RAM authorization - ApsaraVideo VOD - Alibaba Cloud ドキュメントセンター

Resource Access Management (RAM) is a service provided by Alibaba Cloud to manage user identities and resource access permissions. Using RAM helps you avoid sharing your Alibaba Cloud account keys with other users and allows you to grant users the least privilege access. RAM uses permission policies to define authorizations. This topic describes the general structure of a RAM policy, and the policy statement elements (Action, Resource, and Condition) defined by ApsaraVideo VOD for RAM permission policies. The RAM code (RamCode) for ApsaraVideo VOD is vod , and the supported authorization granularity is OPERATION .

General structure of a policy

Permission policies support JSON format with the following general structure:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

The following list describes the fields in the policy:

Version: Specifies the policy version number. It is fixed at 1.
Statement:
- Effect: Specifies the authorization result. Valid values: Allow and Deny.
- Action: Specifies one or more operations that are allowed or denied.
- Resource: Specifies the specific objects affected by the operations. You can use Alibaba Cloud Resource Names (ARNs) to describe specific resources.
- Condition: Specifies the conditions for the authorization to take effect. This field is optional.
  - Condition operator: Specifies the conditional operators. Different types of conditions support different conditional operators.
  - Condition_key: Specifies the condition keys.
  - Condition_value: Specifies the condition values.

Action

The following table lists the actions defined by ApsaraVideo VOD. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that support authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding ARN in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys that are applicable across all RAM-integrated services. For more information, see Common condition keys.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action	API	Access level	Resource type	Condition key	Dependent action
vod:GetEditingProject	GetEditingProject	get	All Resource ``	None	None
vod:DescribeVodDomainTrafficData	DescribeVodDomainTrafficData	get	All Resource ``	None	None
vod:DescribeVodEditingUsageData	DescribeVodEditingUsageData	none	All Resource ``	None	None
vod:UpdateEditingProject	UpdateEditingProject	update	All Resource ``	None	None
vod:DescribeVodPlayerMetricData	DescribeVodPlayerMetricData	none	All Resource ``	None	None
vod:DescribeVodDomainRealTimeByteHitRateData	DescribeVodDomainRealTimeByteHitRateData	get	All Resource ``	None	None
vod:ListAppPoliciesForIdentity	ListAppPoliciesForIdentity	list	All Resource ``	None	None
vod:DescribePlayVideoStatis	DescribePlayVideoStatis	get	All Resource ``	None	None
vod:GetPlayInfo	GetPlayInfo	get	All Resource ``	None	None
vod:UpdateImageInfos	UpdateImageInfos	update	All Resource ``	None	None
vod:DescribeVodDomainHitRateData	DescribeVodDomainHitRateData	get	All Resource ``	None	None
vod:DecryptKMSDataKey	DecryptKMSDataKey	get	All Resource ``	None	None
vod:ListAITemplate	ListAITemplate	list	All Resource ``	None	None
vod:SetDefaultTranscodeTemplateGroup	SetDefaultTranscodeTemplateGroup	update	All Resource ``	None	None
vod:GetDefaultAITemplate	GetDefaultAITemplate	get	All Resource ``	None	None
vod:CreateUploadImage	CreateUploadImage	create	All Resource ``	None	None
vod:ListJobInfo	ListJobInfo	get	All Resource ``	None	None
vod:UpdateWatermark	UpdateWatermark	update	All Resource ``	None	None
vod:BatchStopVodDomain	BatchStopVodDomain	update	All Resource ``	None	None
vod:DescribeVodUserDomains	DescribeVodUserDomains	get	All Resource ``	None	None
vod:GetMediaAuditResultTimeline	GetMediaAuditResultTimeline	get	All Resource ``	None	None
vod:AddVodDomain	AddVodDomain	create	All Resource ``	None	None
vod:GetDailyPlayRegionStatis	GetDailyPlayRegionStatis	get	All Resource ``	None	None
vod:DeleteEditingProject	DeleteEditingProject	delete	All Resource ``	None	None
vod:DeleteAIImageInfos	DeleteAIImageInfos	delete	All Resource ``	None	None
vod:DescribeVodStorageData	DescribeVodStorageData	get	All Resource ``	None	None
vod:UpdateVodDomain	UpdateVodDomain	update	All Resource ``	None	None
vod:DescribeVodTieringStorageRetrievalData	DescribeVodTieringStorageRetrievalData	none	All Resource ``	None	None
vod:DeleteVodSpecificConfig	DeleteVodSpecificConfig	delete	All Resource ``	None	None
vod:DescribeVodTranscodeData	DescribeVodTranscodeData	get	All Resource ``	None	None
vod:DescribeVodDomainSrcTrafficData	DescribeVodDomainSrcTrafficData	get	All Resource ``	None	None
vod:SubmitPreprocessJobs	SubmitPreprocessJobs	create	All Resource ``	None	None
vod:DescribeVodDomainLog	DescribeVodDomainLog	get	All Resource ``	None	None
vod:DescribeVodDomainMax95BpsData	DescribeVodDomainMax95BpsData	get	All Resource ``	None	None
vod:BatchStartVodDomain	BatchStartVodDomain	update	All Resource ``	None	None
vod:DescribeVodSSLCertificateList	DescribeVodSSLCertificateList	get	All Resource ``	None	None
vod:SubmitDigitalWatermarkExtractJob	SubmitDigitalWatermarkExtractJob	create	All Resource ``	None	None
vod:DescribeVodDomainRealTimeReqHitRateData	DescribeVodDomainRealTimeReqHitRateData	get	All Resource ``	None	None
vod:DescribeVodUserVipsByDomain	DescribeVodUserVipsByDomain	get	All Resource ``	None	None
vod:SetVodDomainCertificate	SetVodDomainCertificate	create	All Resource ``	None	None
vod:GetURLUploadInfos	GetURLUploadInfos	get	All Resource ``	None	None
vod:RefreshVodObjectCaches	RefreshVodObjectCaches	update	All Resource ``	None	None
vod:DescribeVodDomainCertificateInfo	DescribeVodDomainCertificateInfo	get	All Resource ``	None	None
vod:ListLiveRecordVideo	ListLiveRecordVideo	get	All Resource ``	None	None
vod:DeleteEditingProjectMaterials	DeleteEditingProjectMaterials	delete	All Resource ``	None	None
vod:DescribeVodPlayerCollectData	DescribeVodPlayerCollectData	none	All Resource ``	None	None
vod:GetAIVideoTagResult	GetAIVideoTagResult	get	All Resource ``	None	None
vod:PreloadVodObjectCaches	PreloadVodObjectCaches	update	All Resource ``	None	None
vod:DescribeVodMediaPlayData	DescribeVodMediaPlayData	none	All Resource ``	None	None
vod:ListTranscodeTask	ListTranscodeTask	list	All Resource ``	None	None
vod:DeleteImage	DeleteImage	delete	All Resource ``	None	None
vod:DescribeVodDomainBpsDataByLayer	DescribeVodDomainBpsDataByLayer	get	All Resource ``	None	None
vod:GetAIMediaAuditJob	GetAIMediaAuditJob	get	All Resource ``	None	None
vod:UpdateAppInfo	UpdateAppInfo	update	All Resource ``	None	None
vod:SetAuditSecurityIp	SetAuditSecurityIp	update	All Resource ``	None	None
vod:GenerateKMSDataKey	GenerateKMSDataKey	create	All Resource ``	None	None
vod:DeleteMultipartUpload	DeleteMultipartUpload	delete	All Resource ``	None	None
vod:DetachAppPolicyFromIdentity	DetachAppPolicyFromIdentity	update	All Resource ``	None	None
vod:DescribeMediaDistribution	DescribeMediaDistribution	list	All Resource ``	None	None
vod:SetDefaultWatermark	SetDefaultWatermark	update	All Resource ``	None	None
vod:GetMediaRefreshJobs	GetMediaRefreshJobs	list	All Resource ``	None	None
vod:ListAppInfo	ListAppInfo	list	All Resource ``	None	None
vod:DeleteStream	DeleteStream	delete	All Resource ``	None	None
vod:DeleteAppInfo	DeleteAppInfo	delete	All Resource ``	None	None
vod:DescribeVodDomainReqHitRateData	DescribeVodDomainReqHitRateData	get	All Resource ``	None	None
vod:AddVodTemplate	AddVodTemplate	create	All Resource ``	None	None
vod:GetAIImageJobs	GetAIImageJobs	list	All Resource ``	None	None
vod:GetCategories	GetCategories	list	All Resource ``	None	None
vod:GetTranscodeTask	GetTranscodeTask	get	All Resource ``	None	None
vod:AddEditingProjectMaterials	AddEditingProjectMaterials	create	All Resource ``	None	None
vod:AddAITemplate	AddAITemplate	create	All Resource ``	None	None
vod:GetTranscodeTemplateGroup	GetTranscodeTemplateGroup	get	All Resource ``	None	None
vod:DeleteMessageCallback	DeleteMessageCallback	delete	All Resource ``	None	None
vod:GetImageInfo	GetImageInfo	get	All Resource ``	None	None
vod:CreateUploadVideo	CreateUploadVideo	create	All Resource ``	None	None
vod:UploadStreamByURL	UploadStreamByURL	create	All Resource ``	None	None
vod:UpdateMediaStorageClass	UpdateMediaStorageClass	update	All Resource ``	None	None
vod:GenerateDownloadSecretKey	GenerateDownloadSecretKey	create	All Resource ``	None	None
vod:ListAuditSecurityIp	ListAuditSecurityIp	list	All Resource ``	None	None
vod:ChangeResourceGroup	ChangeResourceGroup	update	All Resource ``	None	None
vod:SearchEditingProject	SearchEditingProject	list	All Resource ``	None	None
vod:DescribeVodVerifyContent	DescribeVodVerifyContent	get	All Resource ``	None	None
vod:UpdateAITemplate	UpdateAITemplate	update	All Resource ``	None	None
vod:AddVodStorageForApp	AddVodStorageForApp	create	All Resource ``	None	None
vod:SetMessageCallback	SetMessageCallback	create	All Resource ``	None	None
vod:DescribeVodDomainRealTimeTrafficData	DescribeVodDomainRealTimeTrafficData	get	All Resource ``	None	None
vod:AddCategory	AddCategory	create	All Resource ``	None	None
vod:GetAITemplate	GetAITemplate	get	All Resource ``	None	None
vod:GetWatermark	GetWatermark	get	All Resource ``	None	None
vod:RefreshUploadVideo	RefreshUploadVideo	create	All Resource ``	None	None
vod:GetJobDetail	GetJobDetail	get	All Resource ``	None	None
vod:AttachAppPolicyToIdentity	AttachAppPolicyToIdentity	none	All Resource ``	None	None
vod:SetEditingProjectMaterials	SetEditingProjectMaterials	create	All Resource ``	None	None
vod:GetImageInfos	GetImageInfos	list	All Resource ``	None	None
vod:DescribePlayUserAvg	DescribePlayUserAvg	get	All Resource ``	None	None
vod:ListWatermark	ListWatermark	list	All Resource ``	None	None
vod:SetCrossdomainContent	SetCrossdomainContent	update	All Resource ``	None	None
vod:DescribeVodCertificateList	DescribeVodCertificateList	get	All Resource ``	None	None
vod:DescribeVodDomainConfigs	DescribeVodDomainConfigs	get	All Resource ``	None	None
vod:SubmitAIMediaAuditJob	SubmitAIMediaAuditJob	create	All Resource ``	None	None
vod:UpdateTranscodeTemplateGroup	UpdateTranscodeTemplateGroup	update	All Resource ``	None	None
vod:ListSnapshots	ListSnapshots	list	All Resource ``	None	None
vod:DescribeVodDomainRealTimeHttpCodeData	DescribeVodDomainRealTimeHttpCodeData	get	All Resource ``	None	None
vod:CancelUrlUploadJobs	CancelUrlUploadJobs	update	All Resource ``	None	None
vod:VerifyVodDomainOwner	VerifyVodDomainOwner	get	All Resource ``	None	None
vod:SubmitMediaDNADeleteJob	SubmitMediaDNADeleteJob	create	All Resource ``	None	None
vod:CreateUploadAttachedMedia	CreateUploadAttachedMedia	create	All Resource ``	None	None
vod:SubmitWorkflowJob	SubmitWorkflowJob	create	All Resource ``	None	None
vod:GetMediaDNAResult	GetMediaDNAResult	get	All Resource ``	None	None
vod:SubmitSnapshotJob	SubmitSnapshotJob	create	All Resource ``	None	None
vod:DescribeVodDomainSrcBpsData	DescribeVodDomainSrcBpsData	get	All Resource ``	None	None
vod:GetMediaAuditResultDetail	GetMediaAuditResultDetail	get	All Resource ``	None	None
vod:GetAppInfos	GetAppInfos	list	All Resource ``	None	None
vod:DeleteMezzanines	DeleteMezzanines	delete	All Resource ``	None	None
vod:DescribeVodPlayerDimensionData	DescribeVodPlayerDimensionData	none	All Resource ``	None	None
vod:DeleteTranscodeTemplateGroup	DeleteTranscodeTemplateGroup	delete	All Resource ``	None	None
vod:GetAttachedMediaInfo	GetAttachedMediaInfo	get	All Resource ``	None	None
vod:GetAuditHistory	GetAuditHistory	get	All Resource ``	None	None
vod:SearchMedia	SearchMedia	list	All Resource ``	None	None
vod:UpdateVideoInfo	UpdateVideoInfo	update	All Resource ``	None	None
vod:DescribeVodAIData	DescribeVodAIData	get	All Resource ``	None	None
vod:GetMezzanineInfo	GetMezzanineInfo	get	All Resource ``	None	None
vod:AddEditingProject	AddEditingProject	create	All Resource ``	None	None
vod:AddTranscodeTemplateGroup	AddTranscodeTemplateGroup	create	All Resource ``	None	None
vod:ListAIJob	ListAIJob	list	All Resource ``	None	None
vod:BatchSetVodDomainConfigs	BatchSetVodDomainConfigs	update	All Resource ``	None	None
vod:GetVideoInfo	GetVideoInfo	get	All Resource ``	None	None
vod:GetMediaAuditAudioResultDetail	GetMediaAuditAudioResultDetail	get	All Resource ``	None	None
vod:SetAppPlayKey	SetAppPlayKey	update	All Resource ``	None	None
vod:DescribeVodDomainRealTimeQpsData	DescribeVodDomainRealTimeQpsData	get	All Resource ``	None	None
vod:DeleteAITemplate	DeleteAITemplate	delete	All Resource ``	None	None
vod:SubmitAIJob	SubmitAIJob	create	All Resource ``	None	None
vod:DescribeVodTieringStorageData	DescribeVodTieringStorageData	none	All Resource ``	None	None
vod:DeleteVodTemplate	DeleteVodTemplate	delete	All Resource ``	None	None
vod:RestoreMedia	RestoreMedia	update	All Resource ``	None	None
vod:GetVideoInfos	GetVideoInfos	list	All Resource ``	None	None
vod:ProduceEditingProjectVideo	ProduceEditingProjectVideo	create	All Resource ``	None	None
vod:DescribeVodRefreshTasks	DescribeVodRefreshTasks	get	All Resource ``	None	None
vod:GetEditingProjectMaterials	GetEditingProjectMaterials	list	All Resource ``	None	None
vod:DescribeVodRangeDataByLocateAndIspService	DescribeVodRangeDataByLocateAndIspService	get	All Resource ``	None	None
vod:UpdateAttachedMediaInfos	UpdateAttachedMediaInfos	update	All Resource ``	None	None
vod:ListVodTemplate	ListVodTemplate	list	All Resource ``	None	None
vod:DescribeVodDomainBpsData	DescribeVodDomainBpsData	get	All Resource ``	None	None
vod:DescribePlayUserTotal	DescribePlayUserTotal	get	All Resource ``	None	None
vod:SubmitAIImageJob	SubmitAIImageJob	create	All Resource ``	None	None
vod:SetDefaultAITemplate	SetDefaultAITemplate	create	All Resource ``	None	None
vod:DescribeVodDomainDetail	DescribeVodDomainDetail	get	All Resource ``	None	None
vod:ListDynamicImage	ListDynamicImage	list	All Resource ``	None	None
vod:AddWatermark	AddWatermark	create	All Resource ``	None	None
vod:GetDigitalWatermarkExtractResult	GetDigitalWatermarkExtractResult	get	All Resource ``	None	None
vod:DescribeVodDomainUsageData	DescribeVodDomainUsageData	get	All Resource ``	None	None
vod:GetMediaAuditResult	GetMediaAuditResult	get	All Resource ``	None	None
vod:GetVideoList	GetVideoList	list	All Resource ``	None	None
vod:DescribeVodDomainRealTimeBpsData	DescribeVodDomainRealTimeBpsData	get	All Resource ``	None	None
vod:UpdateVodTemplate	UpdateVodTemplate	update	All Resource ``	None	None
vod:UploadMediaByURL	UploadMediaByURL	create	All Resource ``	None	None
vod:GetUploadDetails	GetUploadDetails	get	All Resource ``	None	None
vod:DeleteCategory	DeleteCategory	delete	All Resource ``	None	None
vod:SubmitDynamicImageJob	SubmitDynamicImageJob	create	All Resource ``	None	None
vod:SubmitTranscodeJobs	SubmitTranscodeJobs	create	All Resource ``	None	None
vod:ListAIImageInfo	ListAIImageInfo	list	All Resource ``	None	None
vod:UpdateVideoInfos	UpdateVideoInfos	update	All Resource ``	None	None
vod:DeleteWatermark	DeleteWatermark	delete	All Resource ``	None	None
vod:RefreshMediaPlayUrls	RefreshMediaPlayUrls	update	All Resource ``	None	None
vod:DescribeVodDomainRealTimeDetailData	DescribeVodDomainRealTimeDetailData	get	All Resource ``	None	None
vod:GetAppPlayKey	GetAppPlayKey	get	All Resource ``	None	None
vod:DeleteAttachedMedia	DeleteAttachedMedia	delete	All Resource ``	None	None
vod:GetVideoPlayAuth	GetVideoPlayAuth	get	All Resource ``	None	None
vod:SetVodDomainSSLCertificate	SetVodDomainSSLCertificate	update	All Resource ``	None	None
vod:BatchGetMediaInfos	BatchGetMediaInfos	get	All Resource ``	None	None
vod:RegisterMedia	RegisterMedia	create	All Resource ``	None	None
vod:ListTranscodeTemplateGroup	ListTranscodeTemplateGroup	list	All Resource ``	None	None
vod:GetTranscodeSummary	GetTranscodeSummary	get	All Resource ``	None	None
vod:MoveAppResource	MoveAppResource	update	All Resource ``	None	None
vod:DeleteVodDomain	DeleteVodDomain	delete	All Resource ``	None	None
vod:SubmitAIImageAuditJob	SubmitAIImageAuditJob	create	All Resource ``	None	None
vod:DescribeVodDomainQpsData	DescribeVodDomainQpsData	get	All Resource ``	None	None
vod:DeleteVideo	DeleteVideo	delete	All Resource ``	None	None
vod:UpdateCategory	UpdateCategory	update	All Resource ``	None	None
vod:GetVodTemplate	GetVodTemplate	get	All Resource ``	None	None
vod:CreateAudit	CreateAudit	create	All Resource ``	None	None
vod:DescribeVodRefreshQuota	DescribeVodRefreshQuota	get	All Resource ``	None	None
vod:DescribePlayTopVideos	DescribePlayTopVideos	get	All Resource ``	None	None
vod:CreateAppInfo	CreateAppInfo	create	All Resource ``	None	None
vod:DeleteDynamicImage	DeleteDynamicImage	delete	All Resource ``	None	None
vod:GetMessageCallback	GetMessageCallback	get	All Resource ``	None	None

Resource

The following table lists the resources defined by ApsaraVideo VOD. Specify them in the Resource element of RAM policy statements to grant permissions for specific operations. They are uniquely identified by ARNs. Format: acs:{#ramcode}:{#regionId}:{#accountId}:{#resourceType}:

acs: The initialism of Alibaba Cloud service, which indicates the public cloud of Alibaba Cloud.
{#ramcode}: The code used in RAM to indicate an Alibaba Cloud service.
{#regionId}: The region ID. If the resource covers all regions, set it to an asterisk (*).
{#accountId}: The ID of the Alibaba Cloud account. If the resource covers all Alibaba Cloud accounts, set it to an asterisk (*).
{#resourceType}: The service-defined resource identifier. It supports a hierarchical structure, which is similar to a file path. If the statement covers global resources, set it to an asterisk (*).

Resource type	ARN
AiTemplate	acs:vod:{#regionId}:{#accountId}:aitemplate/* acs:vod:{#regionId}:{#accountId}:aitemplate/{#TemplateId}
AppInfo	acs:vod:{#regionId}:{#accountId}:appinfo/{#AppId}
MediaRefreshJob	acs:vod::{#accountId}:MediaRefreshJob/
UrlUploadJob	acs:vod:{#regionId}:{#accountId}:urluploadjob/{#UrlUploadJobId}
Storage	acs:vod:{#regionId}:{#accountId}:storage/{#StorageLocation}
EditingProject	acs:vod:{#regionId}:{#accountId}:editingproject/{#EditingProjectId}
Image	acs:vod:{#regionId}:{#accountId}:Image/*

Condition

ApsaraVideo VOD does not define product-level condition keys. However, you can use Alibaba Cloud common condition keys for access control. For more information, see Common condition keys.

How to create custom RAM policies?

You can create custom policies and grant them to RAM users, RAM user groups, or RAM roles. For instructions, see: