ApsaraVideo Media Processing:Create a RAM user and grant permissions

Procedure

1. Log on to the RAM console by using an Alibaba Cloud account or a RAM user who has administrative rights.

2. In the left-side navigation pane, choose Identities > Users.

3. On the Users page, click Create User. 

4. In the User Account Information section of the Create User page, configure the following parameters:

   • Logon Name: The logon name can be up to 64 characters in length, and can contain letters, digits, periods (.), hyphens (-), and underscores (_). 

   • Display Name: The display name can be up to 128 characters in length. 

   • Tag: Click the  icon and enter a tag key and a tag value. You can add one or more tags to the RAM user. This way, you can manage the RAM user based on the tags. 

   Note

   You can click Add User to create multiple RAM users at a time.

5. For Access Mode, select Access with permanent AccessKey.

6. Click OK and complete the phone verification. The system automatically generates an AccessKey for the RAM user.

7. In the Actions column, click Copy to save the user information, such as the logon name, logon password, and AccessKey.

   Important

   Make sure to save the logon password and AccessKey information (AccessKey ID and AccessKey secret). You cannot retrieve this information later.

8. Return to the user list. In the Actions column of the new RAM user, click Add Permissions.

9. In the Add Permissions panel, configure the authorization information.

   1. Select the scope of the authorization.

      Type	Description
      Entire Alibaba Cloud Account	The permissions take effect within the current Alibaba Cloud account.
      Specify a resource group	The permissions take effect within the specified resource group.

   2. Enter the principal.

      The principal is the RAM user to whom you want to grant permissions.

   3. Select an access policy. For more information about the services that require authorization and the supported access policies, see Access policy details.

      • Use a system policy

        Enter the policy name in the search box and click the name in the search results to select it.

      • Use a custom policy

        A custom policy allows for more fine-grained permission management. You must create a custom policy before you can select it. For more information, see Create a custom policy.

10. Click Confirm New Authorization.

Access policy details

To use MPS, you must grant permissions for MPS and OSS. You can also grant permissions for Simple Message Queue (formerly MNS) and Alibaba Cloud CDN. You must use a system policy to grant permissions for MPS. For other services, you can use a system policy or a custom policy.

Create a custom policy

1. Log on to the RAM console with your Alibaba Cloud account.

2. In the navigation pane on the left, choose Permission Management > Access Policies.

3. Click Create Policy and select the Script Editor tab.

4. Configure the access policy. Enter the policy content, and then click OK.

   Note

   You can import a system policy or copy the required policy code from the examples below into the code box.

5. Enter basic information such as the Name and Note.

6. Click OK to create the custom policy.

Example: Restrict access to MPS by IP address and time period

• The RAM user can access MPS only from the 192.0.2.0/24 and 203.0.113.2 IP addresses.

• The RAM user can access MPS only before 17:00 on August 12, 2019 (UTC+8).

{
  "Version": "1",
    "Statement": [{
      "Effect": "Allow",
      "Action": [
        "mts:*",
        "mts-inner:*"
      ],
      "Resource": "*",
      "Condition": {
        "NotIpAddress": {
          "acs:SourceIp": [
            "192.0.2.0/24",
            "203.0.113.2"
          ]},
        "DateLessThan": {
          "acs:CurrentTime": "2019-08-12T17:00:00+08:00"
       }
     }
  ]
}

Example: OSS custom policy

• Grants all permissions on the specified input and output buckets.

• Grants the permission to view the bucket list.

{    
  "Version": "1",
    "Statement": [{
      "Effect": "Allow",
      "Action": [
        "oss:ListBuckets"
      ],
      "Resource": "*"
    }, {
      "Effect": "Allow",
      "Action": [
        "oss:*"
      ],
      "Resource": [
        "acs:oss:*:*:$InputBucket",
        "acs:oss:*:*:$InputBucket/*",
        "acs:oss:*:*:$OutputBucket",
        "acs:oss:*:*:$OutputBucket/*
      ]
    }
  ]
}

Parameter description:

For more information, see Common examples of bucket policies.

Example: RAM authorization policy

Grants the permission to view roles.

{
  "Version": "1",
    "Statement": [{
      "Effect": "Allow",
      "Action": [
        "ram:ListPoliciesForRole"
      ],
      "Resource": "*"
    }
  ]
}

Example: MNS custom policy

• Grants the permission to view all queue and topic lists.

• Grants full read and write permissions only for the specified $QueueName and $TopicName.

{
  "Version": "1",
    "Statement": [{
      "Effect":"Allow",
      "Action":[
        "mns:ListQueue",
        "mns:ListTopic",
        "mns:GetQueueAttributes",
        "mns:GetTopicAttributes"
      ],
      "Resource":"acs:mns:*:*:*"
    }, {
      "Effect": "Allow",
      "Action": "mns:*",
      "Resource": [
        "acs:mns:$Region:$Uid:/queues/$QueueName", 
        "acs:mns:$Region:$Uid:/topics/$TopicName"
      ]
    }
  ]
}

Parameter description:

For more information, see Authorization policies and examples.

Example: CDN authorization policy

• Grants the permission to view all CDN-accelerated domain names.

• Grants full read and write permissions only for the specified CDN-accelerated domain name $DomainName.

{
  "Version": "1",
  "Statement": [{
        "Effect": "Allow",
        "Action": "cdn:*",
        "Resource": "acs:cdn:*:$Uid:domain/$DomainName"
        },{
        "Effect": "Allow",
        "Action": "cdn:Describe*",
        "Resource": "*"
      }
  ]
}

Parameter description: