Custom permissions for media transcoding-Intelligent Media Management(IMM)-阿里云帮助中心

If predefined system policies do not meet your requirements, you can create custom permission policies to follow the principle of least privilege. They provide fine-grained access control, improving the security of your resources. This topic describes use cases and provides example policies for IMM media transcoding tasks.

Custom permissions for a project service role

When you create an IMM project, you must assign a service role to it. This allows the IMM service to assume the role and access your resources in other cloud services, such as OSS.

Create a custom service role

Create a service role for IMM, which acts as the trusted entity. For details, see Create a RAM role for a trusted Alibaba Cloud service.
Create a custom permission policy. For more information, see Create a custom permission policy.
The service role requires the following permissions for media transcoding:
- Read and write permissions for an OSS bucket. Media transcoding reads source files from and writes transcoded files to an OSS bucket.
- Permission to publish messages to MNS for task notifications.
- Allows the IMM service to access your other authorized cloud resources, such as OSS and MNS.
Grant permissions to the service role. For more information, see Manage permissions for a RAM role.

Custom service role policy example

Read/write access to a specific OSS bucket

This RAM policy allows read and write operations on a bucket named my-bucket and allows publishing messages to an MNS topic named test-topic in the China (Shanghai) region.

Example parameters

The OSS resource uses the format acs:oss:*:*:<BucketName>/*. Replace the placeholders with your actual values based on the following parameter description:

Parameter	Description
`BucketName`	The name of the OSS bucket. You can find the bucket name on the Buckets page of the OSS console.

The MNS resource uses the format acs:mns:<RegionId>:<UID>:/topics/<TopicName>/messages. Replace the placeholders with your actual values based on the following parameter descriptions:

Parameter	Description
`RegionId`	The region ID, such as `cn-shanghai` or `cn-beijing`. For a list of region IDs, see Endpoints.
`UID`	The account ID. You can find it on the Overview page of Account Center.
`TopicName`	The name of the MNS topic. You can find the topic name on the Topics page of the MNS console.

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "oss:GetObject",
                "oss:PutObject"
            ],
            "Resource": "acs:oss:*:*:my-bucket/*",
            "Effect": "Allow"
        },
        {
            "Action":"mns:PublishMessage",
            "Resource": "acs:mns:cn-shanghai:150910xxxxxxxxxx:/topics/test-topic/messages",
            "Effect": "Allow"
        },
        {
            "Action": "ram:PassRole",
            "Resource": "*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "acs:Service": "imm.aliyuncs.com"
                }
            }
        }
    ]
}

Custom IMM permissions for a RAM user

RAM provides a robust permission control mechanism. You can delegate access by creating RAM users with specific permissions. This ensures that even if a RAM user's AccessKey is compromised, your global resources remain secure.

Create and authorize a RAM user

Create a RAM user. For more information, see Create a RAM user.
Create a custom permission policy. For more information, see Create a custom permission policy.
To perform media transcoding, the RAM user requires the following permissions:
- Permission to call the CreateMediaConvertTask API operation of IMM.
- Permission to call the ListTasks and GetTask API operations of IMM to query tasks.
- Permissions to receive and delete messages from an MNS queue.
Grant permissions to the RAM user. For more information, see Grant permissions to a RAM user.

Custom RAM user policy example

API access for a specific project

This RAM policy allows a user to call the CreateMediaConvertTask, ListTasks, and GetTask API operations of IMM only by using the project video-convert-project in the China (Shanghai) region.

Example parameters

The IMM resource uses the format acs:imm:<RegionId>:<UID>:project/<ProjectName>. Replace the placeholders with your actual values based on the following parameter descriptions:

Parameter	Description
`RegionId`	The region ID, such as `cn-shanghai` or `cn-beijing`. For a list of region IDs, see Endpoints.
`UID`	The account ID. You can find it on the Overview page of Account Center.
`ProjectName`	The project name, which you specified when creating the project in IMM. You can find the name in the IMM console.

The MNS resource uses the format acs:mns:<RegionId>:<UID>:/queues/<QueueName>/messages. Replace the placeholders with your actual values based on the following parameter descriptions:

Parameter	Description
`RegionId`	The region ID, such as `cn-shanghai` or `cn-beijing`. For a list of region IDs, see Endpoints.
`UID`	The account ID. You can find it on the Overview page of Account Center.
`QueueName`	The name of the MNS queue. You can find the queue name on the Queues page of the MNS console.

{
    "Version": "1",
    "Statement": [
        {
            "Action": ["imm:CreateMediaConvertTask", "imm:ListTasks", "imm:GetTask"],
            "Resource": "acs:imm:cn-shanghai:150910xxxxxxxxxx:project/video-convert-project",
            "Effect": "Allow"
        },
        {
            "Action": ["mns:ReceiveMessage", "mns:DeleteMessage"],
            "Resource": "acs:mns:cn-shanghai:150910xxxxxxxxxx:/queues/test-queue/messages",
            "Effect": "Allow"
        }
    ]
}