Note:This document describes the management of access to TRTC. For access management of other Tencent Cloud services, see CAM-Enabled Products.
It may be convenient to use a preset policy for access management in TRTC, but with preset policies, the granularity level of permissions is low, and permission granting cannot be specific to TRTC applications or TencentCloud APIs. To perform fine-grained authorization, you need to create custom policies.
There are multiple ways to create a custom policy. The table below offers a comparison of different methods. For detailed directions, see the remaining part of the document.
Access | Tool | Effect | Resource | Action | Flexibility | Complexity |
---|---|---|---|---|---|---|
CAM console | Policy generator | Manual selection | Syntax conventions | Manual selection | Medium | Medium |
CAM console | Policy syntax | Syntax conventions | Syntax conventions | Syntax conventions | High | High |
CAM server API | CreatePolicy | Syntax conventions | Syntax conventions | Syntax conventions | High | High |
Note:
- TRTC does not support custom policy creation by product feature or project.
- Manual selection means that you can select an object from a list of candidates offered in the console.
- Syntax conventions means using the permission policy syntax to describe an object.
The granularity level of manageable resources in TRTC access management is applications. Syntax conventions of permission policies for applications are in line with the Resource Description Method. In the example below, the developer (root account ID: 12345678
) has created three applications, whose SDKAppIDs
are 1400000000
, 1400000001
, and 1400000002
.
Syntax convention of permission policy for all TRTC applications
"resource": [
"qcs::trtc::uin/12345678:sdkappid/*"
]
Syntax convention of permission policy for single TRTC applications
"resource": [
"qcs::trtc::uin/12345678:sdkappid/1400000001"
]
Syntax convention of permission policy for multiple TRTC applications
"resource": [
"qcs::trtc::uin/12345678:sdkappid/1400000000",
"qcs::trtc::uin/12345678:sdkappid/1400000001"
]
The granularity level of authorizable actions in TRTC access management is TencentCloud APIs. For details, see Manageable Resources and Actions. The examples below use TencentCloud APIs such as DescribeAppList
(gets application list) and DescribeAppInfo
(gets application information).
Syntax convention of permission policy for all TencentCloud APIs
"action": [
"name/trtc:*"
]
Syntax convention of permission policy for single TencentCloud APIs
"action": [
"name/trtc:DescribeAppStatList"
]
Syntax convention of permission policy for multiple TencentCloud APIs
"action": [
"name/trtc:DescribeAppStatList",
"name/trtc:DescribeTrtcAppAndAccountInfo"
]
In the example below, we create a custom policy that allows all actions under TRTC application 1400000001
except calling the server API RemoveUser
.
qcs::trtc::uin/12345678:sdkappid/1400000001
, which aligns with the syntax described in Resource syntax conventions.1400000001
appears below.RemoveUser
. You can use the search feature to quickly locate the action.qcs::trtc::uin/12345678:sdkappid/1400000001
, which aligns with the syntax described in Resource syntax conventions.RemoveUser
is forbidden under TRTC application 1400000001
appears below.You can then grant the policy to other sub-accounts as described in Granting read-and-write permission to existing sub-account.
In the example below, we create a custom policy that allows all actions under TRTC application 1400000002
and all actions but calling RemoveUser
under 1400000001
.
Go to the Policy page of the CAM console using a Tencent Cloud root account and click Create Custom Policy.
Select Create by Policy Syntax.
In the Select a template type section, select Blank Template.
Note:A policy template allows you to create a policy by modifying a copy of an existing policy (preset or custom). You can choose a policy template that fits your actual conditions to reduce the complexity and workload of writing permission policies.
Click Next and rename the policy if necessary.
Enter the following content in the Policy Content box.
{
"version": "2.0",
"statement":[
{
"effect": "allow",
"action": [
"name/trtc:*"
],
"resource": [
"qcs::trtc::uin/12345678:sdkappid/1400000001",
"qcs::trtc::uin/12345678:sdkappid/1400000002"
]
},
{
"effect": "deny",
"action": [
"name/trtc:RemoveUser"
],
"resource": [
"qcs::trtc::uin/12345678:sdkappid/1400000001"
]
}
]
}
Note:Policy content must align with the Syntax Logic. About the syntax of the resource and action elements, see Resource syntax conventions and Action syntax conventions above.
6. Click Create Policy to complete the creation.
You can then grant the policy to other sub-accounts as described in Granting read-and-write permission to existing sub-account.
Managing access in the console can meet the business needs of most developers, but to automate and systematize your access management, you need to use server APIs.
Permission policy-related server APIs belong to CAM. For details, see CAM documentation. Only a few main APIs are listed below:
Was this page helpful?