RAM authorization-Intelligent Media Management(IMM)-阿里云帮助中心

Resource Access Management (RAM) is a service provided by Alibaba Cloud to manage user identities and resource access permissions. Using RAM helps you avoid sharing your Alibaba Cloud account keys with other users and allows you to grant users the least privilege access. RAM uses permission policies to define authorizations. This topic describes the general structure of a RAM policy, and the policy statement elements (Action, Resource, and Condition) defined by Intelligent Media Management for RAM permission policies. The RAM code (RamCode) for Intelligent Media Management is imm , and the supported authorization granularity is RESOURCE .

General structure of a policy

Permission policies support JSON format with the following general structure:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

The following list describes the fields in the policy:

Version: Specifies the policy version number. It is fixed at 1.
Statement:
- Effect: Specifies the authorization result. Valid values: Allow and Deny.
- Action: Specifies one or more operations that are allowed or denied.
- Resource: Specifies the specific objects affected by the operations. You can use Alibaba Cloud Resource Names (ARNs) to describe specific resources.
- Condition: Specifies the conditions for the authorization to take effect. This field is optional.
  - Condition operator: Specifies the conditional operators. Different types of conditions support different conditional operators.
  - Condition_key: Specifies the condition keys.
  - Condition_value: Specifies the condition values.

Action

The following table lists the actions defined by Intelligent Media Management. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that support authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding ARN in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys that are applicable across all RAM-integrated services. For more information, see Common condition keys.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action	API	Access level	Resource type	Condition key	Dependent action
imm:UpdateTrigger	UpdateTrigger	update	Trigger `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/trigger/`	None	None
imm:QuerySimilarImageClusters	QuerySimilarImageClusters	list	*Dataset `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/dataset/{#DatasetName}`	None	None
imm:GetBinding	GetBinding	get	*Dataset `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/dataset/{#DatasetName}`	None	None
imm:DeleteDataset	DeleteDataset	delete	*Dataset `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/dataset/{#DatasetName}`	None	None
imm:ListBindings	ListBindings	list	*Dataset `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/dataset/{#DatasetName}`	None	None
imm:CreateImageModerationTask	CreateImageModerationTask	create	*Project `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}`	None	None
imm:CreateBinding	CreateBinding	create	*Dataset `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/dataset/{#DatasetName}`	None	None
imm:GetOSSBucketAttachment	GetOSSBucketAttachment	get	All Resource ``	None	None
imm:CreateArchiveFileInspectionTask	CreateArchiveFileInspectionTask	create	*Project `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}`	None	None
imm:ContextualRetrieval	ContextualRetrieval	none	All Resource ``	None	None
imm:GetStory	GetStory	get	*Dataset `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/dataset/{#DatasetName}`	None	None
imm:CreateBatch	CreateBatch	create	Batch `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/batch/`	None	None
imm:DetectImageLabels	DetectImageLabels	none	*Project `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}`	None	None
imm:ExtractDocumentText	ExtractDocumentText	none	*Project `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}`	None	None
imm:GetTask	GetTask	get	*Project `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}`	None	None
imm:ListDatasets	ListDatasets	list	Dataset `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/dataset/`	None	None
imm:DetectImageCropping	DetectImageCropping	none	*Project `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}`	None	None
imm:SemanticQuery	SemanticQuery	list	*Dataset `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/dataset/{#DatasetName}`	None	None
imm:DeleteBinding	DeleteBinding	delete	*Dataset `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/dataset/{#DatasetName}`	None	None
imm:ListBatches	ListBatches	list	Batch `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/batch/`	None	None
imm:EncodeBlindWatermark	EncodeBlindWatermark	none	*Project `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}`	None	None
imm:DeleteStory	DeleteStory	delete	*Dataset `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/dataset/{#DatasetName}`	None	None
imm:IndexFileMeta	IndexFileMeta	create	*Dataset `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/dataset/{#DatasetName}`	None	None
imm:DeleteFileMeta	DeleteFileMeta	delete	*Dataset `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/dataset/{#DatasetName}`	None	None
imm:FuzzyQuery	FuzzyQuery	list	*Dataset `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/dataset/{#DatasetName}`	None	None
imm:DeleteBatch	DeleteBatch	delete	Batch `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/batch/`	None	None
imm:CreateImageSplicingTask	CreateImageSplicingTask	create	*Project `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}`	None	None
imm:UpdateFigureCluster	UpdateFigureCluster	update	*Dataset `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/dataset/{#DatasetName}`	None	None
imm:QueryFigureClusters	QueryFigureClusters	list	*Dataset `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/dataset/{#DatasetName}`	None	None
imm:GetBatch	GetBatch	get	Batch `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/batch/`	None	None
imm:DeleteTrigger	DeleteTrigger	delete	Trigger `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/trigger/`	None	None
imm:ContextualAnswer	ContextualAnswer	none	All Resource ``	None	None
imm:BatchGetFigureCluster	BatchGetFigureCluster	get	*Dataset `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/dataset/{#DatasetName}`	None	None
imm:DetectImageScore	DetectImageScore	none	*Project `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}`	None	None
imm:SuspendTrigger	SuspendTrigger	update	Trigger `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/trigger/`	None	None
imm:QueryStories	QueryStories	list	*Dataset `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/dataset/{#DatasetName}`	None	None
imm:BatchGetFileMeta	BatchGetFileMeta	get	*Dataset `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/dataset/{#DatasetName}`	None	None
imm:DetachOSSBucket	DetachOSSBucket	delete	All Resource ``	None	None
imm:GenerateVideoPlaylist	GenerateVideoPlaylist	none	*Project `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}`	None	None
imm:SuspendBatch	SuspendBatch	update	Batch `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/batch/`	None	None
imm:DetectImageTexts	DetectImageTexts	none	*Project `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}`	None	None
imm:GetDecodeBlindWatermarkResult	GetDecodeBlindWatermarkResult	none	All Resource ``	None	None
imm:ListProjects	ListProjects	list	Project `acs:imm:{#regionId}:{#accountId}:project/`	None	None
imm:CreateFileUncompressionTask	CreateFileUncompressionTask	create	*Project `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}`	None	None
imm:SearchImageFigureCluster	SearchImageFigureCluster	list	*Dataset `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/dataset/{#DatasetName}`	None	None
imm:CompareImageFaces	CompareImageFaces	none	*Project `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}`	None	None
imm:ResumeBatch	ResumeBatch	update	Batch `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/batch/`	None	None
imm:DetectImageCodes	DetectImageCodes	none	*Project `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}`	None	None
imm:CreateDataset	CreateDataset	create	*Dataset `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/dataset/{#DatasetName}`	None	None
imm:GetImageModerationResult	GetImageModerationResult	get	*Project `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}`	None	None
imm:DetectMediaMeta	DetectMediaMeta	none	*Project `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}`	None	None
imm:GetFileMeta	GetFileMeta	get	*Dataset `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/dataset/{#DatasetName}`	None	None
imm:AddStoryFiles	AddStoryFiles	create	*Dataset `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/dataset/{#DatasetName}`	None	None
imm:CreateImageToPDFTask	CreateImageToPDFTask	create	*Project `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}`	None	None
imm:GetFigureCluster	GetFigureCluster	get	*Dataset `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/dataset/{#DatasetName}`	None	None
imm:BatchUpdateFileMeta	BatchUpdateFileMeta	update	*Dataset `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/dataset/{#DatasetName}`	None	None
imm:UpdateBatch	UpdateBatch	update	Batch `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/batch/`	None	None
imm:QueryLocationDateClusters	QueryLocationDateClusters	list	*Dataset `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/dataset/{#DatasetName}`	None	None
imm:AddImageMosaic	AddImageMosaic	none	*Project `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}`	None	None
imm:CreateFacesSearchingTask	CreateFacesSearchingTask	list	*Dataset `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/dataset/{#DatasetName}`	None	None
imm:CreateDecodeBlindWatermarkTask	CreateDecodeBlindWatermarkTask	create	*Project `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}`	None	None
imm:DeleteLocationDateCluster	DeleteLocationDateCluster	delete	*Dataset `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/dataset/{#DatasetName}`	None	None
imm:GetProject	GetProject	get	*Project `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}`	None	None
imm:CreateOfficeConversionTask	CreateOfficeConversionTask	create	*Project `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}`	None	None
imm:CreateMediaConvertTask	CreateMediaConvertTask	create	*Project `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}`	None	None
imm:SimpleQuery	SimpleQuery	list	*Dataset `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/dataset/{#DatasetName}`	None	None
imm:DetectTextAnomaly	DetectTextAnomaly	none	*Project `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}`	None	None
imm:CreateCompressPointCloudTask	CreateCompressPointCloudTask	create	*Project `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}`	None	None
imm:CreateCustomizedStory	CreateCustomizedStory	create	*Dataset `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/dataset/{#DatasetName}`	None	None
imm:ResumeTrigger	ResumeTrigger	update	Trigger `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/trigger/`	None	None
imm:RemoveStoryFiles	RemoveStoryFiles	update	*Dataset `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/dataset/{#DatasetName}`	None	None
imm:DetectImageBodies	DetectImageBodies	none	*Project `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}`	None	None
imm:UpdateProject	UpdateProject	update	*Project `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}`	None	None
imm:GetVideoModerationResult	GetVideoModerationResult	get	*Project `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}`	None	None
imm:CreateVideoModerationTask	CreateVideoModerationTask	create	*Project `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}`	None	None
imm:CreateHighlightTask	CreateHighlightTask	create	*Project `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}`	None	None
imm:ListTasks	ListTasks	list	*Project `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}`	None	None
imm:DetectImageCars	DetectImageCars	none	*Project `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}`	None	None
imm:BatchIndexFileMeta	BatchIndexFileMeta	create	*Dataset `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/dataset/{#DatasetName}`	None	None
imm:DeleteProject	DeleteProject	delete	*Project `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}`	None	None
imm:CreateTrigger	CreateTrigger	create	Trigger `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/trigger/`	None	None
imm:UpdateStory	UpdateStory	update	*Dataset `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/dataset/{#DatasetName}`	None	None
imm:GetVideoLabelClassificationResult	GetVideoLabelClassificationResult	get	*Project `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}`	None	None
imm:BatchDeleteFileMeta	BatchDeleteFileMeta	delete	*Dataset `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/dataset/{#DatasetName}`	None	None
imm:UpdateDataset	UpdateDataset	update	*Dataset `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/dataset/{#DatasetName}`	None	None
imm:GetDataset	GetDataset	get	*Dataset `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/dataset/{#DatasetName}`	None	None
imm:CreateProject	CreateProject	create	*Project `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}`	None	None
imm:CreateSimilarImageClusteringTask	CreateSimilarImageClusteringTask	create	*Dataset `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/dataset/{#DatasetName}`	None	None
imm:GetTrigger	GetTrigger	get	Trigger `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/trigger/`	None	None
imm:AttachOSSBucket	AttachOSSBucket	create	*Project `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}`	None	None
imm:CreateFileCompressionTask	CreateFileCompressionTask	create	*Project `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}`	None	None
imm:UpdateFileMeta	UpdateFileMeta	update	*Dataset `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/dataset/{#DatasetName}`	None	None
imm:CreateLocationDateClusteringTask	CreateLocationDateClusteringTask	create	*Dataset `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/dataset/{#DatasetName}`	None	None
imm:ListAttachedOSSBuckets	ListAttachedOSSBuckets	list	*Project `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}`	None	None
imm:CreateFigureClusteringTask	CreateFigureClusteringTask	create	*Dataset `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/dataset/{#DatasetName}`	None	None
imm:CreateVideoLabelClassificationTask	CreateVideoLabelClassificationTask	create	*Project `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}`	None	None
imm:RefreshWebofficeToken	RefreshWebofficeToken	none	*Project `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}`	None	None
imm:CreateFigureClustersMergingTask	CreateFigureClustersMergingTask	create	*Dataset `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/dataset/{#DatasetName}`	None	None
imm:GenerateWebofficeToken	GenerateWebofficeToken	none	*Project `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}`	None	None
imm:ListTriggers	ListTriggers	list	Trigger `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/trigger/`	None	None
imm:CreateStory	CreateStory	create	*Dataset `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/dataset/{#DatasetName}`	None	None
imm:UpdateLocationDateCluster	UpdateLocationDateCluster	update	*Dataset `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/dataset/{#DatasetName}`	None	None
imm:DetectImageFaces	DetectImageFaces	none	*Project `acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}`	None	None

Resource

The following table lists the resources defined by Intelligent Media Management. Specify them in the Resource element of RAM policy statements to grant permissions for specific operations. They are uniquely identified by ARNs. Format: acs:{#ramcode}:{#regionId}:{#accountId}:{#resourceType}:

acs: The initialism of Alibaba Cloud service, which indicates the public cloud of Alibaba Cloud.
{#ramcode}: The code used in RAM to indicate an Alibaba Cloud service.
{#regionId}: The region ID. If the resource covers all regions, set it to an asterisk (*).
{#accountId}: The ID of the Alibaba Cloud account. If the resource covers all Alibaba Cloud accounts, set it to an asterisk (*).
{#resourceType}: The service-defined resource identifier. It supports a hierarchical structure, which is similar to a file path. If the statement covers global resources, set it to an asterisk (*).

Resource type	ARN
Trigger	acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/trigger/*
Dataset	acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/dataset/{#DatasetName} acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/dataset/*
Project	acs:imm:{#regionId}:{#accountId}:project/{#ProjectName} acs:imm:{#regionId}:{#accountId}:project/*
Batch	acs:imm:{#regionId}:{#accountId}:project/{#ProjectName}/batch/*

Condition

Intelligent Media Management does not define product-level condition keys. However, you can use Alibaba Cloud common condition keys for access control. For more information, see Common condition keys.

How to create custom RAM policies?

You can create custom policies and grant them to RAM users, RAM user groups, or RAM roles. For instructions, see: