ApsaraVideo Media Processing:Create a RAM role for a trusted Alibaba Cloud account and authorize the RAM role to access MPS

Create a role

1. Log on to the RAM console as a RAM user who has administrative rights.

2. In the left-side navigation pane, choose Identities > Roles.

3. On the Roles page, click Create Role.

   

4. On the Create Role page, set the Principal Type parameter to Cloud Account, specify an Alibaba Cloud account, and then click OK.

   

   • Current Account: If you want a RAM user or RAM role that belongs to your Alibaba Cloud account to assume the RAM role, select Current Account.

   • Other Account: If you want a RAM user or RAM role that belongs to a different Alibaba Cloud account to assume the RAM role, select Other Account and enter the ID of the Alibaba Cloud account. This option is provided to grant permissions on resources that belong to different Alibaba Cloud accounts. For more information, see Delegate access across Alibaba Cloud accounts using RAM roles. You can view the ID of your Alibaba Cloud account on the Security Settings page.

5. Optional. If you want the RAM role to be assumed only by a specific RAM user or RAM role that belongs to the trusted Alibaba Cloud account, click Switch to Policy Editor and modify the trust policy of the RAM role in the editor.

   The editor supports the Visual editor and JSON modes. In the following example, only the RAM user Alice within the Alibaba Cloud account whose ID is 100******0719 can assume the RAM role.

   • Visual editor

     Specify a RAM user for the Principal element.

     

     

   • JSON

     Specify a RAM user for the RAM field of the Principal parameter.

     {
       "Version": "1",
       "Statement": [
         {
           "Effect": "Allow",
           "Principal": {
             "RAM": "acs:ram::100******0719:user/Alice"
           },
           "Action": "sts:AssumeRole"
         }
       ]
     }

6. In the Create Role dialog box, configure the Role Name parameter and click OK.

Grant permissions to a role

1. Grant permissions to the RAM role.

   1. On the Roles page, find the RAM role that you created and click Grant Permission in the Actions column.

   2. In the Grant Permission panel, set the Resource Scope to Account.

      Resource Scope	Description
      Account	The permissions granted to the RAM role take effect on resources within the current Alibaba Cloud account.
      Resource Group	The permissions granted to the RAM user take effect on resources in the specified resource group.

   3. The system automatically enters the name of the current RAM role in the Principal field.

   4. In the Policy section, select System Policy, check one or more required policies, and then click Grant Permissions. Then, close the panel.

      Note

      If you want to grant, modify, or revoke the Security Token Service (STS) permissions of a RAM user, perform this step and configure the settings as required.

2. Associate the RAM user with the RAM role.

   1. In the left-side navigation pane, choose Permissions > Policies. On the Policies page, click Create Policy.

   2. On the Create Policy page, click the JSON tab.

   3. In the code editor, assign the ARN value you obtained to the Resource parameter. Specify the Action parameter as needed. Click OK.

   4. Click Optimize in the upper part. In the Optimize message, click Perform to optimize the policy.

      The system performs the following operations during the advanced optimization:

      • Split resources or conditions that are incompatible with actions.

      • Narrow down resources.

      • Deduplicate or merge policy statements.

   5. On the Create Policy page, click OK.

   6. In the Create Policy dialog box, configure the Policy Name and Description parameters and click OK.

   7. In the left-side navigation pane, choose Identities > Users.

   8. Find the RAM user you create and click Add Permissions in the Actions column.

   9. In the Policy section, select Custom Policy, check the required policies, and then click Grant Permissions.