tencent cloud

PrevNext

Feedback

search by keyword

Recent Pages

Documentation
Chat
    Documentation
    Download PDF

    Custom Policy

    Last updated: 2024-02-07 17:33:32
    Download PDF
      Caution:
      This document describes the Cloud Access Management (CAM) feature for IM. For more information about CAM for other Tencent Cloud services, see CAM-Enabled Products.
      You can easily use preset policies in the CAM console for authorization. However, preset policies only provide coarse-grained permission control and cannot be refined to IM applications and Tencent Cloud APIs. If you need refined permission control, you must create custom policies.

      Custom Policy Creation Methods

      The table compares several custom policy creation methods with detailed instructions for using them.
      Entry
      Method
      Effect
      Resource
      Action
      Flexibility
      Difficulty
      Policy generator
      Manual selection
      Syntax description
      Manual selection
      Medium
      Medium
      Policy syntax
      Syntax description
      Syntax description
      Syntax description
      High
      High
      CAM server API
      Syntax description
      Syntax description
      Syntax description
      High
      High
      
      Note:
      IM does not support custom policy creation by product feature or project.
      Manual selection indicates that you must select an object from the option list in the console.
      Syntax description indicates that the authorization policy syntax is used to describe objects.

      Authorization Policy Syntax

      Resource syntax description

      As mentioned previously, the resource granularity for IM permission management is applications. Policy syntax description of applications comply with the Resource Description Method. In the following example, the developer’s root account ID is 12345678, and the developer creates three applications whose SDKAppIDs are 1400000000, 1400000001, and 1400000002 respectively.
      Policy syntax description for all IM applications
      "resource": [
      "qcs::im::uin/12345678:sdkappid/*"
      ]
      Policy syntax description for a single application
      "resource": [
      "qcs::im::uin/12345678:sdkappid/1400000001"
      ]
      Policy syntax description for multiple applications
      "resource": [
      "qcs::im::uin/12345678:sdkappid/1400000000",
      "qcs::im::uin/12345678:sdkappid/1400000001"
      ]

      Action syntax description

      As mentioned previously, the action granularity of TRTC permission management is Tencent Cloud APIs. In the following example, Tencent Cloud APIs such as DescribeAppStatList (for obtaining the application list) and DescribeSdkAppInfo (for obtaining application information) are used.
      Policy syntax description for all Tencent Cloud APIs for IM
      "action": [
      "name/im:*"
      ]
      Policy syntax description for a single Tencent Cloud API
      "action": [
      "name/im:DescribeAppStatList"
      ]
      Policy syntax description for multiple Tencent Cloud APIs
      "action": [
      "name/im:DescribeAppStatList",
      "name/im:DescribeTrtcAppAndAccountInfo"
      ]

      Custom Policy Usage Example

      Using the policy generator

      In the following example, we will create a custom policy that allows all operations on the IM application whose SDKAppID is 1400000001.
      1. Log in to the Policies page in the CAM console with the root account. Then, click Create Custom Policy.
      2. Select Create by Policy Generator to go to the policy creation page.
      3. In the Select Service and Action step:
      Select Allow for Effect.
      Select IM for Service.
      Select all items for Action.
      Enter qcs::im::uin/12345678:sdkappid/1400000001 for Resource based on the resource syntax description.
      Condition is optional.
      Click Add Statement. A statement that allows all operations for the IM application 1400000001 appears.
      4. Continue to add another statement on the same page by configuring the following settings:
      Select Deny for Effect.
      Select IM for Service.
      Select RemoveUser for Action. (You can quickly find RemoveUser with the search feature.)
      Enter qcs::im::uin/12345678:sdkappid/1400000001 for Resource based on the resource syntax description.
      Condition is optional.
      Click Add Statement. A statement that rejects the RemoveUser operation for IM application 1400000001 appears.
      5. Click Next and rename the policy as needed (You can also retain the current policy name).
      6. Click Done.
      The method for granting the policy to other sub-accounts is the same as Granting IM Permissions to an Existing Sub-account.

      Using the policy syntax

      In the following example, we will create a custom policy that allows all operations for the IM applications whose SDKAppIDs are 1400000001 and 1400000002.
      1. Log in to the Policies page in the CAM console with the root account. Then, click Create Custom Policy.
      2. Select Create by Policy Syntax to go to the creation page.
      3. In the Select a template type area, select Blank Template.
      Note:
      A policy template is used to create a policy by copying an existing policy (a preset or custom policy) and then modifying the policy. You can select an appropriate policy template to reduce the difficulty and workload of policy definition.
      4. Click Next and rename the policy as needed (You can also retain the current policy name).
      5. Copy and paste the following content in the Policy Content box:
      {
       "version": "2.0",
       "statement": [
        {
            "effect": "allow",
            "action": [
                "name/im:*"
            ],
            "resource": [
                "qcs::im::uin/12345678:sdkappid/1400000001",
                "qcs::im::uin/12345678:sdkappid/1400000002"
            ]
        },
        {
            "effect": "deny",
            "action": [
                "name/im:RemoveUser"
            ],
            "resource": [
                "qcs::im::uin/12345678:sdkappid/1400000001"
            ]
        }
       ]
      }
      Note:
      The policy content must comply with the CAM policy syntax logic described in Element Reference. For more information on the syntax for resource and action elements, see Resource syntax description and Action syntax description.
      6. Click Done. The method for granting the policy to other sub-accounts is the same as Granting IM Permissions to an Existing Sub-account.

      Using server APIs provided by CAM

      For most developers, performing permission management operations in the console can meet their business needs. However, if you need to automate and systematize your permission management capabilities, you can use server APIs. Policy-related server APIs are included in CAM. For more information, see CAM documentation. Among these APIs, the major ones include:
      CreatePolicy
      DeletePolicy
      AttachUserPolicy
      DetachUserPolicy
      Contact Us

      Contact our sales team or business advisors to help your business.

      Contact Us
      Technical Support

      Open a ticket if you're looking for further assistance. Our Ticket is 7x24 avaliable.

      Submit a Ticket
      7x24 Phone Support
      Copyright © 2013-2024 Tencent Cloud. All Rights Reserved.
      Privacy PolicyLegalCookie Policy