Alibaba Cloud CDN:Authorize a RAM user to prefetch and refresh resources

Method 1: Attach a system policy to a RAM user

1. Log on to the RAM console by using your Alibaba Cloud account.
2. In the left-side navigation pane, choose Identities > Users.
3. On the Users page, find the RAM user to which you want to attach the custom policy, and click Add Permissions in the Actions column.
4. In the Add Permissions panel, configure the required parameters.
   
   1. In the Authorized Scope section, select Alibaba Cloud Account.
   2. Click System Policy.
   3. Enter AliyunCDN in the search box. All system policies that are related to Alibaba Cloud CDN are displayed.
   4. Click AliyunCDNFullAccess to add the policy to the Selected list.
      Note The AliyunCDNFullAcces policy grants the RAM user full permissions on Alibaba Cloud CDN. The RAM user has permissions to call CDN API operations and manage all accelerated domain names.
5. Click OK.
6. Click Complete.

Method 2: Attach a custom policy to a RAM user

Create a custom policy.

1. Log on to the RAM console by using your Alibaba Cloud account.
2. In the left-side navigation pane, choose Permissions > Policies.
3. On the Policies page, click Create Policy.
4. On the Create Policy page, click the JSON tab.
5. Enter the policy content.
   In the editor, enter the following policy content. This policy grants the RAM user permissions on the prefetch and refresh API operations. The RAM user can call API operations to prefetch or refresh resources.

   {
     "Version": "1",
     "Statement": [
       {
         "Action": [
           "cdn:PushObjectCache",
           "cdn:RefreshObjectCaches",
           "cdn:DescribeRefreshTasks",
           "cdn:DescribeRefreshQuota"
         ],
         "Resource": "acs:cdn:*:*:*",
         "Effect": "Allow"
       }
     ]
   }

   Note

   • All API operations of Alibaba Cloud CDN can be defined in custom policies. You can add other API operations to custom policies based on your business requirements. After you attach these policies to RAM users, the RAM users have permissions to call the specified API operations. For more information about the actions that you can authorize RAM users to perform, see RAM authentication.
   • The policy content must be expressed in a specific syntax structure to describe the authorized resource sets, operation sets, and authorization conditions. For more information, see Policy elements and Policy structure and syntax.
6. Click Next to edit policy information.
7. Specify the Name and Description fields.
8. Check and optimize the document of the custom policy.
   • Basic optimization

     The system automatically optimizes the policy statement. The system performs the following operations during basic optimization:

     • Deletes unnecessary conditions.
     • Deletes unnecessary arrays.
   • Optional:Advanced optimization

     You can move the pointer over Optional advanced optimize and click Perform. The system performs the following operations during the advanced optimization:

     • Splits resources or conditions that are incompatible with actions.
     • Narrows down resources.
     • Deduplicates or merges policy statements.
9. Click OK.

Grant permissions to a RAM user

1. Log on to the RAM console by using your Alibaba Cloud account.
2. In the left-side navigation pane, choose Identities > Users.
3. On the Users page, find the RAM user to which you want to attach the custom policy, and click Add Permissions in the Actions column.
4. In the Add Permissions panel, set the following parameters.
   

   Parameter	Description
   Authorized Scope	Select Alibaba Cloud Account, which specifies that the authorized scope is all resources that belong to the current Alibaba Cloud account. Do not select Specific Resource Group.
   Principal	The current RAM user is automatically selected.
   Select Policy	Click the Custom Policy tab. Enter the name of the custom policy that you created. The name of the custom policy in this example is AliyunCdnRefresh. After the system displays the policy, click its name to add it to the Selected list.

5. Click OK.
6. Click Complete.