Grant permissions to RAM users - Image Search - Alibaba Cloud Documentation Center

Before a Resource Access Management (RAM) user can access the Image Search service, you must grant permissions to the RAM user. This topic describes how to grant permissions for Image Search to a RAM user.

Background information

Resource Access Management (RAM) is an identity and access control service provided by Alibaba Cloud. RAM lets you create and manage RAM users, such as employees, systems, and applications. You can also control the permissions that these RAM users have to access your resources. If multiple users in your enterprise need to collaborate on resources, you can use RAM to avoid sharing your Alibaba Cloud account keys. Instead, you can assign the least privilege required to each user. This practice reduces security risks for your business.

Overview

You can grant permissions to a RAM user to access the Image Search service in the following ways:

General policies.
Custom policies.

You can use general policies to grant permissions and avoid complex configurations. If general policies do not meet your requirements, you can use custom policies.

RAM-supported regions

Image Search supports RAM authorization in the following regions.

Region	Region ID
Asia Pacific SE 1 (Singapore)	ap-southeast-1
China (Hong Kong)	cn-hongkong
Japan (Tokyo)	ap-northeast-1
Europe Central 1 (Frankfurt)	eu-central-1

General policies

The following two general access policies are available:

AliyunImageSearchReadOnlyAccess: Grants read-only access to Image Search. This policy is for read-only users.
AliyunImageSearchFullAccess: Grants full management access to Image Search. This policy is for administrators.

Procedure:

The procedure is as follows:

Log on to the RAM console as a RAM administrator.
In the left-side navigation pane, choose Permissions > Grants.
On the Permission page, click Grant Permission.
In the Grant Permission panel, grant permissions to the RAM user.
1. Configure the Resource Scope parameter.
  - Account: The authorization takes effect on the current Alibaba Cloud account.
  - Resource Group: The authorization takes effect on a specific resource group.
    Important
    If you select Resource Group for the Resource Scope parameter, make sure that the required cloud service supports resource groups. For more information, see Services that work with Resource Group. For more information about how to grant permissions on a resource group, see Control RAM user access to specific ECS instances.
2. Configure the Principal parameter.
  The principal is the RAM user to which you want to grant permissions. You can select multiple RAM users at a time.
3. Configure the Policy parameter.
  A policy contains a set of permissions. Policies can be classified into system policies and custom policies. You can select multiple policies at a time.
  - System policies: policies that are created by Alibaba Cloud. You can use but cannot modify these policies. Version updates of the policies are maintained by Alibaba Cloud. For more information, see Services that work with RAM.
    Note
    The system automatically identifies high-risk system policies, such as AdministratorAccess and AliyunRAMFullAccess. We recommend that you do not grant unnecessary permissions by attaching high-risk policies.
  - Custom policies: You can manage and update custom policies based on your business requirements. You can create, update, and delete custom policies. For more information, see Create a custom policy.
4. Click OK.
Click Close.

Custom policies

Image Search supports only the instance resource type. When you grant permissions using RAM, you must describe resources in the following format:

Resource type: instance
Resource description format in an authorization policy: acs:imagesearch:$regionid:$accountid:instance/$instance
- $regionid: The region ID. To specify all regions, use a wildcard character (*).
- $accountid: The ID of the Alibaba Cloud account, such as 123456789012****. You can use * as a wildcard character.
- $instance: The instance name, such as demo123. You can use * as a wildcard character.

Table 1. Actions for different resources

Resource

Action

instance/*

The names and descriptions of the actions are as follows:

ClearInstance: Clears an instance.
DescribeInstance: Views instance details.
IncreaseInstance: Triggers an incremental update for an instance.
InitInstance: Initializes an instance.
RemoveInstance: Deletes an instance.
ListInstance: Views the instance list.
SearchItem: Searches for items or images.
DeleteItem: Deletes items or images.
AddItem: Adds items or images.
ListIncrement: Views incremental updates.
TagResources: Adds tags.
UntagResources: Removes tags.

instance/$instance

The names and descriptions of the actions are as follows:

ClearInstance: Clears an instance.
DescribeInstance: Views instance details.
IncreaseInstance: Triggers an incremental update for an instance.
InitInstance: Initializes an instance.
RemoveInstance: Deletes an instance.
SearchItem: Searches for items or images.
SearchImage: Searches for items or images.
SearchImageByPic: Searches for items or images.
SearchImageByName: Searches for items or images by name.
DeleteItem: Deletes items or images.
DeleteImage: Deletes items or images.
AddItem: Adds items or images.
AddImage: Adds items or images.
UpdateImage: Updates items or images.
ListIncrement: Views incremental updates.
TagResources: Adds tags.
UntagResources: Removes tags.
IncreaseInstance: Performs batch operations.
IncreaseList: Queries batch tasks.
The status of the instance.
DumpMeta: Exports metadata.
DumpMetaList: Queries metadata export tasks.

Procedure:

Log on to the RAM console as a RAM administrator.
In the left-side navigation pane, choose Permissions > Policies.
On the Policies page, click Create Policy.
On the Create Policy page, click the JSON Editor tab.
The page displays a JSON editor. The default policy template includes a Version element (set to "1") and a Statement array. Each statement includes Effect (defaults to "Allow"), Action, Resource, and Condition elements. You must populate the Action and Resource elements.
Enter the policy content.
To learn more about the policy syntax and structure, see Policy syntax and structure.
At the top of the page, click Optimize, and then click Perform to perform advanced optimization on the policy.
The advanced policy optimization feature performs the following tasks:
- Splits resources or conditions for incompatible actions.
- Narrows the scope of resources.
- Removes duplicate statements or merges statements.
On the Create Policy page, click OK.
In the Create Policy dialog box, enter a policy name and Description, and then click OK.

Custom policy examples

Example 1

The following permissions are required:

The ID of the Alibaba Cloud account to which the RAM user belongs is 1234.
China (Shanghai) region.
All instances.
All console permissions except for clearing or deleting instances.
Access is allowed only from a specific IP address.

The policy is as follows:

{
  "Statement": [
   {
     "Action": [
       "imagesearch:ListInstance",
       "imagesearch:DescribeInstance",
       "imagesearch:IncreaseInstance",
       "imagesearch:InitInstance",
       "imagesearch:SearchItem",
       "imagesearch:AddItem",
       "imagesearch:TagResources",
       "imagesearch:ListIncrement"
     ],
     "Condition": {
       "IpAddress": {
         "acs:SourceIp": "xxx.xx.xxx.x/xx"
       }
     },
     "Effect": "Allow",
     "Resource": "acs:imagesearch:cn-shanghai:1234:instance/*"
   }
  ],
  "Version": "1"
}

Example 2
The required permissions are as follows:
- The Alibaba Cloud account ID for the RAM user is 1234.
- All regions.
- All instances.
- Full permissions for console and API operations.
The policy is as follows:
```
{
  "Statement": [
   {
     "Action": [
         "imagesearch:*"
           ],
     "Effect": "Allow",
     "Resource": "acs:imagesearch:*:1234:instance/*"
   }
  ],
  "Version": "1"
}
```
Example 3
The following permissions are required:
- The Alibaba Cloud account ID for the RAM user is 1234.
- All regions.
- The instance name is instance12138.
- Full operation permissions.
The following describes the policy details.
```
{
  "Statement": [
   {
     "Action": [
         "imagesearch:*"
           ],
     "Effect": "Allow",
     "Resource": "acs:imagesearch:*:1234:instance/instance12138"
   }
  ],
  "Version": "1"
}
```

FAQ

How do I view a created AccessKey (AK)?

AccessKey information, including the AccessKey ID and AccessKey secret, is displayed only once, at the time you create the AccessKey. You cannot view the AccessKey secret again after you leave the creation page. If you lose the AccessKey secret or fail to save it, you cannot recover it. You must create a new AccessKey to regain API access.