Custom policies for image processing-Intelligent Media Management(IMM)-阿里云帮助中心

If system policies are insufficient, you can create custom policies to implement the principle of least privilege. Custom policies enable fine-grained permission control and help secure your cloud resources. This topic describes use cases and provides examples of custom policies for image processing in Intelligent Media Management (IMM).

Custom service role permissions

When you create an IMM project, you must specify a service role. This role allows IMM to access your authorized cloud resources, such as Object Storage Service (OSS).

Create a custom service role

To create a service role, see Create a RAM role for a trusted Alibaba Cloud service.
Create a custom policy. For more information, see Create a custom policy.

The following permissions are required for the service role to perform image processing:
- The service role must have permission to read source files from an OSS bucket. For features such as blind watermarking, image-to-PDF conversion, mosaic, and image splicing, the role also needs permission to write the processed files back to the bucket.
- If you use Message Service (MNS) to receive task notifications, the role must have permission to publish messages to MNS.
- The service role must be assumable by IMM to access your authorized cloud resources, such as Object Storage Service (OSS) and Message Service (MNS).
Grant permissions to the service role. For more information, see Manage permissions for a RAM role.

Custom service role policy example

Read and write access for a specific OSS bucket

The following RAM policy allows a role to read from and write to the bucket named my-bucket and publish messages to the topic named test-topic in the China (Shanghai) region.

Parameters

The Resource for Object Storage Service (OSS) is in the format acs:oss:*:*:<BucketName>/*. Replace the placeholder with its actual value. The following table describes the parameter.

Parameter	Description
`BucketName`	The name of the OSS bucket. You can find the bucket name on the Buckets page in the OSS console.

The Resource for Message Service (MNS) is in the format acs:mns:<RegionId>:<UID>:/topics/<TopicName>/messages. Replace the placeholders with their actual values. The following table describes the parameters.

Parameter	Description
`RegionId`	The region ID, such as `cn-shanghai` or `cn-beijing`. You can find the region ID for each region in Endpoints.
`UID`	The account ID. You can find your account ID on the Overview page in the Account Center.
`TopicName`	The name of the MNS topic. You can find the topic name on the Topics page in the MNS console.

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "oss:GetObject",
                "oss:PutObject"
            ],
            "Resource": "acs:oss:*:*:my-bucket/*",
            "Effect": "Allow"
        },
        {
            "Action":"mns:PublishMessage",
            "Resource": "acs:mns:cn-shanghai:150910xxxxxxxxxx:/topics/test-topic/messages",
            "Effect": "Allow"
        },
        {
            "Action": "ram:PassRole",
            "Resource": "*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "acs:Service": "imm.aliyuncs.com"
                }
            }
        }
    ]
}

Custom permissions for a RAM user

Resource Access Management (RAM) provides a long-term permission control mechanism. You can create RAM users with different permissions to delegate access. This practice minimizes the risk of data exposure even if a RAM user's AccessKey pair is compromised.

Create a RAM user and grant permissions

Create a RAM user. For more information, see Create a RAM user.
Create a custom policy. For more information, see Create a custom policy.

The following permissions are required for a RAM user to perform image processing:
- Permission to call IMM APIs related to image processing. Grant permissions based on the APIs you use.
- To query tasks, the RAM user must have permission to call IMM's ListTasks and GetTask APIs.
- To receive messages from MNS, the RAM user must have permission to receive and delete MNS messages.
Grant permissions to the RAM user. For more information, see Manage permissions for a RAM user.

Custom RAM user policy example

API access for a specific project

This RAM policy allows a user to call the following Intelligent Media Management APIs only for the project named image-process-project in the China (Shanghai) region:

EncodeBlindWatermark, CreateDecodeBlindWatermarkTask, GetDecodeBlindWatermarkResult, CreateImageToPDFTask, AddImageMosaic, CreateImageSplicingTask, DetectImageScore, DetectImageLabels, DetectImageCodes, DetectImageFaces, DetectImageCropping, CompareImageFaces, DetectImageCars, DetectImageBodies, DetectImageTexts, ListTasks, and GetTask. Add permissions as needed based on your use case.

Parameters

The Resource for Intelligent Media Management (IMM) is in the format acs:imm:<RegionId>:<UID>:project/<ProjectName>. Replace the placeholders with their actual values. The following table describes the parameters.

Parameter	Description
`RegionId`	The region ID, such as `cn-shanghai` or `cn-beijing`. You can find the region ID for each region in Endpoints.
`UID`	The account ID. You can find your account ID on the Overview page in the Account Center.
`ProjectName`	The name of the project you specified when you created the IMM project. You can find the project name in the IMM console.

The Resource for MNS is in the format acs:mns:<RegionId>:<UID>:/queues/<QueueName>/messages. Replace the placeholders with their actual values. The following table describes the parameters.

Parameter	Description
`RegionId`	The region ID, such as `cn-shanghai` or `cn-beijing`. You can find the region ID for each region in Endpoints.
`UID`	The account ID. You can find your account ID on the Overview page in the Account Center.
`QueueName`	The name of the MNS queue. You can find the queue name on the Queues page in the MNS console.

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "imm:EncodeBlindWatermark",
                "imm:CreateDecodeBlindWatermarkTask",
                "imm:GetDecodeBlindWatermarkResult",
                "imm:CreateImageToPDFTask", 
                "imm:AddImageMosaic",
                "imm:CreateImageSplicingTask",
                "imm:ListTasks",
                "imm:GetTask",
                "imm:DetectImageScore",
                "imm:DetectImageLabels",
                "imm:DetectImageCodes",
                "imm:DetectImageFaces",
                "imm:DetectImageCropping",
                "imm:CompareImageFaces",
                "imm:DetectImageCars",
                "imm:DetectImageBodies",
                "imm:DetectImageTexts"
            ],
            "Resource": "acs:imm:cn-shanghai:150910xxxxxxxxxx:project/image-process-project",
            "Effect": "Allow"
        },
        {
            "Action": ["mns:ReceiveMessage", "mns:DeleteMessage"],
            "Resource": "acs:mns:cn-shanghai:150910xxxxxxxxxx:/queues/test-queue/messages",
            "Effect": "Allow"
        }
    ]
}