After permissions are granted to a Resource Access Management (RAM) user, the user can access Alibaba Cloud Visual Intelligence API.
Consulting Service
If you have questions about Alibaba Cloud Visual Intelligence API, join the Alibaba Cloud Visual Intelligence API support group on DingTalk. Search for the group ID 23109592 to join the group and contact support.
Authorization Procedure
Log on to the Resource Access Management (RAM) console.
Create a RAM user.
For more information, see Create a RAM user.
Create a custom policy. If you use the system policy AliyunVIAPIFullAccess, skip this step.
When you create a custom policy, use the script editor. Granular access control supports settings such as single or multiple API restrictions, IP/SSL restrictions, time limits, MFA, and role-based STS. For more information about how to create a custom policy, see Create a custom policy.
Grant permissions to the user.
For more information, see Manage RAM user permissions.
Full permissions
Method 1: Grant the AliyunVIAPIFullAccess system policy to the user. This policy grants full permissions to manage Visual Intelligence API.
Method 2: Use a custom policy. The following policy grants full permissions for all Visual Intelligence API capabilities.
{ "Version": "1", "Statement": [ { "Action": [ "viapi-imageenhan:*", "viapi-imagerecog:*", "viapi-imageseg:*", "viapi-ocr:*", "viapi-facebody:*", "viapi-objectdet:*", "viapi-imageaudit:*", "viapi-goodstech:*", "viapi-imgsearch:*", "viapi-videorecog:*", "viapi-videoenhan:*", "viapi-videoseg:*", "viapi-imageprocess:*", "viapi-regen:*", "viapi:*" ], "Resource": "*", "Effect": "Allow" }, { "Action": "ram:PassRole", "Resource": "*", "Effect": "Allow", "Condition": { "StringEquals": { "acs:Service": "viapi.aliyuncs.com" } } } ] }
Single or multiple API restrictions
The system policy AliyunVIAPIFullAccess allows calls to all Visual Intelligence API operations. If you want to restrict access to one or more specific APIs, you can use a custom policy.
For example, the following policy restricts calls to only RecognizeBankCard and CompareFace. For other capabilities, see Activate capabilities to find the English name of the category (Product) and the capability (Action). Then, add viapi-<Product>:<Action> to the Action array in the Statement block.
{
"Version": "1",
"Statement": [
{
"Action": [
"viapi-ocr:RecognizeBankCard",
"viapi-facebody:CompareFace"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": "ram:PassRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"acs:Service": "viapi.aliyuncs.com"
}
}
}
]
}IP/SSL restrictions
You can add IP and SSL restrictions to an authorization policy. This policy allows access to all resources only if the following two conditions are met:
The RAM user's current IP address is in the 42.120.XX.X/24 CIDR block.
The RAM user is using HTTPS to access the Alibaba Cloud console or an OpenAPI.
{
"Statement": [
{
"Effect": "Allow",
"Action": "viapi-imageenhan:*",
"Resource": "acs:viapi-imageenhan:*:*:*",
"Condition": {
"IpAddress": {
"acs:SourceIp": "42.120.99.0/24"
},
"Bool": {
"acs:SecureTransport": "true"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-imagerecog:*",
"Resource": "acs:viapi-imagerecog:*:*:*",
"Condition": {
"IpAddress": {
"acs:SourceIp": "42.120.99.0/24"
},
"Bool": {
"acs:SecureTransport": "true"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-imageseg:*",
"Resource": "acs:viapi-imageseg:*:*:*",
"Condition": {
"IpAddress": {
"acs:SourceIp": "42.120.99.0/24"
},
"Bool": {
"acs:SecureTransport": "true"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-imageaudit:*",
"Resource": "acs:viapi-imageaudit:*:*:*",
"Condition": {
"IpAddress": {
"acs:SourceIp": "42.120.99.0/24"
},
"Bool": {
"acs:SecureTransport": "true"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-ocr:*",
"Resource": "acs:viapi-ocr:*:*:*",
"Condition": {
"IpAddress": {
"acs:SourceIp": "42.120.99.0/24"
},
"Bool": {
"acs:SecureTransport": "true"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-facebody:*",
"Resource": "acs:viapi-facebody:*:*:*",
"Condition": {
"IpAddress": {
"acs:SourceIp": "42.120.99.0/24"
},
"Bool": {
"acs:SecureTransport": "true"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-objectdet:*",
"Resource": "acs:viapi-objectdet:*:*:*",
"Condition": {
"IpAddress": {
"acs:SourceIp": "42.120.99.0/24"
},
"Bool": {
"acs:SecureTransport": "true"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-goodstech:*",
"Resource": "acs:viapi-goodstech:*:*:*",
"Condition": {
"IpAddress": {
"acs:SourceIp": "42.120.99.0/24"
},
"Bool": {
"acs:SecureTransport": "true"
}
}
}
],
"Version": "1"
}
Time limits
This authorization policy grants the RAM user all VIAPI permissions before 12:30 on September 25, 2019 (UTC+8).
{
"Statement": [
{
"Effect": "Allow",
"Action": "viapi-imageenhan:*",
"Resource": "acs:viapi-imageenhan:*:*:*",
"Condition": {
"DateLessThan": {
"acs:CurrentTime": "2019-09-25T12:30:00+08:00"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-imagerecog:*",
"Resource": "acs:viapi-imagerecog:*:*:*",
"Condition": {
"DateLessThan": {
"acs:CurrentTime": "2019-09-25T12:30:00+08:00"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-imageseg:*",
"Resource": "acs:viapi-imageseg:*:*:*",
"Condition": {
"DateLessThan": {
"acs:CurrentTime": "2019-09-25T12:30:00+08:00"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-imageaudit:*",
"Resource": "acs:viapi-imageaudit:*:*:*",
"Condition": {
"DateLessThan": {
"acs:CurrentTime": "2019-09-25T12:30:00+08:00"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-ocr:*",
"Resource": "acs:viapi-ocr:*:*:*",
"Condition": {
"DateLessThan": {
"acs:CurrentTime": "2019-09-25T12:30:00+08:00"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-facebody:*",
"Resource": "acs:viapi-facebody:*:*:*",
"Condition": {
"DateLessThan": {
"acs:CurrentTime": "2019-09-25T12:30:00+08:00"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-objectdet:*",
"Resource": "acs:viapi-objectdet:*:*:*",
"Condition": {
"DateLessThan": {
"acs:CurrentTime": "2019-09-25T12:30:00+08:00"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-goodstech:*",
"Resource": "acs:viapi-goodstech:*:*:*",
"Condition": {
"DateLessThan": {
"acs:CurrentTime": "2019-09-25T12:30:00+08:00"
}
}
}
],
"Version": "1"
}
MFA
If a RAM user is granted only this authorization policy, the user has VIAPI permissions only when logging on using multi-factor authentication (MFA). The user's AccessKey (AK) does not have permissions by itself. To obtain access, the user must call the Security Token Service (STS) using their AK and the correct six-digit MFA code. This call returns a temporary AK that expires in 15 minutes and grants the required permissions.
{
"Statement": [
{
"Effect": "Allow",
"Action": "viapi-imageenhan:*",
"Resource": "acs:viapi-imageenhan:*:*:*",
"Condition": {
"Bool": {
"acs:MFAPresent": "true"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-imagerecog:*",
"Resource": "acs:viapi-imagerecog:*:*:*",
"Condition": {
"Bool": {
"acs:MFAPresent": "true"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-imageseg:*",
"Resource": "acs:viapi-imageseg:*:*:*",
"Condition": {
"Bool": {
"acs:MFAPresent": "true"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-imageaudit:*",
"Resource": "acs:viapi-imageaudit:*:*:*",
"Condition": {
"Bool": {
"acs:MFAPresent": "true"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-ocr:*",
"Resource": "acs:viapi-ocr:*:*:*",
"Condition": {
"Bool": {
"acs:MFAPresent": "true"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-facebody:*",
"Resource": "acs:viapi-facebody:*:*:*",
"Condition": {
"Bool": {
"acs:MFAPresent": "true"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-objectdet:*",
"Resource": "acs:viapi-objectdet:*:*:*",
"Condition": {
"Bool": {
"acs:MFAPresent": "true"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-goodstech:*",
"Resource": "acs:viapi-goodstech:*:*:*",
"Condition": {
"Bool": {
"acs:MFAPresent": "true"
}
}
}
],
"Version": "1"
}
Role-based STS for console access
A Security Token Service (STS) token is a temporary credential used for cross-account and cross-service resource access. An STS token consists of the following three parts:
AccessKeyId
AccessKeySecret
SecurityToken
In the RAM console, create a RAM role for your Alibaba Cloud account and grant management permissions for the product or the AdministratorAccess policy to the role.
Create a RAM user and grant the user the AliyunSTSAssumeRoleAccess permission.
Log on to the RAM console as the RAM user that you created.
Hover the mouse pointer over the profile picture in the upper-right corner to view and save the enterprise alias.
Click Switch Identity.
On the Switch Role page, enter the enterprise alias that you saved and the name of the role that you created in step 1.
NoteIf you do not have an alias, enter the ID of your Alibaba Cloud account.
After you switch to the role, enter the URL of the product console in your browser.