Grant RAM users access to Chat App resources - Chat App Message Service

This topic describes how to grant RAM users access to Chat App resources. With the required permissions, a RAM user can manage the corresponding instances and features.

Create a resource group and transfer resources

Log on to the Resource Management console to create a resource group and transfer resources to it. In Chat App Message Service, resources are instances.
A resource group is a collection of instances under your Alibaba Cloud account. You can organize instances into different resource groups. For example, create a group named CustomerA and transfer all instances for that customer into it.
On the Resource Group page, click Create Resource Group and set the Resource Group Identifier and Resource Group Name.
On the Resources tab, click Transfer In. Search by resource ID. In Chat App, the ID is the Channel ID, found on the Channel Management page in the Chat App console. Select the resource to transfer.
The resource group is created.

What is a resource group?

Grant permissions to a RAM user

Create multiple RAM users and assign least-privilege access based on each user's responsibilities. This approach enables fine-grained permission management, prevents key sharing, and improves management efficiency and security by reducing the risk of information leaks.

Note

Resource Access Management (RAM) is an Alibaba Cloud service that lets you manage user identities and resource access permissions. Grant RAM users specific permissions so each user accesses only the resources they need. What is access control?, RAM user overview.

Prerequisites

You have created at least one RAM user. For instructions, see Create a RAM user.

Procedure

Log on to the RAM console with your Alibaba Cloud account.
Create a custom policy.
Grant permissions to the RAM user.
Attach a system policy or a custom policy to the RAM user. This grants the user the necessary permissions to access or manage the specified resources. For instructions, see Manage RAM user permissions.
After you grant permissions, the RAM user can log on to the console to manage the target resources. Log on as a RAM user.

Authorization reference

To use custom policies, you need to understand your permission management requirements and the authorization details for Chat App Message Service. For more information, see RAM authorization.

Custom policy examples

All permissions except billing and packages

Note

This permission must be granted at the account level.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "cams:QueryProductOpenStatus",
                "cams:RAM*",
                "cams:UpdateOpenService",
                "cams:GetCurrentRole",
                "cams:ListDict",
                "cams:ListLanguage",
                "cams:ListCountry",
                "cams:ListVariableType",
                "cams:Add*",
                "cams:Associate*",
                "cams:Audit*",
                "cams:*BeeBot*",
                "cams:Bind*",
                "cams:*Chat*",
                "cams:Cpass*",
                "cams:*Flow*",
                "cams:CreateMassPlanning",
                "cams:*Phone*",
                "cams:DeleteAgent",
                "cams:*Contact*",
                "cams:*Group*",
                "cams:*Instagram*",
                "cams:*Messenger*",
                "cams:*Message*",
                "cams:*Whatsapp*",
                "cams:*Facebook*",
                "cams:*Generate*",
                "cams:GetAuditRequestByTypeUnAudit",
                "cams:IsvGetAppId",
                "cams:ListAllAudit",
                "cams:ListAuditAndFailByType",
                "cams:ListChannelsForBinding",
                "cams:*Cust*",
                "cams:ListDayUseDetail",
                "cams:ListIntent",
                "cams:ListMessengerPage",
                "cams:*Viber*",
                "cams:ListProduct",
                "cams:ListProductCatalog",
                "cams:ListSenderIdReport",
                "cams:ListSwitchVariable",
                "cams:*Waba*",
                "cams:Modify*",
                "cams:Read*",
                "cams:RefundResourceBagCallback",
                "cams:Remove*",
                "cams:Select*",
                "cams:Show*",
                "cams:TagResources",
                "cams:UntagResources",
                "cams:UpdateAccountWebhook",
                "cams:UpdateAuditRequest",
                "cams:UpdateCheckCode",
                "cams:UpdateCommerceSetting",
                "cams:UpdateConversationalAutomation",
                "cams:GetCommerceSetting",
                "cams:GetConversationalAutomation",
                "cams:GetCountryList",
                "cams:GetDefaultLanguage",
                "cams:GetDownloadApplicationMaterials",
                "cams:GetDownloadExcelList",
                "cams:GetFileStringByFileName",
                "cams:GetUserStatus",
                "cams:*Template*",
                "cams:GetSearchTreeData",
                "cams:GetPermissionByCode",
                "cams:*Oss*",
                "cams:GetMigrationVerifyCode",
                "cams:*Href*",
                "cams:AddAddressRecoverSuspend",
                "cams:ChangeResourceGroup",
                "cams:ListTagResources",
                "cams:GetWhiteList",
                "cams:ListAdvert"
            ],
            "Resource": "*"
        }
    ]
}

Billing and package permissions

Important

After you grant a RAM user billing and package permissions, the user can view all bills. Grant these permissions with caution.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "cams:*Bill*",
                "cams:QueryThreshold",
                "cams:*Package*"
            ],
            "Resource": "*"
        }
    ]
}