If system policies do not meet your requirements, you can create custom policies to achieve least privilege. Custom policies provide fine-grained permission control and improve resource access security. This topic describes scenarios and provides policy examples for using custom policies with the Visual Intelligence API.
What are custom policies?
In the Resource Access Management (RAM) based access control system, custom policies are policies that you can create, update, and delete in addition to system policies. You are responsible for maintaining the versions of your custom policies.
After you create a custom policy, you can attach it to a RAM user, user group, or RAM role. These RAM identities can then obtain the access permissions specified in the policy.
You can delete custom policies. Before you delete a policy, make sure it is not referenced. If the policy is referenced, you must first revoke the authorization.
Custom policies support versioning. You can manage the versions of your custom policies based on the version management mechanism that is specified by RAM.
Operation document
Common scenarios and examples for custom policies
Full permissions
Method 1: Directly grant the system policy AliyunVIAPIFullAccess (permissions to manage the Visual Intelligence API) to a RAM user.
Method 2: Use a custom policy. To grant full permissions for all Visual Intelligence API capabilities, you can define the policy as follows.
{ "Version": "1", "Statement": [ { "Action": [ "viapi-imageenhan:*", "viapi-imagerecog:*", "viapi-imageseg:*", "viapi-ocr:*", "viapi-facebody:*", "viapi-objectdet:*", "viapi-imageaudit:*", "viapi-goodstech:*", "viapi-imgsearch:*", "viapi-videorecog:*", "viapi-videoenhan:*", "viapi-videoseg:*", "viapi-imageprocess:*", "viapi-regen:*", "viapi:*" ], "Resource": "*", "Effect": "Allow" }, { "Action": "ram:PassRole", "Resource": "*", "Effect": "Allow", "Condition": { "StringEquals": { "acs:Service": "viapi.aliyuncs.com" } } } ] }
Single or multiple API limits
If you want to restrict a RAM user to call only one or more APIs, you can use a custom policy.
For example, the following policy restricts calls to only the RecognizeBankCard and CompareFace operations. The process is similar for other capabilities. For more information, see Enable capabilities. Find the English name of the category (Product) and the capability (Action), and then add viapi-<Product>:<Action> to the Action list in the Statement block.
{
"Version": "1",
"Statement": [
{
"Action": [
"viapi-ocr:RecognizeBankCard",
"viapi-facebody:CompareFace"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": "ram:PassRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"acs:Service": "viapi.aliyuncs.com"
}
}
}
]
}IP address and SSL restrictions
Authorization with IP address and SSL restrictions is supported. This authorization policy allows access to all resources only if the following two conditions are met:
The RAM user's current IP CIDR block is 42.120.XX.X/24.
The RAM user accesses the Alibaba Cloud Management Console or an OpenAPI over HTTPS.
{
"Statement": [
{
"Effect": "Allow",
"Action": "viapi-imageenhan:*",
"Resource": "acs:viapi-imageenhan:*:*:*",
"Condition": {
"IpAddress": {
"acs:SourceIp": "42.120.99.0/24"
},
"Bool": {
"acs:SecureTransport": "true"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-imagerecog:*",
"Resource": "acs:viapi-imagerecog:*:*:*",
"Condition": {
"IpAddress": {
"acs:SourceIp": "42.120.99.0/24"
},
"Bool": {
"acs:SecureTransport": "true"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-imageseg:*",
"Resource": "acs:viapi-imageseg:*:*:*",
"Condition": {
"IpAddress": {
"acs:SourceIp": "42.120.99.0/24"
},
"Bool": {
"acs:SecureTransport": "true"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-imageaudit:*",
"Resource": "acs:viapi-imageaudit:*:*:*",
"Condition": {
"IpAddress": {
"acs:SourceIp": "42.120.99.0/24"
},
"Bool": {
"acs:SecureTransport": "true"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-ocr:*",
"Resource": "acs:viapi-ocr:*:*:*",
"Condition": {
"IpAddress": {
"acs:SourceIp": "42.120.99.0/24"
},
"Bool": {
"acs:SecureTransport": "true"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-facebody:*",
"Resource": "acs:viapi-facebody:*:*:*",
"Condition": {
"IpAddress": {
"acs:SourceIp": "42.120.99.0/24"
},
"Bool": {
"acs:SecureTransport": "true"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-objectdet:*",
"Resource": "acs:viapi-objectdet:*:*:*",
"Condition": {
"IpAddress": {
"acs:SourceIp": "42.120.99.0/24"
},
"Bool": {
"acs:SecureTransport": "true"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-goodstech:*",
"Resource": "acs:viapi-goodstech:*:*:*",
"Condition": {
"IpAddress": {
"acs:SourceIp": "42.120.99.0/24"
},
"Bool": {
"acs:SecureTransport": "true"
}
}
}
],
"Version": "1"
}
Time restrictions
The following authorization policy grants a RAM user all permissions for VIAPI before 12:30 on September 25, 2019 (UTC+8).
{
"Statement": [
{
"Effect": "Allow",
"Action": "viapi-imageenhan:*",
"Resource": "acs:viapi-imageenhan:*:*:*",
"Condition": {
"DateLessThan": {
"acs:CurrentTime": "2019-09-25T12:30:00+08:00"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-imagerecog:*",
"Resource": "acs:viapi-imagerecog:*:*:*",
"Condition": {
"DateLessThan": {
"acs:CurrentTime": "2019-09-25T12:30:00+08:00"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-imageseg:*",
"Resource": "acs:viapi-imageseg:*:*:*",
"Condition": {
"DateLessThan": {
"acs:CurrentTime": "2019-09-25T12:30:00+08:00"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-imageaudit:*",
"Resource": "acs:viapi-imageaudit:*:*:*",
"Condition": {
"DateLessThan": {
"acs:CurrentTime": "2019-09-25T12:30:00+08:00"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-ocr:*",
"Resource": "acs:viapi-ocr:*:*:*",
"Condition": {
"DateLessThan": {
"acs:CurrentTime": "2019-09-25T12:30:00+08:00"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-facebody:*",
"Resource": "acs:viapi-facebody:*:*:*",
"Condition": {
"DateLessThan": {
"acs:CurrentTime": "2019-09-25T12:30:00+08:00"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-objectdet:*",
"Resource": "acs:viapi-objectdet:*:*:*",
"Condition": {
"DateLessThan": {
"acs:CurrentTime": "2019-09-25T12:30:00+08:00"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-goodstech:*",
"Resource": "acs:viapi-goodstech:*:*:*",
"Condition": {
"DateLessThan": {
"acs:CurrentTime": "2019-09-25T12:30:00+08:00"
}
}
}
],
"Version": "1"
}
MFA
If a RAM user is granted only this authorization policy, the user has permissions for VIAPI only when Multi-Factor Authentication (MFA) is enabled and the user logs on using MFA. The AccessKey pair of this RAM user does not have permissions. The user must call the Security Token Service (STS) using the AccessKey pair and the correct six-digit MFA code to obtain a temporary AccessKey pair that is valid for 15 minutes. Only this temporary AccessKey pair has the required permissions.
{
"Statement": [
{
"Effect": "Allow",
"Action": "viapi-imageenhan:*",
"Resource": "acs:viapi-imageenhan:*:*:*",
"Condition": {
"Bool": {
"acs:MFAPresent": "true"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-imagerecog:*",
"Resource": "acs:viapi-imagerecog:*:*:*",
"Condition": {
"Bool": {
"acs:MFAPresent": "true"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-imageseg:*",
"Resource": "acs:viapi-imageseg:*:*:*",
"Condition": {
"Bool": {
"acs:MFAPresent": "true"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-imageaudit:*",
"Resource": "acs:viapi-imageaudit:*:*:*",
"Condition": {
"Bool": {
"acs:MFAPresent": "true"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-ocr:*",
"Resource": "acs:viapi-ocr:*:*:*",
"Condition": {
"Bool": {
"acs:MFAPresent": "true"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-facebody:*",
"Resource": "acs:viapi-facebody:*:*:*",
"Condition": {
"Bool": {
"acs:MFAPresent": "true"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-objectdet:*",
"Resource": "acs:viapi-objectdet:*:*:*",
"Condition": {
"Bool": {
"acs:MFAPresent": "true"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-goodstech:*",
"Resource": "acs:viapi-goodstech:*:*:*",
"Condition": {
"Bool": {
"acs:MFAPresent": "true"
}
}
}
],
"Version": "1"
}