How to set a RAM policy for the earlier version of Intelligent Media Management-Intelligent Media Management(IMM)-阿里云帮助中心

Resource Access Management (RAM) is an access control service provided by Alibaba Cloud. RAM policies are user-based authorization policies that allow you to centrally manage your users, such as employees, systems, or applications, and control their permissions to access your resources. For example, you can grant users read-only permissions for a specific project.

Important

This document is no longer maintained. Use the new version of Intelligent Media Management.

For a comparison between the new and earlier versions of Intelligent Media Management, see Guide to new and earlier versions.
To learn how to customize a RAM policy for the new version of Intelligent Media Management, see Customize a RAM policy.

Customize a RAM policy

You can customize a RAM policy to control user permissions. The policy includes the following configurations:

Effect: Set to Allow or Deny. Allow grants permission for an operation, and Deny rejects permission for an operation.
Action: An API operation of Intelligent Media Management. The format is imm:<action>, such as imm:ConvertOfficeFormat. For more information about the list of actions, see API overview.
Resource: Intelligent Media Management supports only the Project resource type. The format is acs:imm:<region-id>:<uid>:projects/<project>. An example is acs:imm:cn-shanghai:150910xxxxxxxxxx:projects/imm-test-doc-proj. For project-related API operations, such as PutProject and ListProject, set Resource to * if the operation is not associated with a specific resource.
- region-id: The region ID, such as cn-shanghai or cn-beijing.
- uid: The account ID. You can view the ID in Account Management on the console.
- project: The project name specified during creation. You can view the name in the Intelligent Media Management console.

For more information about access policies, see Create a custom policy.

Common examples

Full authorization

This RAM policy grants a user permissions to use all features of Intelligent Media Management.

{
    "Version": "1",
    "Statement": [
        {
            "Action": "imm:*",
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

Wildcard authorization

RAM policies support the wildcard character (*) for batch authorization. The following example grants a user permissions to call read operations on projects that start with imm-test-doc in all regions.

{
    "Statement": [
        {
            "Effect": "Allow",
            "Action": ["imm:List*", "imm:Get*"],
            "Resource": "acs:imm:*:150910xxxxxxxxxx:projects/imm-test-doc-*"
        }
    ],
    "Version": "1"
}

Authorization for specific operations on specific projects

The following example policy grants a user permission to call the ListProjects API operation. The policy also grants the user permissions to call the ConvertOfficeFormat and CreateOfficeConversionTask API operations, but only on the imm-test-doc-proj project in the China (Shanghai) region. In addition, the policy grants the user permissions to call the CreateGroupFacesJob and CreateMergeFaceGroupsJob API operations, but only on the imm-test-media-proj project in the China (Shanghai) region.

{
    "Statement": [
        {
            "Effect": "Allow",
            "Action": ["imm:ListProjects"],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": ["imm:ConvertOfficeFormat", "imm:CreateOfficeConversionTask"],
            "Resource": "acs:imm:cn-shanghai:150910xxxxxxxxxx:projects/imm-test-doc-proj"
        },
        {
            "Effect": "Allow",
            "Action": ["imm:CreateGroupFacesJob", "imm:CreateMergeFaceGroupsJob"],
            "Resource": "acs:imm:cn-shanghai:150910xxxxxxxxxx:projects/imm-test-media-proj"
        }
    ],
    "Version": "1"
}