Service role for ApsaraVideo VOD

To use ApsaraVideo VOD, you must create the service role AliyunVODDefaultRole and attach the AliyunVODRolePolicy policy. You can also view and delete AliyunVODDefaultRole as needed.

Background information

A service role is a Resource Access Management (RAM) role that an Alibaba Cloud service assumes to access your resources in other Alibaba Cloud services. For more information, see RAM role overview.

ApsaraVideo VOD provides the following service role and system policy:

Service role: AliyunVODDefaultRole
System policy: AliyunVODRolePolicy

Scenarios

AliyunVODDefaultRole allows ApsaraVideo VOD to access and manage your resources in Object Storage Service (OSS), Message Service (MNS), Alibaba Cloud CDN, and Key Management Service (KMS).

Create a service role

When you activate ApsaraVideo VOD, the system automatically creates AliyunVODDefaultRole and grants it the necessary permissions.

If you accidentally delete AliyunVODDefaultRole and features become unavailable, go to the Resource Access Authorization page to recreate the role and grant the required permissions.

AliyunVODDefaultRole includes the system policy AliyunVODRolePolicy. You cannot modify this system policy, but you can attach other access policies to the role.

Expand to view the AliyunVODRolePolicy policy document

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "oss:PutBucketLifecycle",
                "oss:PutBucketNotification",
                "oss:DeleteBucketNotification",
                "oss:GetBucket",
                "oss:GetBucketLocation",
                "oss:GetBucketAcl",
                "oss:PutBucketAcl",
                "oss:GetObjectAcl",
                "oss:PutObjectAcl",
                "oss:GetObject",
                "oss:PutObject",
                "oss:MultipartUpload",
                "oss:InitiateMultipartUpload",
                "oss:UploadPart",
                "oss:UploadPartCopy",
                "oss:CompleteMultipartUpload",
                "oss:AbortMultipartUpload",
                "oss:ListMultipartUploads",
                "oss:ListParts",
                "oss:CopyObject",
                "oss:AppendObject",
                "oss:GetObjectMeta",
                "oss:PutSymlink",
                "oss:GetSymlink",
                "oss:HeadObject",
                "oss:ListBuckets",
                "oss:PutBucketWebsite",
                "oss:PutBucketcors",
                "oss:GetBucketcors",
                "oss:GetBucketLifecycle",
                "oss:ListObjects",
                "oss:DeleteObject",
                "oss:DeleteMultipleObjects",
                "oss:GetBucketTransferAcceleration",
                "oss:PutBucketTransferAcceleration"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "mns:PublishMessage",
                "mns:SendMessage"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "cdn:DescribeDomainsBySource",
                "cdn:DescribeCdnDomainDetail",
                "cdn:DescribeDomainConfigs"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "kms:Decrypt",
                "kms:GenerateDataKey",
                "kms:Encrypt",
                "kms:DescribeKey"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "vod:GetPlayInfo",
                "vod:GetVideoConfig",
                "vod:GetDRMLicense",
                "vod:GetDRMCertInfo"
            ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

View the service role

After the service role is created, you can go to the of the RAM console and search for AliyunVODDefaultRole to view the role details.

Basic information

The Basic Information section displays the role name, creation time, Alibaba Cloud Resource Name (ARN), and description.
Access policies

On the Permission Management tab, click a policy name to view the policy document and the resources that the role can access.
Trust policy

On the Trust Policy tab, view the trust policy document. A trust policy defines the trusted entities of a RAM role. The trusted entity of a service role is an Alibaba Cloud service, which you can identify from the Service field in the trust policy.

For more information, see View a RAM role.

Delete the service role

Important

If you delete AliyunVODDefaultRole, ApsaraVideo VOD may not function correctly. Delete this role with caution.

If you no longer need ApsaraVideo VOD, delete the service role in the RAM console. For more information, see Delete a RAM role.