templates. After the configuration is complete, click Next.
5. Configure user tags, review role information, and complete the sub-user creation.
6. Click Show to reveal the key and copy the key information.
Step 3: Select a Login Method
Password Authentication Login
Anonymous Login
Third-Party Authentication Login
Enter the username, password, and the key corresponding to the user's permissions, and save the configuration. Multiple users can be added.
Configuration Item
Description
Username
Username for logging in to DataSight.
Password
Password for logging in to DataSight. The password must be 8–30 characters long, cannot start with a forward slash (/), and must include at least three of the following character types: lowercase letters (a–z), uppercase letters (A–Z), digits (0–9), or special characters ()!@#$%^&*|?><.
Restricts the source IP addresses allowed to access DataSight. Enter IP addresses or CIDR blocks, separated by commas.
Allowlist: Only IP addresses matching the allowlist can access DataSight.
Blocklist: IP addresses matching the blocklist will be denied access to DataSight.
Enter the SecretId and SecretKey, and save the configuration. Anonymous login is only supported for access over the private network and does not require authentication. It is recommended to use a key with read-only permissions to avoid security risks.
Restricts the source IP addresses allowed to access DataSight. Enter IP addresses or CIDR blocks, separated by commas.
Allowlist: Only IP addresses matching the allowlist can access DataSight.
Blocklist: IP addresses matching the blocklist will be denied access to DataSight.
DataSight supports access via a reverse proxy that handles identity authentication, enabling integration with third-party identity authentication systems such as LDAP and OAuth. Third-party authentication login is only supported for access over the private network. The configuration process is as follows:
1. Create a DataSight role.
Enter a role name and the key information that defines the role's permissions. This role will be mapped to a user role in your third-party identity authentication system.
3. Enter the private IP address of the reverse proxy.
Enter the Nginx private IP address or CIDR block. Multiple entries are supported and should be separated by commas.
Step 4: Log in to DataSight to View Logs
Password authentication login or anonymous login
On the Overview page of the cloud console, view the DataSight management list to obtain the access address. Open this address in a browser, log in to DataSight, and use CLS.
If password authentication is used for login, enter the username and password on the login page.
Third-party authentication login
In a browser, access the custom domain name configured in the Nginx configuration file. After successful authentication, you will be logged in to the DataSight console.
Step 5: Set Dashboard Subscription and Alarm Notification Links to Open the DataSight Console by Default (Optional)
1. Create a dashboard subscription and configure the dashboard link to Use the DataSight domain name. Once saved, the link included in the sent dashboard subscription will open DataSight by default.
2. Create an alarm notification channel group and configure the query data link to Use the DataSight domain name. Once saved, the link included in the sent alarm notification will open DataSight by default.
DataSight Use Cases
Case 1: Providing DataSight as an Independent Console to Third Parties
A company needs to grant multiple third-party partners access to its business logs for querying. The requirements are as follows:
Multiple third-party users exist, each requiring different levels of resource access.
Third-party users have no Tencent Cloud accounts and need independent account/password authentication.
Solution
Leverage DataSight's account/password login authentication capability. Create distinct roles (PartnerA and PartnerB), each associated with a sub-user key with specific permissions. This achieves resource isolation and permission control between roles.
Partners use the access link, username, and password provided by the administrator to log in to DataSight and fulfill their respective business needs.
Operation Steps
1. Create a DataSight instance. For details, see the steps for creating an instance.
3. Select password authentication login as the DataSight login method. Create two users named PartnerA and PartnerB, configure their passwords, and enter the corresponding SecretId and SecretKey. For details, see Password Authentication Login.
4. Save the configuration to obtain the DataSight access link. Users can then log in to DataSight via this link using their username and password to fulfill their respective business needs.
Case 2: Using DataSight as an Independent Console for Login-Free Access Within an Enterprise Private Network
The Ops personnel of a company are responsible for managing business logs and need to grant internal personnel access to specific business logs. The requirements are as follows:
Internal users do not need to log in with a Tencent Cloud account.
Ops personnel can specify which business logs and dashboard resources are accessible.
Select to access DataSight over the private network, use anonymous login, and configure a sub-user key with read-only permissions for specified resources to achieve anonymous access over the private network.
Users log in to DataSight over the private network via the access link provided by Ops personnel to fulfill their respective needs.
Operation Steps
1. Create a DataSight instance and select access over the private network. For details, see the steps for creating an instance.
3. Select anonymous login as the DataSight login method and enter the SecretId and SecretKey. For details, see Anonymous Login. Then, save the configuration.
4. (Optional) To customize the access domain name, configure an Nginx reverse proxy to use the company's internal domain name instead of the DataSight domain name.
5. Obtain the DataSight access link. Within the private network, users log in to DataSight directly via this link to fulfill their respective business needs.
Case 3: Embedding and Integrating DataSight Pages into an Enterprise's Internal Platform
The Ops team of a company has already configured DataSight, enabling developers to view application logs through DataSight. However, the company has developed its own unified Ops platform and wants to integrate DataSight into this platform with login based on the company's unified identity authentication system. The requirements are as follows:
DataSight pages must be embedded, with page elements such as navigation menus and operation buttons being hideable.
The company's self-built unified identity authentication system (LDAP service) must be used for user login and authentication.
User resource isolation must be automatically implemented based on business team attributes.
