OpenSearch:Create RAM user and grant permissions

Scenarios

The following scenarios require creating RAM users and granting them the minimum permissions needed for business operations:

• When RAM users call the AI Search Open Platform service via API/SDK, use AccessKey for identity authentication.

• When RAM users use the AI Search Open Platform console, common scenarios include:

  • Granting the permission to create workspaces and activate AI Search Open Platform.

  • Granting the permission to manage API Keys.

    Important

    In AI Search Open Platform, API Keys exist in independent workspaces. If a RAM user obtains an API Key for a specific workspace (and the API Key is enabled), and uses the API Key in the code, the user can call all services under the workspace via API/SDK with no separate authorization required.

  • Granting the permission to experience services such as document parsing and chunking in Experience Center.

  • Granting the permission to perform evaluation on RAG chains.

Permission policies

System policies

System policies are created uniformly by Alibaba Cloud. Users can only use them and cannot modify them. The version updates of the policies are maintained by Alibaba Cloud. AI Search Open Platform provides the following system policies:

• AliyunOpenSearchFullAccess: Permission to manage OpenSearch. This permission policy includes all permissions in the permission point list. Grant this permission policy with caution.

• AliyunOpenSearchReadOnlyAccess: Grants read-only access to OpenSearch. This policy includes all the control API permissions (List, Describe) for read operations and all permissions within the traffic API permissions list, as detailed in the permission point list.

Custom policies

Create custom permission policies to achieve fine-grained permission management.

Permission point list

Control API permissions

Traffic API permissions

Procedure

Step 1: Create RAM user

A RAM user is a physical identity that has a fixed ID and credential information. A RAM user represents a person or an application. A RAM user has the following characteristics:

• A RAM user can be created by an Alibaba Cloud account. In this case, the RAM user belongs to the Alibaba Cloud account. A RAM user can also be created by a RAM user or a RAM role that has administrative rights. In this case, the RAM user belongs to the Alibaba Cloud account that creates the RAM user or the RAM role.

• A RAM user does not own resources. Resource usage fees of the RAM user are billed to the Alibaba Cloud account to which the RAM user belongs. A RAM user does not receive individual bills and cannot make payments.

• Before RAM users can log on to the Alibaba Cloud Management Console or call operations, they must be authorized by Alibaba Cloud accounts. After RAM users are authorized, the RAM users can access resources that are owned by the Alibaba Cloud accounts.

• RAM users have independent passwords or AccessKey pairs for logon.

• An Alibaba Cloud account can create multiple RAM users. RAM users can be used to represent employees, systems, and applications within an enterprise.

For more information, see Create RAM user.

Step 2: Create custom permission policy

Refer to Common minimum permission combination examples, select permission points from the permission point list to combine into a minimum permission policy. For more information on creating custom authorization policies, see Create custom permission policy.

Step 3: Authorize RAM user

After granting RAM users a system policy or custom policy, the users can access resources with the corresponding permissions in the policy. We recommend that you grant only the required permissions to the RAM user based on the principle of least privilege. For more information on authorization, see Authorize RAM user.

Common minimum permission combination examples

Example 1: Allow RAM users to view the workspace list, view the remaining free service quota, and call the document chunking service in the default workspace. The corresponding authorization policy is as follows:

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "searchplat:ListWorkspaces",
            "Resource": "acs:searchplat:*:*:workspaces/*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "searchplat:DescribeWorkspace",
                "searchplat:GetDocumentSplit",
                "searchplat:DescribeMeasure"
            ],
            "Resource": "acs:searchplat:*:*:workspaces/default"
        }
    ]
}

Example 2: Allow RAM users to view the workspace list, view the remaining free service quota, manage API Keys in the default space, and call the document chunking service.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "searchplat:ListWorkspaces"
            ],
            "Resource": "acs:searchplat:*:*:workspaces/*"
        },
        {
            "Effect": "Allow",
           "Action": [
                "searchplat:DescribeWorkspace",
                "searchplat:WriteCredentials",
                "searchplat:GetDocumentSplit",
                "searchplat:DescribeCredentials",
                "searchplat:DescribeMeasure"
            ],
            "Resource": "acs:searchplat:*:*:workspaces/default"
        }
    ]
}