How to create a RAM role and grant STS authorization-Intelligent Media Services(IMS)-阿里云帮助中心

When accessing Intelligent Media Services (IMS) from mobile or web applications, you can use Security Token Service (STS) for temporary authorization to prevent security risks from leaked AccessKey pairs.

Background

An AccessKey pair for a RAM user provides long-term access, which poses a security risk if leaked. With Security Token Service (STS), you can issue temporary credentials that have a custom expiration time and a scoped policy, following the principle of least privilege to enhance access security.

Step 1: Create a RAM user and grant AssumeRole API access

Log on to the RAM console by using your Alibaba Cloud account or as a RAM administrator.
In the left-side navigation pane, choose Identities > Users.
On the Users page, click Create User.
On the Create User page, in the User Account Information section, configure the user's basic information.
- Logon Name: Enter a logon name. The name can contain letters, digits, periods (.), hyphens (-), and underscores (_). The name can be up to 64 characters long.
- Display Name: Enter a display name. The name can be up to 128 characters long.
- Tag: Click , and then enter a tag key and tag value. Attach tags to the RAM user for easier management.
Note
Click Add User to create multiple RAM users at a time.
In the Access Mode section, select an access mode and configure the parameters.
Click OK and complete the phone verification. The system automatically generates an AccessKey pair for the RAM user.
In the Actions column, click Copy to save the logon name, password, and AccessKey information of the user.
Important
Save the logon password and AccessKey information (AccessKey ID and AccessKey Secret). You cannot retrieve them later.
Return to the user list. In the Actions column of the created RAM user, click Add Permissions.
In the Add Permissions panel, grant permissions to the RAM user.
1. Select an authorization scope.
  For Authorization Scope, select Alibaba Cloud Account. Intelligent Media Services (IMS) does not support granting permissions to a specific resource group. For more information about resource groups, see Differences and relationships among Resource Directory, resource groups, and tags.
2. Specify the principal.
  The principal is the RAM user to which you want to grant permissions.
3. Select a policy.
  Under System Policies, enter AliyunSTS in the search box and select the AliyunSTSAssumeRoleAccess policy.
4. Click OK to complete the authorization.

Step 2: Create a RAM role and grant IMS permissions

Log on to the RAM console as a RAM administrator.
In the left-side navigation pane, choose Identities > Roles.
On the Roles page, click Create Role.
On the Create Role page, set Principal Type to Cloud Account, specify the details of the Alibaba Cloud account, and then click OK.
- Current Account: Select this option to allow all RAM users and RAM roles under the current Alibaba Cloud account to assume the role. SelectCurrent Account.
- Other Account: Select this option to allow all RAM users and RAM roles from another Alibaba Cloud account to assume the role. SelectOther Account and then enter the ID of the other Alibaba Cloud account (main account). This is primarily used for cross-account resource access. For more information, see Access resources across Alibaba Cloud accounts.You can find your Alibaba Cloud account (main account) ID on the Security Settings page.
(Optional) To restrict the role to specific RAM users or RAM roles, click Switch to Policy Editor to modify the trust policy.

The editor supports two modes: Visual Editor and JSON Editor. In the following example, the RAM role can only be assumed by the RAM user Alice under the current Alibaba Cloud account (AccountID=100******0719).
- Visual Editor
  
  In the Principal section, add the RAM user.
  
  Click the Edit link next to Cloud Account and enter the ID of the trusted account.
  
  In the Add Principal dialog box, select Current Account for Cloud Account and RAM user for Identity Type. Enter the target username, such as Alice, in the User Name field, and then click OK.
- JSON Editor
  
  In the RAM field of the Principal object, enter the full ARN of the RAM user.
```
{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "RAM": "acs:ram::100******0719:user/Alice"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
```

On the Grant Permission panel, grant permissions to the RAM role.

Select an authorization scope.
For Authorization Scope, select Alibaba Cloud Account. IMS does not support granting permissions to a specific resource group. For more information about resource groups, see Differences and relationships among Resource Directory, resource groups, and tags.
Specify the principal.
The principal is the RAM role to which permissions are granted. By default, the current RAM role is specified. You can also specify a different RAM role.

Select permission policies.

Use system policies

In the search box under System Policy, enter AliyunICE and select a policy based on your needs.

Policy	Description	API operation
AliyunICEFullAccess	Permissions to manage and operate all IMS resources	This policy grants permissions on all operations of IMS.
AliyunICEReadOnlyAccess	Read-only permissions on all IMS resources	This policy grants permissions on all read-only operations of IMS, such as Get, Describe, Search, and List operations.

Use custom policies
Under Custom Policy, select a policy based on your needs. If no custom policy is available, you can create one. For more information, see Create a custom permission policy and Custom policy examples.

Note

You can add up to five policies at a time. To add more, repeat the operation.
To minimize risks, follow the principle of least privilege.
If you need to use the IMS server-side SDK for iOS or Android, you must also grant OSS permissions because files need to be uploaded to OSS. You can grant the AliyunOSSFullAccess permission or customize an OSS permission policy based on your needs.

Click OK to complete the authorization.

Step 3: Call AssumeRole to obtain temporary credentials

Download and integrate an STS SDK. For download links, see STS SDK overview.

Call the AssumeRole API to obtain temporary identity credentials for the role.

The following Java code sample demonstrates how to call AssumeRole. For sample code in other languages, see SDK sample code.

Java

import com.aliyun.tea.*;

public class Sample {

    /**
     * <b>description</b> :
     * <p>Use a credential to initialize the client.</p>
     * @return Client
     * 
     * @throws Exception
     */
    public static com.aliyun.sts20150401.Client createClient() throws Exception {
        // We recommend that you use a credential-free method to run your project code. For more information about how to configure credentials, see https://help.aliyun.com/document_detail/378657.html.
        com.aliyun.credentials.Client credential = new com.aliyun.credentials.Client();
        com.aliyun.teaopenapi.models.Config config = new com.aliyun.teaopenapi.models.Config()
                .setCredential(credential);
        // For more information about endpoints, see https://api.aliyun.com/product/Sts.
        config.endpoint = "sts.us-west-1.aliyuncs.com";
        return new com.aliyun.sts20150401.Client(config);
    }

    public static void main(String[] args_) throws Exception {

        com.aliyun.sts20150401.Client client = Sample.createClient();
        // The request parameters for the AssumeRole API include RoleArn, RoleSessionName, Policy, and DurationSeconds.
        // You can obtain the RoleArn parameter from the RAM console.
        com.aliyun.sts20150401.models.AssumeRoleRequest assumeRoleRequest = new com.aliyun.sts20150401.models.AssumeRoleRequest()
                .setDurationSeconds(3600L)
                // Customize your policy.
                .setPolicy("{\n" +
                        "  \"Version\": \"1\",\n" +
                        "  \"Statement\": [\n" +
                        "    {\n" +
                        "      \"Action\": \"ice:*\",\n" +
                        "      \"Resource\": \"*\",\n" +
                        "      \"Effect\": \"Allow\"\n" +
                        "    }\n" +
                        "  ]\n" +
                        "}")
                .setRoleArn("<role-arn>")
                // RoleSessionName is a custom name for the session, used to identify the user for auditing purposes.
                .setRoleSessionName("session-name");// Specify a custom name.
        com.aliyun.teautil.models.RuntimeOptions runtime = new com.aliyun.teautil.models.RuntimeOptions();
        try {
            com.aliyun.sts20150401.models.AssumeRoleResponse resp = client.assumeRoleWithOptions(assumeRoleRequest, runtime);
            com.aliyun.teaconsole.Client.log(com.aliyun.teautil.Common.toJSONString(resp));
        } catch (TeaException error) {
            // This is for printing and demonstration purposes only. Handle exceptions with caution. Do not ignore exceptions in your project.
            // Error message
            System.out.println(error.getMessage());
            // Diagnostic address
            System.out.println(error.getData().get("Recommend"));
            com.aliyun.teautil.Common.assertAsString(error.message);
        } catch (Exception _error) {
            TeaException error = new TeaException(_error.getMessage(), _error);
            // This is for printing and demonstration purposes only. Handle exceptions with caution. Do not ignore exceptions in your project.
            // Error message
            System.out.println(error.getMessage());
            // Diagnostic address
            System.out.println(error.getData().get("Recommend"));
            com.aliyun.teautil.Common.assertAsString(error.message);
        }
    }
}

Next steps

After you obtain the AccessKey information, install the server-side SDK and call API operations. For more information, see Call API operations.

References

AssumeRole - Obtain temporary identity credentials for a role