OpenSearch:Create RAM users and grant permissions

Usage scenarios

The following two scenarios require creating RAM users and granting them the minimum permissions needed for business operations:

• When RAM users call the search development console service via API/SDK, use AccessKey for caller identity authentication.

• When RAM users use the search development console via OpenSearch, common scenarios include:

  • Granting RAM users the permission to manage API Keys.

    Important

    In the OpenSearch search development console, API Keys exist in independent workspaces. If a RAM user obtains an API Key for a workspace (and the API Key is enabled), and then configures the API Key in the code that calls the service, the user can call all services under the workspace via API/SDK without needing separate authorization.

  • Granting RAM users the permission to quickly experience services such as document parsing and slicing through the Experience Center.

  • Granting RAM users the permission to evaluate the effectiveness of the RAG chain via evaluation task management.

Permission policies

System permission policies

System permission policies are created uniformly by Alibaba Cloud. Users can only use them and cannot modify them. The version updates of the policies are maintained by Alibaba Cloud. The OpenSearch search development console provides the following two system permission policies:

• AliyunOpenSearchFullAccess: Permission to manage OpenSearch services. This permission policy includes all permissions in the permission point list. Grant this permission policy to RAM users with caution.

• AliyunOpenSearchReadOnlyAccess: Grants read-only access to the OpenSearch service. This policy includes all the control API permissions (List, Describe) for read operations and all permissions within the traffic API permissions list, as detailed in the permission points list.

Custom permission policies

Create custom permission policies to achieve fine-grained permission management.

Permission point list

Control API permission list

Traffic API permission list

Steps

Step 1: Create RAM user

A RAM user is a physical identity that has a fixed ID and credential information. A RAM user represents a person or an application. A RAM user has the following characteristics:

• A RAM user can be created by an Alibaba Cloud account. In this case, the RAM user belongs to the Alibaba Cloud account. A RAM user can also be created by a RAM user or a RAM role that has administrative rights. In this case, the RAM user belongs to the Alibaba Cloud account that creates the RAM user or the RAM role.

• A RAM user does not own resources. Resource usage fees of the RAM user are billed to the Alibaba Cloud account to which the RAM user belongs. A RAM user does not receive individual bills and cannot make payments.

• Before RAM users can log on to the Alibaba Cloud Management Console or call operations, they must be authorized by Alibaba Cloud accounts. After RAM users are authorized, the RAM users can access resources that are owned by the Alibaba Cloud accounts.

• RAM users have independent passwords or AccessKey pairs for logon.

• An Alibaba Cloud account can create multiple RAM users. RAM users can be used to represent employees, systems, and applications within an enterprise.

For more information, see Create RAM user.

Step 2: Create custom permission policy

Refer to common minimum permission combination examples, select permission points from the permission point list to combine into a business minimum permission policy. For more information on creating custom authorization policies, see Create custom permission policy.

Step 3: Authorize RAM user

After granting RAM users the system policy or custom policy of RAM, RAM users can access Alibaba Cloud resources with the corresponding permissions in the policy. It is recommended to follow the principle of minimum permissions and grant RAM users the necessary permissions as needed. For more information on authorization, see Authorize RAM user.

Common minimum permission combination examples

Example 1: Allow RAM users to view the workspace list, view the remaining free service quota, and call the document slicing service in the default space. The corresponding authorization policy is as follows:

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "searchplat:ListWorkspaces",
            "Resource": "acs:searchplat:*:*:workspaces/*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "searchplat:DescribeWorkspace",
                "searchplat:GetDocumentSplit",
                "searchplat:DescribeMeasure"
            ],
            "Resource": "acs:searchplat:*:*:workspaces/default"
        }
    ]
}

Example 2: Allow RAM users to view the workspace list, view the remaining free service quota, manage API Keys in the default space, and call the document slicing service.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "searchplat:ListWorkspaces"
            ],
            "Resource": "acs:searchplat:*:*:workspaces/*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "searchplat:DescribeWorkspace",
                "searchplat:WriteCredentials",
                "searchplat:GetDocumentSplit",
                "searchplat:DescribeCredentials",
                "searchplat:DescribeMeasure"
            ],
            "Resource": "acs:searchplat:*:*:workspaces/default"
        }
    ]
}