DocsICP FilingConsole
官方文档
首页

Configure user permissions

更新时间：
复制 MD 格式
产品详情
我的收藏

Alibaba Cloud provides permission management mechanisms, including Resource Access Management (RAM) and temporary security tokens. You can use RAM users with different permissions to access the Intelligent Media Management (IMM) service. The service also supports temporary access authorization for users. Using RAM and Security Token Service (STS) significantly improves management flexibility and data security.

Important

This document is no longer maintained. Use the new version of Intelligent Media Management.

Background information

RAM and STS solve a core problem: how to securely grant access to other users without exposing the AccessKey of your Alibaba Cloud account. Exposing the AccessKey of your Alibaba Cloud account creates a major security risk. Anyone who has the key can manage all your resources and steal important data.

  • Resource Access Management (RAM) is an Alibaba Cloud service that manages user identities and resource access permissions. RAM lets you create and manage multiple identities under a single Alibaba Cloud account. You can assign different permissions to an identity or a group of identities to control resource access. For more information, see What is RAM?.

  • Alibaba Cloud Security Token Service (STS) is a service for managing temporary access permissions. With STS, an authorized entity, such as a RAM user or RAM role, can obtain a temporary access token. This token is valid for a custom period and grants specific access permissions. For more information, see What is STS?.

RAM provides a long-term access control mechanism. You can create RAM users and assign different permissions to them. If a RAM user's AccessKey is exposed, the security risk is contained and does not lead to a global data breach. However, because RAM users are typically used for long-term access, you must still protect their AccessKeys.

In contrast to the long-term control provided by RAM, STS provides temporary access authorization. With STS, you can obtain a temporary AccessKey and security token. You can provide these credentials to temporary users to grant them access to Intelligent Media Management. STS permissions are typically more restricted and have a shorter validity period. Therefore, if these credentials are exposed, the security impact is minimal.

Configure RAM user permissions

For improved data security and access control, we recommend that you use RAM users to access Intelligent Media Management.

  1. Create a RAM user. For more information, see Create a RAM user.

  2. Grant permissions to the RAM user. For more information, see Manage permissions for a RAM user.

    • To perform management operations in Intelligent Media Management, such as creating projects, grant the AliyunIMMFullAccess permission to the RAM user.

    • For read-only access to Intelligent Media Management, such as viewing projects, grant the AliyunIMMReadOnlyAccess permission to the RAM user.

    Note

    For more fine-grained access control, you can create custom policies. For more information, see Access control based on RAM policies.

  3. Configure multi-factor authentication (MFA) for the RAM user. For more information, see Bind an MFA device to a RAM user.

Configure temporary user permissions

  1. Create a RAM role and grant permissions.

    1. Create a RAM role for a trusted Alibaba Cloud account. For more information, see Create a RAM role for a trusted Alibaba Cloud account.

    2. Create a custom policy. For more information, see Create a custom policy.

      Note

      For more fine-grained access control, you can create a custom policy. For more information, see Access control based on RAM policies.

    3. Grant permissions to the RAM role. For more information, see Manage permissions for a RAM role.

  2. Grant temporary access.

    1. Create a custom policy. For more information, see Create a custom policy.

      Note

      For more fine-grained access control, you can create a custom policy. For more information, see Access control based on RAM policies.

    2. Grant the RAM user permissions to assume the role. For more information, see Manage permissions for a RAM user.

  3. Obtain temporary access credentials from STS. For more information, see AssumeRole - Obtain temporary identity credentials for a role.

  4. Use the temporary credentials to read and write data.

    You can use the temporary credentials to call the software development kits (SDKs) for different languages to access Intelligent Media Management. For example, when you use the Java SDK, you can create an IAcsClient object as shown in the following code. Pass the AccessKeyId, AccessKeySecret, and SecurityToken that you obtained from STS as parameters.

    DefaultProfile profile = DefaultProfile.getProfile("cn-shanghai", stsAccessKeyId, stsAccessKeySecret, stsToken);
IAcsClient client = new DefaultAcsClient(profile);
Previous：Authorization managementNext：Access control based on RAM policies