Note:This document describes the Cloud Access Management (CAM) feature for IM. For more information about CAM for other Tencent Cloud services, see CAM-Enabled Products.
You can easily use preset policies in the CAM console for authorization. However, preset policies only provide coarse-grained permission control and cannot be refined to IM applications and Tencent Cloud APIs. If you need refined permission control, you must create custom policies.
The table compares several custom policy creation methods with detailed instructions for using them.
Entry | Method | Effect | Resource | Action | Flexibility | Difficulty |
---|---|---|---|---|---|---|
CAM console | Policy generator | Manual selection | Syntax description | Manual selection | Medium | Medium |
CAM console | Policy syntax | Syntax description | Syntax description | Syntax description | High | High |
CAM server API | CreatePolicy | Syntax description | Syntax description | Syntax description | High | High |
Note:
- IM does not support custom policy creation by product feature or project.
- Manual selection indicates that you must select an object from the option list in the console.
- Syntax description indicates that the authorization policy syntax is used to describe objects.
As mentioned previously, the resource granularity for IM permission management is applications. Policy syntax description of applications comply with the Resource Description Method. In the following example, the developer’s root account ID is 12345678, and the developer creates three applications whose SDKAppIDs are 1400000000, 1400000001, and 1400000002 respectively.
Policy syntax description for all IM applications
"resource": [
"qcs::im::uin/12345678:sdkappid/*"
]
Policy syntax description for a single application
"resource": [
"qcs::im::uin/12345678:sdkappid/1400000001"
]
Policy syntax description for multiple applications
"resource": [
"qcs::im::uin/12345678:sdkappid/1400000000",
"qcs::im::uin/12345678:sdkappid/1400000001"
]
As mentioned previously, the action granularity of TRTC permission management is Tencent Cloud APIs. In the following example, Tencent Cloud APIs such as DescribeAppStatList
(for obtaining the application list) and DescribeSdkAppInfo
(for obtaining application information) are used.
Policy syntax description for all Tencent Cloud APIs for IM
"action": [
"name/im:*"
]
Policy syntax description for a single Tencent Cloud API
"action": [
"name/im:DescribeAppStatList"
]
Policy syntax description for multiple Tencent Cloud APIs
"action": [
"name/im:DescribeAppStatList",
"name/im:DescribeTrtcAppAndAccountInfo"
]
In the following example, we will create a custom policy that allows all operations on the IM application whose SDKAppID is 1400000001.
qcs::im::uin/12345678:sdkappid/1400000001
for Resource based on the resource syntax description.RemoveUser
for Action. (You can quickly find RemoveUser
with the search feature.)qcs::im::uin/12345678:sdkappid/1400000001
for Resource based on the resource syntax description.RemoveUser
operation for IM application 1400000001 appears.The method for granting the policy to other sub-accounts is the same as Granting IM Permissions to an Existing Sub-account.
In the following example, we will create a custom policy that allows all operations for the IM applications whose SDKAppIDs are 1400000001 and 1400000002.
Note:A policy template is used to create a policy by copying an existing policy (a preset or custom policy) and then modifying the policy. You can select an appropriate policy template to reduce the difficulty and workload of policy definition.
{
"version": "2.0",
"statement": [
{
"effect": "allow",
"action": [
"name/im:*"
],
"resource": [
"qcs::im::uin/12345678:sdkappid/1400000001",
"qcs::im::uin/12345678:sdkappid/1400000002"
]
},
{
"effect": "deny",
"action": [
"name/im:RemoveUser"
],
"resource": [
"qcs::im::uin/12345678:sdkappid/1400000001"
]
}
]
}
Note:The policy content must comply with the CAM policy syntax logic described in Element Reference. For more information on the syntax for resource and action elements, see Resource syntax description and Action syntax description.
6. Click Done.
The method for granting the policy to other sub-accounts is the same as Granting IM Permissions to an Existing Sub-account.
For most developers, performing permission management operations in the console can meet their business needs. However, if you need to automate and systematize your permission management capabilities, you can use server APIs.
Policy-related server APIs are included in CAM. For more information, see CAM documentation. Among these APIs, the major ones include:
Was this page helpful?