Image Search:Grant permissions to RAM users

Overview

Regions that support RAM user authorization

General policies

The procedure is as follows:

1. Log on to the RAM console as a RAM administrator.

2. In the left-side navigation pane, choose Permissions > Grants.

3. On the Permission page, click Grant Permission.

   

4. In the Grant Permission panel, grant permissions to the RAM user.

   1. Configure the Resource Scope parameter.

      • Account: The authorization takes effect on the current Alibaba Cloud account.

      • Resource Group: The authorization takes effect on a specific resource group.

        Important

        If you select Resource Group for the Resource Scope parameter, make sure that the required cloud service supports resource groups. For more information, see Services that work with Resource Group. For more information about how to grant permissions on a resource group, see Use a resource group to grant a RAM user the permissions to manage a specific ECS instance.

   2. Configure the Principal parameter.

      The principal is the RAM user to which you want to grant permissions. You can select multiple RAM users at a time.

   3. Configure the Policy parameter.

      A policy contains a set of permissions. Policies can be classified into system policies and custom policies. You can select multiple policies at a time.

      • System policies: policies that are created by Alibaba Cloud. You can use but cannot modify these policies. Version updates of the policies are maintained by Alibaba Cloud. For more information, see Services that work with RAM.

        Note

        The system automatically identifies high-risk system policies, such as AdministratorAccess and AliyunRAMFullAccess. We recommend that you do not grant unnecessary permissions by attaching high-risk policies.

      • Custom policies: You can manage and update custom policies based on your business requirements. You can create, update, and delete custom policies. For more information, see Create a custom policy.

   4. Click Grant permissions.

5. Click Close.

Custom policies

The procedure is as follows:

1. Log on to the RAM console as a RAM user who has administrative rights.

2. In the left-side navigation pane, choose Permissions > Policies.

3. On the Policies page, click Create Policy.

   

4. On the Create Policy page, click the JSON tab.

   

5. Enter the policy content.

   For more information about the syntax and structure of RAM policies, see Policy structure and syntax.

6. Click Optional advanced optimize in the upper part. In the Optional advanced optimize message, click Perform to optimize the policy.

   The system performs the following operations during the advanced optimization:

   • Split resources or conditions that are incompatible with actions.

   • Narrow down resources.

   • Deduplicate or merge policy statements.

7. On the Create Policy page, click OK.

8. In the Create Policy dialog box, configure the Name and Description parameters and click OK.

Examples of custom policies

• Example 1

  In this example, the policy must meet the following requirements:

  • The ID of the Alibaba Cloud account is 1234.

  • The region is China (Shanghai).

  • All the instances can be accessed.

  • All the permissions except the permissions to clear and delete instances are to be granted in the Image Search console.

  • The specified IP address can connect to the RAM user.

  The following policy content is provided:

  {
    "Statement": [
     {
       "Action": [
         "imagesearch:ListInstance",
         "imagesearch:DescribeInstance",
         "imagesearch:IncreaseInstance",
         "imagesearch:InitInstance",
         "imagesearch:ListIncrement"
       ],
       "Condition": {
         "IpAddress": {
           "acs:SourceIp": "xxx.xx.xxx.x/xx"
         }
       },
       "Effect": "Allow",
       "Resource": "acs:imagesearch:cn-shanghai:1234:instance/*"
     }
    ],
    "Version": "1"
  }

• Example 2

  In this example, the policy must meet the following requirements:

  • The ID of the Alibaba Cloud account is 1234.

  • All the regions are supported.

  • All the instances can be accessed.

  • All the permissions to perform operations in the console or call all the API operations are to be granted.

  The following policy content is provided:

  {
    "Statement": [
     {
       "Action": [
           "imagesearch:*"
             ],
       "Effect": "Allow",
       "Resource": "acs:imagesearch:*:1234:instance/*"
     }
    ],
    "Version": "1"
  }

• Example 3

  In this example, the policy must meet the following requirements:

  • The ID of the Alibaba Cloud account is 1234.

  • All the regions are supported.

  • The instance name is instance12138.

  • All the permissions to perform operations are to be granted.

  The following policy content is provided:

  {
    "Statement": [
     {
       "Action": [
           "imagesearch:*",
             ],
       "Effect": "Allow",
       "Resource": "acs:imagesearch:*:1234:instance/instance12138"
     }
    ],
    "Version": "1"
  }