ApsaraVideo VOD:Overview

Identity authentication

You can access ApsaraVideo VOD by using the APIs or SDKs provided by ApsaraVideo VOD. The SDKs include the upload SDK, ApsaraVideo Player SDK, and short video SDK.

For each request, ApsaraVideo VOD authenticates the identity of the user and checks whether the user has the permissions to perform the operation. AccessKey pairs are used in identity authentication.

Terms

• RAM

  Resource Access Management (RAM) is an Alibaba Cloud service that allows you to manage user identities and control access to your resources. For more information, see What is RAM?

  Note

  The RAM service isolates and manages permissions rather than resources. RAM users are subordinate to Alibaba Cloud accounts and do not own actual resources. All resources belong only to Alibaba Cloud accounts. If you want to isolate resources, you can use the multi-application system of ApsaraVideo VOD. For more information, see Overview.

• Alibaba Cloud account

  The Alibaba Cloud account is the owner of Alibaba Cloud resources. The Alibaba Cloud account is charged for the usage of all resources that it owns. The Alibaba Cloud account has full control over the resources.

• RAM user

  RAM users are created in Alibaba Cloud accounts. Each RAM user of an Alibaba Cloud account has its own AccessKey pair and can perform authorized operations in the same way as the Alibaba Cloud account. A RAM user can be considered a user who has specific operation permissions.

• role

  Roles are identities to which permission policies are attached. Roles do not have logon passwords or AccessKey pairs. Roles can be assigned to a RAM user. When a RAM user is assigned a role, the permissions of the role are granted to the RAM user.

  Note

  The relationship between RAM users and their roles is similar to the relationship between individuals and their identities. For example, an individual may be assigned the roles of an employee at work and a father at home. An individual may be assigned different roles in different scenarios. If an individual is assigned a specific role, the individual is granted the permissions of that role. A role is not an operational entity. A role is a complete operational entity only after the role is assigned to a user.

  A role can be assigned to multiple users at the same time. The user who is assigned a role is automatically granted all permissions of the role.

• RAM policy

  A RAM policy is a set of permissions that are described based on the policy structure and syntax. You can configure policies to control which operations an identity can perform, on which resources, and under what conditions. You can configure RAM policies and grant specific permissions to users or user groups to control their access to the resources or services in your Alibaba Cloud account. For example, you can grant users only the permissions to upload, play, or review media resources.

For more information about the concepts of access control, see Terms.

AccessKey pair

An AccessKey pair consists of an AccessKey ID and an AccessKey secret. The AccessKey pair is used to authenticate user identities. ApsaraVideo VOD uses AccessKey pairs in symmetric encryption to authenticate user identities.

• AccessKey IDs are used to identify users.

• AccessKey secrets are used to encrypt and verify signature strings. You must keep your AccessKey secret confidential.

• An AccessKey pair consists of an AccessKey ID and an AccessKey secret.

You can use the following types of AccessKey pairs to access ApsaraVideo VOD:

• AccessKey pairs of Alibaba Cloud accounts

  AccessKey pairs of Alibaba Cloud accounts are AccessKey pairs of accounts that are used to activate ApsaraVideo VOD or accounts that are registered with Alibaba Cloud. The AccessKey pair of each Alibaba Cloud account allows full access to resources that are owned by the account. Each Alibaba Cloud account can have up to five AccessKey pairs that are in the enabled or disabled state.

  You can apply to add or delete your AccessKey pairs in the Alibaba Cloud Management Console. Each AccessKey pair may be in the enabled or disabled state. Only enabled AccessKey pairs can be used for identity authentication.

  Warning

  AccessKey pairs of Alibaba Cloud accounts allow full access to all resources and pose high risks for data leaks if the AccessKey pairs are disclosed. We recommend that you do not use the AccessKey pairs of Alibaba Cloud accounts to access ApsaraVideo VOD.

• AccessKey pairs of RAM users

  RAM is a resource access control service provided by Alibaba Cloud. The AccessKey pairs of RAM users are authorized in RAM. They can be used to access ApsaraVideo VOD resources only based on the rules defined by RAM. You can use RAM to manage users such as employees, systems, and applications, and control the permissions of users to access your resources. For example, you can use RAM to grant your users only the permissions to play videos. RAM users are subordinate to Alibaba Cloud accounts and do not own actual resources. All resources belong only to Alibaba Cloud accounts.

  You can log on to the RAM console to create RAM users, obtain AccessKey pairs, and grant permissions to the RAM users.

  Warning

  Grant only required permissions to RAM users to prevent security risks introduced by excessive permissions. For more information about how to configure fine-grained access control, see Create a custom policy.

• STS temporary AccessKey pairs

  Security Token Service (STS) is an Alibaba Cloud service that provides temporary access credentials. An STS temporary AccessKey pair is an AccessKey pair that is issued by STS and is valid for a specific period of time. STS temporary AccessKey pairs can be used to access ApsaraVideo VOD resources only based on the rules that are defined by STS and expire after the specified validity period elapses.

Comparison between the authentication methods

In addition to the preceding authentication methods, you can also use upload credentials and playback credentials to handle authorization and security issues during media upload and playback. For more information about the comparison between credentials and STS, see Comparison between credentials and STS.

System policies

ApsaraVideo VOD provides four system policies to grant permissions to RAM users or STS accounts.

Permission policies for other cloud services

The following table describes the policies that you can attach to RAM users or STS accounts based on your business requirements.