視覺智能開放平臺自定義權(quán)限策略參考
如果系統(tǒng)權(quán)限策略不能滿足您的要求，您可以創(chuàng)建自定義權(quán)限策略實現(xiàn)最小授權(quán)。使用自定義權(quán)限策略有助于實現(xiàn)權(quán)限的精細化管控，是提升資源訪問安全的有效手段。本文介紹視覺智能開放平臺使用自定義權(quán)限策略的場景和策略示例。
什么是自定義權(quán)限策略
在基于RAM的訪問控制體系中，自定義權(quán)限策略是指在系統(tǒng)權(quán)限策略之外，您可以自主創(chuàng)建、更新和刪除的權(quán)限策略。自定義權(quán)限策略的版本更新需由您來維護。
創(chuàng)建自定義權(quán)限策略后，需為RAM用戶、用戶組或RAM角色綁定權(quán)限策略，這些RAM身份才能獲得權(quán)限策略中指定的訪問權(quán)限。
已創(chuàng)建的權(quán)限策略支持刪除，但刪除前需確保該策略未被引用。如果該權(quán)限策略已被引用，您需要在該權(quán)限策略的引用記錄中移除授權(quán)。
自定義權(quán)限策略支持版本控制，您可以按照RAM規(guī)定的版本管理機制來管理您創(chuàng)建的自定義權(quán)限策略版本。
操作文檔
常見自定義權(quán)限策略場景及示例
全部權(quán)限
方式一：直接授予用戶系統(tǒng)權(quán)限策略AliyunVIAPIFullAccess（管理視覺智能API的權(quán)限）。
方式二：自定義權(quán)限。擁有視覺智能所有能力的全部權(quán)限，policy定義如下所示。
{ "Version": "1", "Statement": [ { "Action": [ "viapi-imageenhan:*", "viapi-imagerecog:*", "viapi-imageseg:*", "viapi-ocr:*", "viapi-facebody:*", "viapi-objectdet:*", "viapi-imageaudit:*", "viapi-goodstech:*", "viapi-imgsearch:*", "viapi-videorecog:*", "viapi-videoenhan:*", "viapi-videoseg:*", "viapi-imageprocess:*", "viapi-regen:*", "viapi:*" ], "Resource": "*", "Effect": "Allow" }, { "Action": "ram:PassRole", "Resource": "*", "Effect": "Allow", "Condition": { "StringEquals": { "acs:Service": "viapi.aliyuncs.com" } } } ] }
單個或多個API限制
如果您希望限制RAM用戶只能調(diào)用單個或多個API，可以通過自定義策略實現(xiàn)。
例如，以下策略限制只能調(diào)用RecognizeBankCard和CompareFace。其他能力類似，參考能力開通，找到相關(guān)類目英文名Product和相關(guān)能力英文名Action，在Statement的Action下面增加viapi-<Product>:<Action>即可。
{
"Version": "1",
"Statement": [
{
"Action": [
"viapi-ocr:RecognizeBankCard",
"viapi-facebody:CompareFace"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": "ram:PassRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"acs:Service": "viapi.aliyuncs.com"
}
}
}
]
}IP/SSL限制
支持帶IP/SSL限制的授權(quán)。該授權(quán)策略在滿足以下兩個條件時可以訪問所有資源。
RAM用戶當(dāng)前的IP網(wǎng)段為42.120.XX.X/24。
RAM用戶正在使用HTTPS訪問阿里云控制臺或OpenAPI。
{
"Statement": [
{
"Effect": "Allow",
"Action": "viapi-imageenhan:*",
"Resource": "acs:viapi-imageenhan:*:*:*",
"Condition": {
"IpAddress": {
"acs:SourceIp": "42.120.99.0/24"
},
"Bool": {
"acs:SecureTransport": "true"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-imagerecog:*",
"Resource": "acs:viapi-imagerecog:*:*:*",
"Condition": {
"IpAddress": {
"acs:SourceIp": "42.120.99.0/24"
},
"Bool": {
"acs:SecureTransport": "true"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-imageseg:*",
"Resource": "acs:viapi-imageseg:*:*:*",
"Condition": {
"IpAddress": {
"acs:SourceIp": "42.120.99.0/24"
},
"Bool": {
"acs:SecureTransport": "true"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-imageaudit:*",
"Resource": "acs:viapi-imageaudit:*:*:*",
"Condition": {
"IpAddress": {
"acs:SourceIp": "42.120.99.0/24"
},
"Bool": {
"acs:SecureTransport": "true"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-ocr:*",
"Resource": "acs:viapi-ocr:*:*:*",
"Condition": {
"IpAddress": {
"acs:SourceIp": "42.120.99.0/24"
},
"Bool": {
"acs:SecureTransport": "true"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-facebody:*",
"Resource": "acs:viapi-facebody:*:*:*",
"Condition": {
"IpAddress": {
"acs:SourceIp": "42.120.99.0/24"
},
"Bool": {
"acs:SecureTransport": "true"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-objectdet:*",
"Resource": "acs:viapi-objectdet:*:*:*",
"Condition": {
"IpAddress": {
"acs:SourceIp": "42.120.99.0/24"
},
"Bool": {
"acs:SecureTransport": "true"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-goodstech:*",
"Resource": "acs:viapi-goodstech:*:*:*",
"Condition": {
"IpAddress": {
"acs:SourceIp": "42.120.99.0/24"
},
"Bool": {
"acs:SecureTransport": "true"
}
}
}
],
"Version": "1"
}
時間限制
以下授權(quán)策略的含義為：在北京時間2019年09月25日下午12:30之前，RAM用戶擁有viapi的所有權(quán)限。
{
"Statement": [
{
"Effect": "Allow",
"Action": "viapi-imageenhan:*",
"Resource": "acs:viapi-imageenhan:*:*:*",
"Condition": {
"DateLessThan": {
"acs:CurrentTime": "2019-09-25T12:30:00+08:00"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-imagerecog:*",
"Resource": "acs:viapi-imagerecog:*:*:*",
"Condition": {
"DateLessThan": {
"acs:CurrentTime": "2019-09-25T12:30:00+08:00"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-imageseg:*",
"Resource": "acs:viapi-imageseg:*:*:*",
"Condition": {
"DateLessThan": {
"acs:CurrentTime": "2019-09-25T12:30:00+08:00"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-imageaudit:*",
"Resource": "acs:viapi-imageaudit:*:*:*",
"Condition": {
"DateLessThan": {
"acs:CurrentTime": "2019-09-25T12:30:00+08:00"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-ocr:*",
"Resource": "acs:viapi-ocr:*:*:*",
"Condition": {
"DateLessThan": {
"acs:CurrentTime": "2019-09-25T12:30:00+08:00"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-facebody:*",
"Resource": "acs:viapi-facebody:*:*:*",
"Condition": {
"DateLessThan": {
"acs:CurrentTime": "2019-09-25T12:30:00+08:00"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-objectdet:*",
"Resource": "acs:viapi-objectdet:*:*:*",
"Condition": {
"DateLessThan": {
"acs:CurrentTime": "2019-09-25T12:30:00+08:00"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-goodstech:*",
"Resource": "acs:viapi-goodstech:*:*:*",
"Condition": {
"DateLessThan": {
"acs:CurrentTime": "2019-09-25T12:30:00+08:00"
}
}
}
],
"Version": "1"
}
MFA
如果一個RAM用戶僅被授予該授權(quán)策略，那么只有當(dāng)該RAM用戶啟用MFA并使用MFA登錄時，才具有viapi的權(quán)限。此RAM用戶的AK也沒有權(quán)限，需要使用AK+正確的MFA六位Code調(diào)用STS服務(wù)獲取一個臨時AK（15分鐘失效），此臨時AK才具有相應(yīng)的權(quán)限。
{
"Statement": [
{
"Effect": "Allow",
"Action": "viapi-imageenhan:*",
"Resource": "acs:viapi-imageenhan:*:*:*",
"Condition": {
"Bool": {
"acs:MFAPresent": "true"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-imagerecog:*",
"Resource": "acs:viapi-imagerecog:*:*:*",
"Condition": {
"Bool": {
"acs:MFAPresent": "true"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-imageseg:*",
"Resource": "acs:viapi-imageseg:*:*:*",
"Condition": {
"Bool": {
"acs:MFAPresent": "true"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-imageaudit:*",
"Resource": "acs:viapi-imageaudit:*:*:*",
"Condition": {
"Bool": {
"acs:MFAPresent": "true"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-ocr:*",
"Resource": "acs:viapi-ocr:*:*:*",
"Condition": {
"Bool": {
"acs:MFAPresent": "true"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-facebody:*",
"Resource": "acs:viapi-facebody:*:*:*",
"Condition": {
"Bool": {
"acs:MFAPresent": "true"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-objectdet:*",
"Resource": "acs:viapi-objectdet:*:*:*",
"Condition": {
"Bool": {
"acs:MFAPresent": "true"
}
}
},
{
"Effect": "Allow",
"Action": "viapi-goodstech:*",
"Resource": "acs:viapi-goodstech:*:*:*",
"Condition": {
"Bool": {
"acs:MFAPresent": "true"
}
}
}
],
"Version": "1"
}
文檔內(nèi)容是否對您有幫助？