ApsaraVideo Media Processing:Create a RAM user and grant permissions to the RAM user

Create a RAM user

Grant permissions to a RAM user

1. Log on to the RAM console by using your Alibaba Cloud account.
2. In the left-side navigation pane, choose Identities > Users.
3. On the Users page, find the RAM user to which you want to grant permissions and click Add Permissions in the Actions column.
4. In the Add Permissions panel, configure the following parameters.
   1. Authorization scope: You can select Alibaba Cloud Account or Specific Resource Group.

      Option	Description
      Alibaba Cloud Account	The permissions granted to the RAM user take effect on resources within the current Alibaba Cloud account.
      Specific Resource Group	The permissions granted to the RAM user take effect only on resources in the specified resource group.

   2. Select Policy: You can select System Policy or Custom Policy. Enter a policy name in the search box to search for the policy that you want to attach to the RAM user. Then, click the policy name to add the policy to the Selected section.
      Note You can refine permission management by using custom policies. After you create custom policies, you can select the custom policies in this step to attach the custom policies to the RAM user. For more information, see Create custom policies.

      • If you use system policies, add the system policies described in the following table.
      • If you use custom policies, create custom policies first based on the description in the "Create custom policies" section in this topic and then add the custom policies.

      Service	Required	Description	System policy	Custom policy
      MPS	Yes	To allow a RAM user to use MPS, you must grant full permissions on MPS to the RAM user.	AliyunMTSFullAccess	Not supported.
      OSS	Yes	To allow a RAM user to use MPS, you must grant the read and write permissions on OSS to the RAM user.	AliyunOSSFullAccess	Supported. For more information, see the "Create custom policies" section in this topic.
      RAM	Yes	To allow a RAM user to use MPS, you must grant read-only permissions on RAM to the RAM user.	AliyunRAMReadOnlyAccess	Supported. For more information, see the "Create custom policies" section in this topic.
      MNS	No	To allow a RAM user to use MPS, you must grant permissions on MNS to the RAM user.	AliyunMNSFullAccess	Supported. For more information, see the "Create custom policies" section in this topic.
      Alibaba Cloud CDN	No	To allow a RAM user to use MPS, you must grant permissions on Alibaba Cloud CDN to the RAM user.	AliyunCDNFullAccess	Supported. For more information, see the "Create custom policies" section in this topic.

   3. Click OK.
   4. Click Complete.

Create custom policies

1. Log on to the RAM console by using your Alibaba Cloud account.
2. In the left-side navigation pane, choose Permissions > Policies.
3. On the Policies page, click Create Policy. On the Create Policy page, click the JSON tab.
4. Enter the policy document in the code editor and click Next to edit policy information. Configure basic policy information and click OK to create a custom policy.

   Parameter	Description
   Policy document	You can import system policies or paste the code of the policy templates that are described in the following sections in the code editor. Note For more information about how to configure a custom policy, see the following policy templates for OSS, Alibaba Cloud CDN, and MNS.

Policy template for OSS

• The permissions to perform all operations on the specified input and output buckets.
• The permission to view the list of buckets.

{
  "Version": "1",
  "Statement": [
  {
  "Action": [
  "oss:*"
  ],
  "Resource": [
  "acs:oss:*:*:$InputBucket",
  "acs:oss:*:*:$InputBucket/*",
  "acs:oss:*:*:$OutputBucket",
  "acs:oss:*:*:$OutputBucket/*"
  ],
  "Effect": "Allow"
  },
  {
    "Action": [
    "oss:ListBuckets"
    ],
  "Resource": "*",
  "Effect": "Allow"
  }
 ]
}

Policy template for MNS

• The permissions to perform all operations on the specified queues and topics.
• The permissions to query queues and topics.

{
  "Version": "1",
  "Statement": [
  {
    "Action": [
    "mns:*"
    ],
    "Resource": [
    "acs:mns:$Region:$Uid:/queues/$QueueName",
    "acs:mns:$Region:$Uid:/topics/$TopicName"
    ],
    "Effect": "Allow"
    },
    {
    "Action": [
    "mns:Get*",
    "mns:List*"
    ],
    "Resource": "*",
    "Effect": "Allow"
    }
  ]
}

Policy template for Alibaba Cloud CDN

• The permissions to perform all operations on the specified domain name for CDN.
• The permission to query domain names for CDN.

{
  "Version": "1",
  "Statement": [
     {
        "Action": "cdn:*",
        "Resource": [
        "acs:cdn:*:$Uid:domain/$DomainName"
        ],
        "Effect": "Allow"
        },
        {
        "Action": "cdn:Describe*",
        "Resource": "*",
        "Effect": "Allow"
      }
  ]
}

Policy template for RAM

The permission to query policies attached to RAM roles.

{
    "Statement": [
    {
        "Action": ["ram:ListPoliciesForRole"],
        "Effect": "Allow",
        "Resource": "*"
    }
    ],
    "Version": "1"
}