Grant RAM users the minimum permissions needed to use AI Search Open Platform. - OpenSearch

If multiple users in your enterprise need to access the same services, create RAM users and grant only the minimum permissions required. This avoids sharing your Alibaba Cloud account password or AccessKey.

Use cases

Create RAM users and grant the minimum required permissions in these scenarios:

A RAM user calls AI Search Open Platform services through an API or SDK. The user authenticates with anAccessKey.
A RAM user uses the AI Search Open Platform console. Common scenarios include:
- Creating a workspace and activating AI Search Open Platform.
- Managing API keys.
  
  Important
  In AI Search Open Platform, API keys are scoped to a specific workspace. A RAM user with a valid API key for a workspace can call all services in that workspace through an API or SDK without separate RAM authorization.
- Using the Experience Center to try services such as document parsing and document chunking.
- Performing an evaluation on a RAG chain.

Permission policies

System policies

Alibaba Cloud provides and maintains two system policies for AI Search Open Platform. You can use but not modify them:

AliyunOpenSearchFullAccess: Grants full access to OpenSearch services. Includes all permissions in the Permission list. Assign with caution.
AliyunOpenSearchReadOnlyAccess: Grants read-only access to OpenSearch services. Includes all List and Describe control API permissions, and all traffic API permissions in the Permission list.

Custom policies

Create custom policies for fine-grained permissions.

Permission list

Control API permissions

Category	API	RAM action	Resource	Description
Workspace	`CreateWorkspace`	`searchplat:WriteWorkspace`	`workspaces/*`	Creates a workspace and activates AI Search Open Platform. Note AI Search Open Platform is free to activate. You are not charged until you use services.
	`UpdateWorkspace`	`searchplat:WriteWorkspace`	`workspaces/{workspaceName}`	Modifies a workspace.
	`GetWorkspace`	`searchplat:DescribeWorkspace`	`workspaces/{workspaceName}`	Gets the details of a workspace.
	`ListWorkspaces`	`searchplat:ListWorkspaces`	`workspaces/*`	Lists workspaces.
	`ListServices`	`searchplat:ListServices`	`workspaces/{workspaceName}`	Lists services.
Access credential	`CreateCredentials`	`searchplat:WriteCredentials`	`workspaces/{workspaceName}`	Creates an access credential.
	`DeleteCredentials`	`searchplat:WriteCredentials`	`workspaces/{workspaceName}`	Deletes an access credential.
	`UpdateCredentials`	`searchplat:WriteCredentials`	`workspaces/{workspaceName}`	Modifies an access credential.
	`GetCredentials`	`searchplat:DescribeCredentials`	`workspaces/{workspaceName}`	Gets the details of an access credential.
	`ListCredentials`	`searchplat:DescribeCredentials`	`workspaces/{workspaceName}`	Lists access credentials.
Remaining free quota	`GetMeasure`	`searchplat:DescribeMeasure`	`workspaces/{workspaceName}`	Gets the remaining free quota for a workspace. Note After activation, each Alibaba Cloud account receives 10 free service calls. The free quota is shared between the Alibaba Cloud account and its RAM users. Click Activate Now to try the model service. After the 10 free calls are used, charges apply based on model service usage.
Experience data	`CreateExperienceData`	`searchplat:WriteExperienceData`	`workspaces/{workspaceName}`	Adds experience data.
	`DeleteExperienceData`	`searchplat:WriteExperienceData`	`workspaces/{workspaceName}`	Deletes experience data.
	`GetExperienceData`	`searchplat:DescribeExperienceData`	`workspaces/{workspaceName}`	Gets the details of experience data.
	`ListExperienceData`	`searchplat:DescribeExperienceData`	`workspaces/{workspaceName}`	Lists experience data.
Asynchronous task	`CreateAsyncTask`	`searchplat:WriteAsyncTask`	`workspaces/{workspaceName}`	Creates an asynchronous document parsing task.
	`GetAsyncTask`	`searchplat:DescribeAsyncTask`	`workspaces/{workspaceName}`	Gets asynchronous document parsing task details.
	`ListAsyncTasks`	`searchplat:DescribeAsyncTask`	`workspaces/{workspaceName}`	Lists asynchronous document parsing tasks.
Evaluation	`CreateRagEvaluatorTask`	`searchplat:WriteEvaluation`	`workspaces/{workspaceName}`	Creates an evaluation task.
	`GetRagEvaluatorTask`	`searchplat:DescribeEvaluation`	`workspaces/{workspaceName}`	Gets the details of an evaluation task.
	`ListRagEvaluatorTasks`	`searchplat:DescribeEvaluation`	`workspaces/{workspaceName}`	Lists evaluation tasks.
	`DeleteRagEvaluatorTask`	`searchplat:WriteEvaluation`	`workspaces/{workspaceName}`	Deletes an evaluation task.
Model service	`CreateFunctionInstance`	`searchplat:WriteFunction`	`workspaces/{workspaceName}`	Creates a service or model.
	`CreateFunctionTask`		`workspaces/{workspaceName}`	Activates the service configuration immediately.
	`UpdateFunctionInstance`		`workspaces/{workspaceName}`	Modifies the service or model configuration.
	`DeleteFunctionInstance`		`workspaces/{workspaceName}`	Deletes the service or model configuration.
	`ListFunctionInstances`	`searchplat:DescribeFunction`	`workspaces/{workspaceName}`	Lists service or model configurations.
	`GetFunctionInstance`	`searchplat:DescribeFunction`	`workspaces/{workspaceName}`	Gets the details of a service or model configuration.
	`GetTableFields`	`searchplat:GetTableFields`	`workspaces/{workspaceName}`	Gets the schema of a MaxCompute table.
	`CeaseFunctionInstance`	`searchplat:CeaseFunctionInstance`	`workspaces/{workspaceName}`	Stops a service.
	`ResumeFunctionInstance`	`searchplat:ResumeFunctionInstance`	`workspaces/{workspaceName}`	Resumes a service.
Model service - Service deployment	`ListFunctionRestrictions`	`searchplat:ListFunctionRestrictions`	`workspaces/{workspaceName}`	Gets function restrictions: available deployment regions, model categories, model types, and models.

Traffic API permissions

API	RAM action	Resource	Description
`GetTextEmbedding`	`searchplat:GetTextEmbedding`	`workspaces/{workspaceName}`	Text embedding service.
`GetTextSparseEmbedding`	`searchplat:GetTextSparseEmbedding`	`workspaces/{workspaceName}`	Text sparse embedding service.
`CreateDocumentAnalyzeTask`	`searchplat:CreateDocumentAnalyzeTask`	`workspaces/{workspaceName}`	Creates an asynchronous document analysis request.
`DescribeDocumentAnalyzeTask`	`searchplat:DescribeDocumentAnalyzeTask`	`workspaces/{workspaceName}`	Gets the result of an asynchronous document analysis request.
`GetDocumentAnalysis`	`searchplat:GetDocumentAnalysis`	`workspaces/{workspaceName}`	Gets the result of a synchronous document analysis request.
`CreateImageAnalyzeTask`	`searchplat:CreateImageAnalyzeTask`	`workspaces/{workspaceName}`	Creates an asynchronous image analysis request.
`DescribeImageAnalyzeTask`	`searchplat:DescribeImageAnalyzeTask`	`workspaces/{workspaceName}`	Gets the result of an asynchronous image analysis request.
`GetImageAnalysis`	`searchplat:GetImageAnalysis`	`workspaces/{workspaceName}`	Gets the result of a synchronous image analysis request.
`GetDocumentSplit`	`searchplat:GetDocumentSplit`	`workspaces/{workspaceName}`	Document chunking service.
`GetDocumentRank`	`searchplat:GetDocumentRank`	`workspaces/{workspaceName}`	Re-ranking service.
`GetTextGeneration`	`searchplat:GetTextGeneration`	`workspaces/{workspaceName}`	Content generation (LLM) service.
`GetQueryAnalysis`	`searchplat:GetQueryAnalysis`	`workspaces/{workspaceName}`	Query analysis service.
`GetEmbeddingTuning`	`searchplat:GetEmbeddingTuning`	`workspaces/{workspaceName}`	Embedding fine-tuning service.
`GetWebSearch`	`searchplat:SearchWeb`	`workspaces/{workspaceName}`	Web search service.
`GetMultiModalEmbedding`	`searchplat:GetMultiModalEmbedding`	`workspaces/{workspaceName}`	Multimodal embedding service.
`CreateVideoSnapshotTask`	`searchplat:CreateVideoSnapshotTask`	`workspaces/{workspaceName}`	Creates an asynchronous video frame extraction task.
`GetVideoSnapshotTaskStatus`	`searchplat:DescribeVideoSnapshotTask`	`workspaces/{workspaceName}`	Gets the status of a video frame extraction task.
`CreateAudioAsrTask`	`searchplat:CreateAudioAsrTask`	`workspaces/{workspaceName}`	Creates an asynchronous audio transcription task.
`GetAudioAsrTaskStatus`	`searchplat:DescribeAudioAsrTask`	`workspaces/{workspaceName}`	Gets the status of an asynchronous audio transcription task.
`GetImageObjectDetection`	`searchplat:GetImageObjectDetection`	`workspaces/{workspaceName}`	Image object detection service.
`GetMultiModalReranker`	`searchplat:GetMultiModalReranker`	`workspaces/{workspaceName}`	Multimodal re-ranking service.
`CreateVideoSummarizationTask`	`searchplat:CreateVideoSummarizationTask`	`workspaces/{workspaceName}`	Creates an asynchronous video summarization task.
`GetVideoSummarizationTaskStatus`	`searchplat:DescribeVideoSummarizationTask`	`workspaces/{workspaceName}`	Gets the status of a video summarization task.
`CreateVideoSegmentationTask`	`searchplat:CreateVideoSegmentationTask`	`workspaces/{workspaceName}`	Creates an asynchronous video segmentation task.
`GetVideoSegmentationTaskStatus`	`searchplat:DescribeVideoSegmentationTask`	`workspaces/{workspaceName}`	Gets the status of a video segmentation task.

Procedure

Step 1: Create a RAM user

A RAM user is a physical identity that has a fixed ID and credential information. A RAM user represents a person or an application. A RAM user has the following characteristics:

A RAM user can be created by an Alibaba Cloud account. In this case, the RAM user belongs to the Alibaba Cloud account. A RAM user can also be created by a RAM user or a RAM role that has administrative rights. In this case, the RAM user belongs to the Alibaba Cloud account that creates the RAM user or the RAM role.
A RAM user does not own resources. Resource usage fees of the RAM user are billed to the Alibaba Cloud account to which the RAM user belongs. A RAM user does not receive individual bills and cannot make payments.
Before RAM users can log on to the Alibaba Cloud Management Console or call operations, they must be authorized by Alibaba Cloud accounts. After RAM users are authorized, the RAM users can access resources that are owned by the Alibaba Cloud accounts.
RAM users have independent passwords or AccessKey pairs for logon.
An Alibaba Cloud account can create multiple RAM users. RAM users can be used to represent employees, systems, and applications within an enterprise.

For instructions, see Create a RAM user.

Step 2: Create a custom permission policy

See Examples of minimum required permissions, select the required permissions from the Permission list, and combine them into a custom policy. For instructions, see Create a custom policy.

Step 3: Authorize the RAM user

Assign a system or custom policy to the RAM user. Grant only the permissions required for the user's tasks. For instructions, see Grant permissions to a RAM user.

Note

Permission changes take effect in about 5 minutes.

Examples of minimum required permissions

Example 1: Allows a RAM user to list workspaces, check the remaining free quota, and call the document chunking service in the default workspace.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "searchplat:ListWorkspaces",
            "Resource": "acs:searchplat:*:*:workspaces/*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "searchplat:DescribeWorkspace",
                "searchplat:GetDocumentSplit",
                "searchplat:DescribeMeasure"
            ],
            "Resource": "acs:searchplat:*:*:workspaces/default"
        }
    ]
}

Example 2: Allows a RAM user to list workspaces, check the remaining free quota, manage API keys, and call the document chunking service in the default workspace.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "searchplat:ListWorkspaces"
            ],
            "Resource": "acs:searchplat:*:*:workspaces/*"
        },
        {
            "Effect": "Allow",
           "Action": [
                "searchplat:DescribeWorkspace",
                "searchplat:WriteCredentials",
                "searchplat:GetDocumentSplit",
                "searchplat:DescribeCredentials",
                "searchplat:DescribeMeasure"
            ],
            "Resource": "acs:searchplat:*:*:workspaces/default"
        }
    ]
}