Custom permissions for live transcoding-Intelligent Media Management(IMM)-阿里云帮助中心

If the default system permission policy does not meet your requirements, you can create a custom policy to follow the principle of least privilege. Custom policies enable fine-grained permission management and improve resource access security. This topic describes use cases and provides examples of custom policies for the live transcoding feature of Intelligent Media Management (IMM).

Custom permissions for a service role

When you create an IMM project, you must set a service role for the project. This allows the IMM service to assume the role to access your authorized resources in other cloud services, such as Object Storage Service (OSS).

Create a custom service role

Create a service role. For details, see Create a RAM role for a trusted Alibaba Cloud service.
Create a custom policy. For more information, see Create a custom permission policy.

The service role requires the following permissions for live transcoding:
- The service role must have read and write permissions on the OSS bucket to read source files and write transcoded files.
- Permission for the IMM service to assume this role to access your authorized resources in other cloud services, such as OSS.
Grant permissions to the service role. For details, see Manage the permissions of a RAM role.

Custom policy for a service role

Read and write permissions for a specific OSS bucket

The following RAM policy allows read and write access to the bucket named my-bucket.

Parameter description

The OSS resource is specified in the format acs:oss:*:*:<BucketName>/*. When you configure the policy, replace the <BucketName> placeholder with your actual value. This parameter is described in the table below.

Parameter	Description
`BucketName`	The name of the OSS bucket. You can find the name on the Buckets page in the OSS console.

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "oss:GetObject",
                "oss:PutObject"
            ],
            "Resource": "acs:oss:*:*:my-bucket/*",
            "Effect": "Allow"
        },
        {
            "Action": "ram:PassRole",
            "Resource": "*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "acs:Service": "imm.aliyuncs.com"
                }
            }
        }
    ]
}

Custom permissions for a RAM user

Resource Access Management (RAM) is a permission control service. You can create RAM users with specific permissions to securely delegate access. If a RAM user's AccessKey pair is compromised, the security risk is limited to that user's specific permissions.

Create a RAM user and grant permissions

Create a RAM user. For details, see Create a RAM user.
Create a custom policy. For more information, see Create a custom permission policy.

To use live transcoding, the RAM user requires the following permissions:
- Permission to call IMM APIs related to live transcoding.
- Permission to read objects from OSS and use IMM to process them.
Grant permissions to the RAM user. For details, see Grant permissions to a RAM user.

Custom policy for a RAM user

Limit API calls by project and bucket

This RAM policy allows a RAM user to call specific Intelligent Media Management (IMM) APIs for the video-process-project project in the China (Shanghai) region:

GenerateVideoPlaylist and LiveTranscoding. The policy also grants permission to read objects and perform IMM processing operations only on the bucket named my-bucket.

Important

Live transcoding relies on an IMM project bound to an OSS bucket. Therefore, you must grant the RAM user permission to call the APIs for the associated project.

Parameter description

Parameter	Description
`BucketName`	The name of the OSS bucket. You can find the name on the Buckets page in the OSS console.

The IMM resource is specified in the format acs:imm:<RegionId>:<UID>:project/<ProjectName>. When you configure the policy, replace the <RegionId>, <UID>, and <ProjectName> placeholders with your actual values. These parameters are described in the table below.

Parameter	Description
`RegionId`	The region ID, such as `cn-shanghai` or `cn-beijing`. For a list of region IDs, see Endpoints.
`UID`	Your account ID. You can find your account ID on the Overview page of the Account Center.
`ProjectName`	The name of the IMM project. You can find the project name in the IMM console.

The Message Service (MNS) resource is specified in the format acs:mns:<RegionId>:<UID>:/queues/<QueueName>/messages. When you configure the policy, replace the <RegionId>, <UID>, and <QueueName> placeholders with your actual values. These parameters are described in the table below.

Parameter	Description
`RegionId`	The region ID, such as `cn-shanghai` or `cn-beijing`. For a list of region IDs, see Endpoints.
`UID`	Your account ID. You can find your account ID on the Overview page of the Account Center.
`QueueName`	The name of the MNS queue. You can find the name on the Queues page in the MNS console.

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "oss:GetObject",
                "oss:PostProcessTask",
                "oss:ProcessImm"
            ],
            "Resource": "acs:oss:*:*:my-bucket/*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "imm:GenerateVideoPlaylist",
                "imm:LiveTranscoding"
            ],
            "Resource": "acs:imm:cn-shanghai:150910xxxxxxxxxx:project/video-process-project",
            "Effect": "Allow"
        }
    ]
}