Custom policy reference for Document Mind

Resource Access Management (RAM) is an Alibaba Cloud service that manages user identities and resource access permissions. You can use RAM to avoid sharing your Alibaba Cloud account keys with other users. You can also grant least privilege to users as needed. In RAM, access policies describe the specific content of an authorization.

This topic describes the operations (Action), resources (Resource), and conditions (Condition) that Document Mind (docmind) defines for RAM access policies. The RAM code (RamCode) for Document Mind (docmind) is docmind. The supported authorization granularity is OPERATION.

General structure of an access policy

Access policies are in JSON format. The general structure is as follows:

{  "Version": "1",  "Statement": [    {      "Effect": "<Effect>",      "Action": "<Action>",      "Resource": "<Resource>",      "Condition": {        "<Condition_operator>": {          "<Condition_key>": [            "<Condition_value>"          ]        }      }    }  ]}

The following describes the fields:

• Effect: The effect of the policy. Valid values: Allow and Deny.

• Action: The specific operation for which permission is granted or denied. For more information, see Operations (Action).

• Resource: The specific object affected by the operation. You can use an Alibaba Cloud Resource Name (ARN) to describe a specific resource. For more information, see Resources (Resource)

• Condition: The conditions under which the authorization takes effect. This field is optional. For more information, see Conditions (Condition)

  • Condition_operator: The conditional operator. Different types of conditions correspond to different conditional operators. For more information, see Policy elements.

  • Condition_key: The condition key.

  • Condition_value: The value that corresponds to the condition key.

Operations (Action)

The following table lists the operations defined by Document Mind (docmind). You can use these operations in the Action element of a RAM policy statement to grant permissions for the operation. The columns in the table are described as follows:

• Operation: A specific permission.

• API: The API operation that corresponds to the operation.

• Access level: The access level of each operation. Valid values are Write, Read, and List.

• Resource type: The resource type for which the operation supports authorization. Note the following:

  • Required resource types are highlighted.

  • For operations that do not support resource-level authorization, this column shows All resources.

• Condition key: A condition key defined by the cloud service. This column does not include common condition keys that apply to all operations.

• Associated operations: Other permissions required to successfully perform the operation. The user or role must also have permissions for the associated operations for the primary operation to succeed.

• Operation	API	Access level	Resource type	Condition key	Associated operations
  docmind:SubmitDocStructureJob	SubmitDocStructureJob	Write	All resources *	None	None
  docmind:SubmitTableUnderstandingJob	SubmitTableUnderstandingJob	Write	All resources *	None	None
  docmind:SubmitDocumentExtractJob	SubmitDocumentExtractJob	Write	All resources *	None	None
  docmind:SubmitConvertPdfToWordJob	SubmitConvertPdfToWordJob	Write	All resources *	None	None
  docmind:SubmitConvertImageToWordJob	SubmitConvertImageToWordJob	Write	All resources *	None	None
  docmind:SubmitConvertPdfToExcelJob	SubmitConvertPdfToExcelJob	Write	All resources *	None	None
  docmind:SubmitConvertImageToExcelJob	SubmitConvertImageToExcelJob	Write	All resources *	None	None
  docmind:SubmitConvertPdfToImageJob	SubmitConvertPdfToImageJob	Write	All resources *	None	None
  docmind:SubmitConvertImageToPdfJob	SubmitConvertImageToPdfJob	Write	All resources *	None	None
  docmind:SubmitConvertPdfToMarkdownJob	SubmitConvertPdfToMarkdownJob	Write	All resources *	None	None
  docmind:SubmitConvertImageToMarkdownJob	SubmitConvertImageToMarkdownJob	Write	All resources *	None	None

  Resources (Resource)

  Document Mind (docmind) does not support specifying resource ARNs in the Resource element of a RAM policy statement. To grant access to Document Mind (docmind), specify "Resource": "*" in the policy statement.

  Conditions (Condition)

  Document Mind (docmind) does not define service-level condition keys. For information about the common condition keys that apply to all cloud services, see Common condition keys.

  Related operations

  You can create a custom policy and grant it to a RAM user, RAM user group, or RAM role. For more information, see the following topics:

  • Create a custom policy

  • Grant permissions to a RAM user

  • Grant permissions to a RAM user group

  • Grant permissions to a RAM role