This topic describes how to grant a Resource Access Management (RAM) user permissions to use Chat App resources. A RAM user with the required permissions can access and manage the corresponding instances and features.
Create a resource group and transfer in resources
Alibaba Cloud account registration and enterprise authentication have been completed.
Log on to the Resource Management console, create a resource group, and transfer resources to the resource group. In Chat App Message Service, resources refer to instances.
A resource group is a collection of instances that belong to your Alibaba Cloud account. You can group instances into different resource groups based on your requirements. For example, you can create a resource group named CustomerA and transfer all instances that belong to Customer A to this group.
On the Resource Groups page, click Create Resource Group. Set the Resource Group ID and Resource Group Name for the resource group.
On the Resource Management page, click Transfer In Resources. Search for the resource by its Resource ID (the Channel ID, which you can obtain from the page), and then select the resource to transfer.
Finish creating the resource group.
For more information about resource groups, see What is a resource group?.
Grant permissions to a RAM user
To collaborate on resources, you can create multiple RAM users for your Alibaba Cloud account and assign the least privilege to each user based on their role. This practice helps you manage permissions separately, avoid sharing your account keys, and improve both efficiency and security.
Resource Access Management (RAM) is an Alibaba Cloud service that helps you manage user identities and resource access permissions. You can create RAM users for your Alibaba Cloud account and grant them specific permissions. This ensures that different users have access only to the resources they need. For more information, see What is Resource Access Management? and Overview of RAM users.
Prerequisites
You have created at least one RAM user for your Alibaba Cloud account. For more information, see Create a RAM user.
Procedure
Log on to the RAM console using your Alibaba Cloud account.
Create a custom policy. For more information, see Create a custom policy.
Grant permissions to the RAM user.
You can grant a system policy or a custom policy to the RAM user. This grants the user permissions to access or manage the corresponding resources. For more information, see Grant permissions to a RAM user.
After the authorization is complete, the RAM user can log on to the console to manage the specified resources. For more information, see Log on to the Alibaba Cloud Management Console as a RAM user.
Authorization reference
To use custom policies, you need to understand your permission management requirements and the authorization details for Chat App Message Service. For more information, see Authorization details.
Examples of common custom policies
Grant a RAM user all permissions except for billing and packages
This permission must be granted at the account level.
{
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"cams:QueryProductOpenStatus",
"cams:RAM*",
"cams:UpdateOpenService",
"cams:GetCurrentRole",
"cams:ListDict",
"cams:ListLanguage",
"cams:ListCountry",
"cams:ListVariableType",
"cams:Add*",
"cams:Associate*",
"cams:Audit*",
"cams:*BeeBot*",
"cams:Bind*",
"cams:*Chat*",
"cams:Cpass*",
"cams:*Flow*",
"cams:CreateMassPlanning",
"cams:*Phone*",
"cams:DeleteAgent",
"cams:*Contact*",
"cams:*Group*",
"cams:*Instagram*",
"cams:*Messenger*",
"cams:*Message*",
"cams:*Whatsapp*",
"cams:*Facebook*",
"cams:*Generate*",
"cams:GetAuditRequestByTypeUnAudit",
"cams:IsvGetAppId",
"cams:ListAllAudit",
"cams:ListAuditAndFailByType",
"cams:ListChannelsForBinding",
"cams:*Cust*",
"cams:ListDayUseDetail",
"cams:ListIntent",
"cams:ListMessengerPage",
"cams:*Viber*",
"cams:ListProduct",
"cams:ListProductCatalog",
"cams:ListSenderIdReport",
"cams:ListSwitchVariable",
"cams:*Waba*",
"cams:Modify*",
"cams:Read*",
"cams:RefundResourceBagCallback",
"cams:Remove*",
"cams:Select*",
"cams:Show*",
"cams:TagResources",
"cams:UntagResources",
"cams:UpdateAccountWebhook",
"cams:UpdateAuditRequest",
"cams:UpdateCheckCode",
"cams:UpdateCommerceSetting",
"cams:UpdateConversationalAutomation",
"cams:GetCommerceSetting",
"cams:GetConversationalAutomation",
"cams:GetCountryList",
"cams:GetDefaultLanguage",
"cams:GetDownloadApplicationMaterials",
"cams:GetDownloadExcelList",
"cams:GetFileStringByFileName",
"cams:GetUserStatus",
"cams:*Template*",
"cams:GetSearchTreeData",
"cams:GetPermissionByCode",
"cams:*Oss*",
"cams:GetMigrationVerifyCode",
"cams:*Href*",
"cams:AddAddressRecoverSuspend",
"cams:ChangeResourceGroup",
"cams:ListTagResources",
"cams:GetWhiteList",
"cams:ListAdvert"
],
"Resource": "*"
}
]
}Grant a RAM user permissions for billing and packages
After you grant a RAM user permissions for billing and packages, the user can view all bills. Grant this permission with caution.
{
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"cams:*Bill*",
"cams:QueryThreshold",
"cams:*Package*"
],
"Resource": "*"
}
]
}