Note：

This document describes the Cloud Access Management (CAM) feature for IM. For more information about CAM for other Tencent Cloud services, see CAM-Enabled Products.

You can easily use preset policies in the CAM console for authorization. However, preset policies only provide coarse-grained permission control and cannot be refined to IM applications and Tencent Cloud APIs. If you require refined permission control, you must create custom policies.

Custom Policy Creation Methods

The following table compares several custom policy creation methods with detailed instructions for using them.

Note：

• IM does not support custom policy creation by product feature or project.
• Manual selection indicates that you must select an object from the option list in the console.
• Syntax description indicates that the authorization policy syntax is used to describe objects.

Authorization Policy Syntax

Resource syntax descriptions

As mentioned previously, the resource granularity for IM permission management is applications. Policy syntax descriptions of applications comply with the Resource Description Method. In the following example, the developer’s root account ID is 12345678, and the developer creates three applications whose SDKAppIDs are 1400000000, 1400000001, and 1400000002 respectively.

• Policy syntax description for all IM applications

  "resource": [
  "qcs::im::uin/12345678:sdkappid/*"
  ]

• Policy syntax description for a single application

  "resource": [
  "qcs::im::uin/12345678:sdkappid/1400000001"
  ]

• Policy syntax description for multiple applications

  "resource": [
  "qcs::im::uin/12345678:sdkappid/1400000000",
  "qcs::im::uin/12345678:sdkappid/1400000001"
  ]

Action syntax descriptions

As mentioned previously, the action granularity of TRTC permission management is Tencent Cloud APIs. In the following example, Tencent Cloud APIs such as DescribeAppStatList (for obtaining the application list) and DescribeSdkAppInfo (for obtaining application information) are used.

• Policy syntax description for all Tencent Cloud APIs for IM

  "action": [
  "name/im:*"
  ]

• Policy syntax description for a single Tencent Cloud API

  "action": [
  "name/im:DescribeAppStatList"
  ]

• Policy syntax description for multiple Tencent Cloud APIs

  "action": [
  "name/im:DescribeAppStatList",
  "name/im:DescribeTrtcAppAndAccountInfo"
  ]

Custom Policy Use Example

Using the policy generator

In the following example, we will create a custom policy that allows all operations on the IM application whose SDKAppID is 1400000001.

1. Log in to the Policies page in the CAM console with the root account. Then, click Create Custom Policy.
2. Select Create by Policy Generator to go to the policy creation page.
3. In the "Select Service and Action" step:
   • Select Allow for Effect.
   • Select IM for Service.
   • Select all items for Action.
   • Enter qcs::im::uin/12345678:sdkappid/1400000001 for Resource based on the resource syntax description.
   • Condition is optional.
   • Click Add Statement. A statement that allows all operations for the IM application 1400000001 appears.
4. Continue to add another statement on the same page by configuring the following settings:
   • Select Deny for Effect.
   • Select IM for Service.
   • Select RemoveUser for Action. (You can quickly find RemoveUser with the search feature.)
   • Enter qcs::im::uin/12345678:sdkappid/1400000001 for Resource based on the resource syntax description.
   • Condition is optional.
   • Click Add Statement. A statement that rejects the RemoveUser operation for IM application 1400000001 appears.
5. Click Next and rename the policy as needed. (You can also retain the current policy name.)
6. Click Done.

The method for granting the policy to other sub-accounts is the same as Granting IM Read and Write Permissions to an Existing Sub-account.

Using the policy syntax

In the following example, we will create a custom policy that allows all operations for the IM applications whose SDKAppIDs are 1400000001 and 1400000002.

1. Log in to the Policies page in the CAM console with the root account. Then, click Create Custom Policy.
2. Select Create by Policy Syntax to go to the creation page.
3. In the Select a template type area, select Blank Template.

   Note：

   A policy template is used to create a policy by copying an existing policy (a preset or custom policy) and then modifying the policy. You can select an appropriate policy template to reduce the difficulty and workload of policy definition.

4. Click Next and rename the policy as needed. (You can also retain the current policy name.)
5. Copy and paste the following content in the Policy Content box:

   {
   "version": "2.0",
   "statement": [
     {
         "effect": "allow",
         "action": [
             "name/im:*"
         ],
         "resource": [
             "qcs::im::uin/12345678:sdkappid/1400000001",
             "qcs::im::uin/12345678:sdkappid/1400000002"
         ]
     },
     {
         "effect": "deny",
         "action": [
             "name/im:RemoveUser"
         ],
         "resource": [
             "qcs::im::uin/12345678:sdkappid/1400000001"
         ]
     }
   ]
   }

   Note：

   The policy content must comply with the CAM policy syntax logic described in Element Reference. For more information on the syntax for resource and action elements, see Resource syntax descriptions and Action syntax descriptions.

6. Click Done.
   The method for granting the policy to other sub-accounts is the same as Granting IM Read and Write Permissions to an Existing Sub-account.

Using server APIs provided by CAM

For most developers, performing permission management operations in the console can meet their business needs. However, if you need to automate and systematize your permission management capabilities, you can use server APIs.
Policy-related server APIs are included in CAM. For more information, see CAM documentation. Among these APIs, the major ones include:

• CreatePolicy
• DeletePolicy
• AttachUserPolicy
• DetachUserPolicy