If system policies do not meet your business requirements, you can create custom policies. You can follow the principle of least privilege (PoLP) to create custom policies. Custom policies help you manage permissions in a fine-grained manner and improve resource access security. This topic describes custom policies for Intelligent Media Management (IMM) and provides sample custom policies.
What is a custom policy?
Resource Access Management (RAM) policies are classified into system policies and custom policies. You can manage custom policies based on your business requirements.
After you create a custom policy, you must attach the policy to a RAM user, RAM user group, or RAM role. This way, the permissions that are specified in the policy can be granted to the principal.
You can delete a RAM policy that is not attached to a principal. If the RAM policy is attached to a principal, before you can delete the RAM policy you must detach the RAM policy from the principal.
Custom policies support version control. You can manage custom policy versions based on the version management mechanism provided by RAM.
References
Scenarios and examples of custom policies
Example 1: Allow specific operations for specific projects
The following sample policy grants the user the permissions to query datasets for projects whose name starts with imm-test-doc in all supported regions:
{
"Statement": [
{
"Effect": "Allow",
"Action": ["imm:List*", "imm:Get*"],
"Resource": "acs:imm:*:150910xxxxxxxxxx:project/imm-test-doc*"
}
],
"Version": "1"
} Example 2: Allow specific operations for a project in a specific region
The following sample policy grants the user the permissions to perform the following operations:
Call the CreateFigureClusteringTask and CreateFigureClustersMergingTask operations on data in the imm-test-media-proj project in the China (Shanghai) region.
{
"Statement": [
{
"Effect": "Allow",
"Action": ["imm:CreateFigureClusteringTask", "imm:CreateFigureClustersMergingTask"],
"Resource": "acs:imm:cn-shanghai:150910xxxxxxxxxx:project/imm-test-media-proj"
}
],
"Version": "1"
}
Example 3: Allow specific operations on a specific dataset within a specific project in the designated region
The following sample policy grants the user the permissions to perform the following operations:
Call the CreateFigureClusteringTask and CreateFigureClustersMergingTask operations on the dataset1 dataset of the imm-test-media-proj project in the China (Shanghai) region.
{
"Statement": [
{
"Effect": "Allow",
"Action": ["imm:CreateFigureClusteringTask", "imm:CreateFigureClustersMergingTask"],
"Resource": "acs:imm:cn-shanghai:150910xxxxxxxxxx:project/imm-test-media-proj/dataset/dataset1"
}
],
"Version": "1"
}