Grant RAM users the minimum permissions needed to use AI Search Open Platform. - OpenSearch

Create RAM users and grant only the minimum permissions required to avoid sharing your Alibaba Cloud account password or AccessKey across your organization.

Use cases

Create RAM users and grant minimum permissions in these scenarios:

A RAM user calls AI Search Open Platform services through an API or SDK. The user authenticates with anAccessKey.
A RAM user uses the AI Search Open Platform console. Common scenarios include:
- Creating a workspace and activating AI Search Open Platform.
- Managing API keys.
  
  Important
  In AI Search Open Platform, API keys are scoped to a specific workspace. A RAM user with a valid API key for a workspace can call all services in that workspace through an API or SDK without separate RAM authorization.
- Using the Service overview to try services such as document parsing and document chunking.
- Performing an evaluation on a RAG chain.

Permission policies

System policies

Alibaba Cloud provides and maintains two system policies for AI Search Open Platform. You can use but not modify them:

AliyunOpenSearchFullAccess: Grants full access to OpenSearch services. Includes all permissions in the Permission list. Assign with caution.
AliyunOpenSearchReadOnlyAccess: Grants read-only access to OpenSearch services. Includes all List and Describe control API permissions, and all traffic API permissions in the Permission list.

Custom policies

Create custom policies for fine-grained access control.

Permission list

Control API permissions

Category	API	RAM action	Resource	Description
Workspace	`CreateWorkspace`	`searchplat:WriteWorkspace`	`workspaces/*`	Creates a workspace and activates AI Search Open Platform. Note AI Search Open Platform is free to activate. You are not charged until you use services.
	`UpdateWorkspace`	`searchplat:WriteWorkspace`	`workspaces/{workspaceName}`	Modifies a workspace.
	`GetWorkspace`	`searchplat:DescribeWorkspace`	`workspaces/{workspaceName}`	Gets the details of a workspace.
	`ListWorkspaces`	`searchplat:ListWorkspaces`	`workspaces/*`	Lists workspaces.
	`ListServices`	`searchplat:ListServices`	`workspaces/{workspaceName}`	Lists services.
Access credential	`CreateCredentials`	`searchplat:WriteCredentials`	`workspaces/{workspaceName}`	Creates an access credential.
	`DeleteCredentials`	`searchplat:WriteCredentials`	`workspaces/{workspaceName}`	Deletes an access credential.
	`UpdateCredentials`	`searchplat:WriteCredentials`	`workspaces/{workspaceName}`	Modifies an access credential.
	`GetCredentials`	`searchplat:DescribeCredentials`	`workspaces/{workspaceName}`	Gets the details of an access credential.
	`ListCredentials`	`searchplat:DescribeCredentials`	`workspaces/{workspaceName}`	Lists access credentials.
Remaining free quota	`GetMeasure`	`searchplat:DescribeMeasure`	`workspaces/{workspaceName}`	Gets the remaining free quota for a workspace. Note After activation, each Alibaba Cloud account receives 10 free service calls. The free quota is shared between the Alibaba Cloud account and its RAM users. Click Activate Now to try the model service. After the 10 free calls are used, charges apply based on model service usage.
Experience data	`CreateExperienceData`	`searchplat:WriteExperienceData`	`workspaces/{workspaceName}`	Adds experience data.
	`DeleteExperienceData`	`searchplat:WriteExperienceData`	`workspaces/{workspaceName}`	Deletes experience data.
	`GetExperienceData`	`searchplat:DescribeExperienceData`	`workspaces/{workspaceName}`	Gets the details of experience data.
	`ListExperienceData`	`searchplat:DescribeExperienceData`	`workspaces/{workspaceName}`	Lists experience data.
Asynchronous task	`CreateAsyncTask`	`searchplat:WriteAsyncTask`	`workspaces/{workspaceName}`	Creates an asynchronous document parsing task.
	`GetAsyncTask`	`searchplat:DescribeAsyncTask`	`workspaces/{workspaceName}`	Gets asynchronous document parsing task details.
	`ListAsyncTasks`	`searchplat:DescribeAsyncTask`	`workspaces/{workspaceName}`	Lists asynchronous document parsing tasks.
Evaluation	`CreateRagEvaluatorTask`	`searchplat:WriteEvaluation`	`workspaces/{workspaceName}`	Creates an evaluation task.
	`GetRagEvaluatorTask`	`searchplat:DescribeEvaluation`	`workspaces/{workspaceName}`	Gets the details of an evaluation task.
	`ListRagEvaluatorTasks`	`searchplat:DescribeEvaluation`	`workspaces/{workspaceName}`	Lists evaluation tasks.
	`DeleteRagEvaluatorTask`	`searchplat:WriteEvaluation`	`workspaces/{workspaceName}`	Deletes an evaluation task.
Model service	`CreateFunctionInstance`	`searchplat:WriteFunction`	`workspaces/{workspaceName}`	Creates a service or model.
	`CreateFunctionTask`		`workspaces/{workspaceName}`	Activates the service configuration immediately.
	`UpdateFunctionInstance`		`workspaces/{workspaceName}`	Modifies the service or model configuration.
	`DeleteFunctionInstance`		`workspaces/{workspaceName}`	Deletes the service or model configuration.
	`ListFunctionInstances`	`searchplat:DescribeFunction`	`workspaces/{workspaceName}`	Lists service or model configurations.
	`GetFunctionInstance`	`searchplat:DescribeFunction`	`workspaces/{workspaceName}`	Gets the details of a service or model configuration.
	`GetTableFields`	`searchplat:GetTableFields`	`workspaces/{workspaceName}`	Gets the schema of a MaxCompute table.
	`CeaseFunctionInstance`	`searchplat:CeaseFunctionInstance`	`workspaces/{workspaceName}`	Stops a service.
	`ResumeFunctionInstance`	`searchplat:ResumeFunctionInstance`	`workspaces/{workspaceName}`	Resumes a service.
Model service - Service deployment	`ListFunctionRestrictions`	`searchplat:ListFunctionRestrictions`	`workspaces/{workspaceName}`	Gets function restrictions: available deployment regions, model categories, model types, and models.

Traffic API permissions

API	RAM action	Resource	Description
`GetTextEmbedding`	`searchplat:GetTextEmbedding`	`workspaces/{workspaceName}`	Text embedding service.
`GetTextSparseEmbedding`	`searchplat:GetTextSparseEmbedding`	`workspaces/{workspaceName}`	Text sparse embedding service.
`CreateDocumentAnalyzeTask`	`searchplat:CreateDocumentAnalyzeTask`	`workspaces/{workspaceName}`	Creates an asynchronous document analysis request.
`DescribeDocumentAnalyzeTask`	`searchplat:DescribeDocumentAnalyzeTask`	`workspaces/{workspaceName}`	Gets the result of an asynchronous document analysis request.
`GetDocumentAnalysis`	`searchplat:GetDocumentAnalysis`	`workspaces/{workspaceName}`	Gets the result of a synchronous document analysis request.
`CreateImageAnalyzeTask`	`searchplat:CreateImageAnalyzeTask`	`workspaces/{workspaceName}`	Creates an asynchronous image analysis request.
`DescribeImageAnalyzeTask`	`searchplat:DescribeImageAnalyzeTask`	`workspaces/{workspaceName}`	Gets the result of an asynchronous image analysis request.
`GetImageAnalysis`	`searchplat:GetImageAnalysis`	`workspaces/{workspaceName}`	Gets the result of a synchronous image analysis request.
`GetDocumentSplit`	`searchplat:GetDocumentSplit`	`workspaces/{workspaceName}`	Document chunking service.
`GetDocumentRank`	`searchplat:GetDocumentRank`	`workspaces/{workspaceName}`	Re-ranking service.
`GetTextGeneration`	`searchplat:GetTextGeneration`	`workspaces/{workspaceName}`	Content generation (LLM) service.
`GetQueryAnalysis`	`searchplat:GetQueryAnalysis`	`workspaces/{workspaceName}`	Query analysis service.
`GetEmbeddingTuning`	`searchplat:GetEmbeddingTuning`	`workspaces/{workspaceName}`	Embedding fine-tuning service.
`GetWebSearch`	`searchplat:SearchWeb`	`workspaces/{workspaceName}`	Web search service.
`GetMultiModalEmbedding`	`searchplat:GetMultiModalEmbedding`	`workspaces/{workspaceName}`	Multimodal embedding service.
`CreateVideoSnapshotTask`	`searchplat:CreateVideoSnapshotTask`	`workspaces/{workspaceName}`	Creates an asynchronous video frame extraction task.
`GetVideoSnapshotTaskStatus`	`searchplat:DescribeVideoSnapshotTask`	`workspaces/{workspaceName}`	Gets the status of a video frame extraction task.
`CreateAudioAsrTask`	`searchplat:CreateAudioAsrTask`	`workspaces/{workspaceName}`	Creates an asynchronous audio transcription task.
`GetAudioAsrTaskStatus`	`searchplat:DescribeAudioAsrTask`	`workspaces/{workspaceName}`	Gets the status of an asynchronous audio transcription task.
`GetImageObjectDetection`	`searchplat:GetImageObjectDetection`	`workspaces/{workspaceName}`	Image object detection service.
`GetMultiModalReranker`	`searchplat:GetMultiModalReranker`	`workspaces/{workspaceName}`	Multimodal re-ranking service.
`CreateVideoSummarizationTask`	`searchplat:CreateVideoSummarizationTask`	`workspaces/{workspaceName}`	Creates an asynchronous video summarization task.
`GetVideoSummarizationTaskStatus`	`searchplat:DescribeVideoSummarizationTask`	`workspaces/{workspaceName}`	Gets the status of a video summarization task.
`CreateVideoSegmentationTask`	`searchplat:CreateVideoSegmentationTask`	`workspaces/{workspaceName}`	Creates an asynchronous video segmentation task.
`GetVideoSegmentationTaskStatus`	`searchplat:DescribeVideoSegmentationTask`	`workspaces/{workspaceName}`	Gets the status of a video segmentation task.

Procedure

Step 1: Create a RAM user

A RAM user is a physical identity with a fixed ID and credentials, representing a person or an application. Key characteristics:

A RAM user can be created by an Alibaba Cloud account, or by a RAM user or RAM role with administrative rights. In either case, the created RAM user belongs to the Alibaba Cloud account of the creator.
A RAM user does not own resources. All usage fees are billed to the parent Alibaba Cloud account. RAM users cannot receive bills or make payments.
RAM users must be authorized before they can log on to the console or call API operations. After authorization, they can access resources owned by the parent Alibaba Cloud account.
RAM users have independent passwords or AccessKey pairs for logon.
An Alibaba Cloud account can create multiple RAM users to represent employees, systems, and applications.

For instructions, see Create a RAM user.

Step 2: Create a custom permission policy

See Examples of minimum required permissions, select the required permissions from the Permission list, and combine them into a custom policy. For instructions, see Create a custom policy.

Step 3: Authorize the RAM user

Attach a system or custom policy to the RAM user. Grant only the permissions required for the user's tasks. For instructions, see Manage RAM user permissions.

Note

Permission changes take effect in about 5 minutes.

Examples of minimum required permissions

Example 1: Allow a RAM user to list workspaces, check the remaining free quota, and call the document chunking service in the default workspace.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "searchplat:ListWorkspaces",
            "Resource": "acs:searchplat:*:*:workspaces/*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "searchplat:DescribeWorkspace",
                "searchplat:GetDocumentSplit",
                "searchplat:DescribeMeasure"
            ],
            "Resource": "acs:searchplat:*:*:workspaces/default"
        }
    ]
}

Example 2: Allow a RAM user to list workspaces, check the remaining free quota, manage API keys, and call the document chunking service in the default workspace.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "searchplat:ListWorkspaces"
            ],
            "Resource": "acs:searchplat:*:*:workspaces/*"
        },
        {
            "Effect": "Allow",
           "Action": [
                "searchplat:DescribeWorkspace",
                "searchplat:WriteCredentials",
                "searchplat:GetDocumentSplit",
                "searchplat:DescribeCredentials",
                "searchplat:DescribeMeasure"
            ],
            "Resource": "acs:searchplat:*:*:workspaces/default"
        }
    ]
}