Custom policies for file compression and decompression-Intelligent Media Management(IMM)-阿里云帮助中心

If system policies do not meet your requirements, create custom policies to enforce the principle of least privilege. These policies provide fine-grained permission control and enhance resource security. This topic describes use cases and provides examples of custom policies for file compression and decompression in Intelligent Media Management (IMM).

Custom service role permissions

When you create an Intelligent Media Management (IMM) project, you must specify a service role. This role grants IMM access to your resources in other cloud services, such as Object Storage Service (OSS).

Create a custom service role

To create a service role, see Create a service RAM role.
Create a custom policy. For more information, see Create a custom policy.
The service role requires the following permissions for file compression and decompression:
- The role requires read and write permissions on the Object Storage Service (OSS) bucket to access source files and save processed files. For file compression, the role also needs permission to list objects in the bucket.
- If you use Message Service (MNS) for task notifications, the role needs permission to publish messages.
- The policy must grant IMM permission to assume this role.
Grant permissions to the service role. For more information, see Manage permissions for a RAM role.

Custom service role policy example

Read and write to a specific OSS bucket

This policy allows the role to read from and write to the bucket named my-bucket. It also allows the role to publish messages to the topic named test-topic in the China (Shanghai) region.

Parameters

The OSS resource is specified in the format acs:oss:*:*:<BucketName>/*. Replace the placeholders with your actual values.

Parameter	Description
`BucketName`	The name of the OSS bucket. You can find the bucket name on the Buckets page in the OSS console.

The MNS resource is specified in the format acs:mns:<RegionId>:<UID>:/topics/<TopicName>/messages. Replace the placeholders with your actual values.

Parameter	Description
`RegionId`	The region ID. Examples: `cn-shanghai` and `cn-beijing`. You can find the region ID for each region in Endpoints.
`UID`	The account ID. You can find your account ID on the Overview page of the Account Center.
`TopicName`	The name of the MNS topic. You can find the topic name on the Topics page in the MNS console.

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "oss:GetObject",
                "oss:PutObject",
                "oss:ListObjects"
            ],
            "Resource": [
                "acs:oss:*:*:my-bucket",
                "acs:oss:*:*:my-bucket/*"
            ],
            "Effect": "Allow"
        },
        {
            "Action":"mns:PublishMessage",
            "Resource": "acs:mns:cn-shanghai:150910xxxxxxxxxx:/topics/test-topic/messages",
            "Effect": "Allow"
        },
        {
            "Action": "ram:PassRole",
            "Resource": "*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "acs:Service": "imm.aliyuncs.com"
                }
            }
        }
    ]
}

Custom RAM user permissions

Resource Access Management (RAM) provides a robust permission control mechanism. By creating RAM users with specific permissions, you can ensure that each user has only the access they need. This practice limits the potential impact of a compromised AccessKey.

Create a RAM user and grant permissions

Create a RAM user. For more information, see Create a RAM user.
Create a custom policy. For more information, see Create a custom policy.
A RAM user requires the following permissions for file compression and decompression:
- The user must have permission to call IMM API operations related to file compression and decompression.
- To query tasks, the user must have permission to call the ListTasks and GetTask API operations.
- To receive MNS messages, the user must have permission to receive and delete messages from an MNS queue.
Grant permissions to the RAM user. For more information, see Grant permissions to a RAM user.

Custom RAM user policy example

Call IMM APIs within a specific project

This RAM policy restricts a user to calling the following Intelligent Media Management APIs only in the image-process-project project in the China (Shanghai) region:

CreateFileCompressionTask, CreateFileUncompressionTask, CreateArchiveFileInspectionTask, ListTasks, and GetTask. Add API operations as needed.

Parameters

The IMM resource is specified in the format acs:imm:<RegionId>:<UID>:project/<ProjectName>. Replace the placeholders with your actual values.

Parameter	Description
`RegionId`	The region ID. Examples: `cn-shanghai` and `cn-beijing`. You can find the region ID for each region in Endpoints.
`UID`	The account ID. You can find your account ID on the Overview page of the Account Center.
`ProjectName`	The name of the IMM project. You specified this name when you created the project. You can find the project name in the IMM console.

The MNS resource is specified in the format acs:mns:<RegionId>:<UID>:/queues/<QueueName>/messages. Replace the placeholders with your actual values.

Parameter	Description
`RegionId`	The region ID. Examples: `cn-shanghai` and `cn-beijing`. You can find the region ID for each region in Endpoints.
`UID`	The account ID. You can find your account ID on the Overview page of the Account Center.
`QueueName`	The name of the MNS queue. You can find the queue name on the Queues page in the MNS console.

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "imm:CreateFileCompressionTask",
                "imm:CreateFileUncompressionTask",
                "imm:CreateArchiveFileInspectionTask",
                "imm:ListTasks",
                "imm:GetTask"
            ],
            "Resource": "acs:imm:cn-shanghai:150910xxxxxxxxxx:project/file-process-project",
            "Effect": "Allow"
        },
        {
            "Action": ["mns:ReceiveMessage", "mns:DeleteMessage"],
            "Resource": "acs:mns:cn-shanghai:150910xxxxxxxxxx:/queues/test-queue/messages",
            "Effect": "Allow"
        }
    ]
}