本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。

日志传送权限

向调用者角色（调用的 IAM 委托人CreateReplicator）而不是服务执行角色授予日志传输权限。这些权限不涉及源集群或目标集群。您只需要启用的目的地的片段。

Amazon CloudWatch Logs 目标

在logDelivery配置true中时cloudWatchLogs.enabled，添加以下语句。

{
    "Sid": "CloudWatchLogsLogDeliveryActions",
    "Effect": "Allow",
    "Action": [
        "logs:CreateLogDelivery",
        "logs:PutResourcePolicy",
        "logs:DescribeResourcePolicies",
        "logs:DescribeLogGroups",
        "logs:ListLogDeliveries"
    ],
    "Resource": [
        "*"
    ]
}

亚马逊 S3 目的地

在 i s3.enabled s 时添加以下语句true。将 <logBucketName> 替换为目标存储桶名称。

[
    {
        "Sid": "S3LogDeliveryActions",
        "Effect": "Allow",
        "Action": [
            "logs:CreateLogDelivery",
            "logs:ListLogDeliveries"
        ],
        "Resource": [
            "*"
        ]
    },
    {
        "Sid": "S3BucketLogDeliveryActions",
        "Effect": "Allow",
        "Action": [
            "s3:GetBucketPolicy",
            "s3:PutBucketPolicy"
        ],
        "Resource": "arn:aws:s3:::<logBucketName>"
    }
]

Firehose 目的地

在 i firehose.enabled s 时添加以下语句true。<accountID>用您的 AWS 账户 身份证替换。

[
    {
        "Sid": "FirehoseLogDeliveryActions",
        "Effect": "Allow",
        "Action": [
            "logs:CreateLogDelivery",
            "logs:ListLogDeliveries",
            "firehose:TagDeliveryStream"
        ],
        "Resource": [
            "*"
        ]
    },
    {
        "Sid": "FirehoseLogDeliveryServiceLinkedRole",
        "Effect": "Allow",
        "Action": [
            "iam:CreateServiceLinkedRole"
        ],
        "Resource": "arn:aws:iam::<accountID>:role/aws-service-role/delivery.logs.amazonaws.com/AWSServiceRoleForLogDelivery"
    }
]

有关 vended-logs 权限的更多信息，请参阅启用来自 AWS 服务的日志记录。