Configure custom permissions for document conversion-Intelligent Media Management(IMM)-阿里云帮助中心

If system policies do not meet your requirements, you can create a custom policy to implement the principle of least privilege. Custom policies enable fine-grained permission management and improve the security of your cloud resources. This topic describes use cases and provides examples of custom policies for document conversion in Intelligent Media Management (IMM).

Customize permissions for a project service role

When you create an IMM project, you must assign a service role to the project. This ensures that the IMM service can assume the role to access authorized resources in other Alibaba Cloud services, such as Object Storage Service (OSS).

Create a custom service role

Create a service role. For more information, see Create a RAM role for a trusted entity.
Create a custom policy. For more information, see Create a custom policy.

A service role requires the following permissions for document conversion:
- Permission to read source files from an OSS bucket and write the converted files back to it.
- Permission to send messages to Simple Message Queue (SMQ) if you use SMQ for task notifications.
- Permission to pass the role to the IMM service, which allows the service to access other authorized cloud resources.
Grant permissions to the service role. For more information, see Manage permissions for a RAM role.

Custom service role policy example

Read and write to a specific OSS bucket

The following RAM policy grants permissions to read from and write to the bucket named my-bucket and to publish messages to the SMQ topic named test-topic in the China (Shanghai) region.

Parameters

The resource format for OSS is acs:oss:*:*:<BucketName>/*. Replace the placeholders with your actual values as described in the table below.

Parameter	Description
`BucketName`	The name of the OSS bucket. You can find the name on the Buckets page of the OSS console.

The resource format for Simple Message Queue (SMQ) is acs:mns:<RegionId>:<UID>:/topics/<TopicName>/messages. Replace the placeholders with your actual values as described in the table below.

Parameter	Description
`RegionId`	The region ID, such as `cn-shanghai` or `cn-beijing`. You can find the region ID on the Endpoints page.
`UID`	The account ID. You can find the ID on the Overview page in Account Center.
`TopicName`	The name of the SMQ topic. You can find the name on the Topics page of the SMQ console.

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "oss:GetObject",
                "oss:PutObject"
            ],
            "Resource": "acs:oss:*:*:my-bucket/*",
            "Effect": "Allow"
        },
        {
            "Action":"mns:PublishMessage",
            "Resource": "acs:mns:cn-shanghai:150910xxxxxxxxxx:/topics/test-topic/messages",
            "Effect": "Allow"
        },
        {
            "Action": "ram:PassRole",
            "Resource": "*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "acs:Service": "imm.aliyuncs.com"
                }
            }
        }
    ]
}

Customize RAM user permissions for IMM

RAM lets you assign specific permissions to different RAM users. This ensures that if a RAM user's AccessKey is compromised, the resulting security risk is confined to that user's permissions, preventing a wider information leak.

Create a RAM user and grant permissions

Create a RAM user. For more information, see Create a RAM user.
Create a custom policy. For more information, see Create a custom policy.

A RAM user requires the following permissions for document conversion:
- Permission to call the CreateOfficeConversionTask API operation.
- Permission to call the ListTasks and GetTask API operations to query task status.
- Permission to receive and delete messages from an SMQ queue if you use SMQ for task notifications.
Grant permissions to the RAM user. For more information, see Grant permissions to a RAM user.

Custom RAM user policy example

Restrict API calls to a specific project

This RAM policy allows a RAM user to call the CreateOfficeConversionTask, ListTasks, and GetTask API operations only on the IMM project named doc-convert-project in the China (Shanghai) region. The policy also grants permissions to receive and delete messages from a specific SMQ queue.

Parameters

The resource format for IMM is acs:imm:<RegionId>:<UID>:project/<ProjectName>. Replace the placeholders with your actual values as described in the table below.

Parameter	Description
`RegionId`	The region ID, such as `cn-shanghai` or `cn-beijing`. You can find the region ID on the Endpoints page.
`UID`	The account ID. You can find the ID on the Overview page in Account Center.
`ProjectName`	The name of the IMM project specified during creation. You can find the project name in the Intelligent Media Management console.

The resource format for SMQ is acs:mns:<RegionId>:<UID>:/queues/<QueueName>/messages. Replace the placeholders with your actual values as described in the table below.

Parameter	Description
`RegionId`	The region ID, such as `cn-shanghai` or `cn-beijing`. You can find the region ID on the Endpoints page.
`UID`	The account ID. You can find the ID on the Overview page in Account Center.
`QueueName`	The name of the SMQ queue. You can find the name on the Queues page of the SMQ console.

{
    "Version": "1",
    "Statement": [
        {
            "Action": ["imm:CreateOfficeConversionTask", "imm:ListTasks", "imm:GetTask"],
            "Resource": "acs:imm:cn-shanghai:150910xxxxxxxxxx:project/doc-convert-project",
            "Effect": "Allow"
        },
        {
            "Action": ["mns:ReceiveMessage", "mns:DeleteMessage"],
            "Resource": "acs:mns:cn-shanghai:150910xxxxxxxxxx:/queues/test-queue/messages",
            "Effect": "Allow"
        }
    ]
}