tencent cloud

PrevNext

Feedback

search by keyword

Recent Pages

Documentation
Tencent Real-Time Communication
    Documentation
    Download PDF

    Custom Policies

    Last updated: 2023-10-08 16:05:09
    Download PDF
      notice
      This document describes the management of access to TRTC. For access management of other Tencent Cloud services, see CAM-Enabled Products.
      It may be convenient to use a preset policy for access management in TRTC, but with preset policies, the granularity level of permissions is low, and permission granting cannot be specific to TRTC applications or TencentCloud APIs. To perform fine-grained authorization, you need to create custom policies.

      Custom Policy Creation

      There are multiple ways to create a custom policy. The table below offers a comparison of different methods. For detailed directions, see the remaining part of the document.
      Access
      Tool
      Effect
      Resource
      Action
      Flexibility
      Complexity
      Policy generator
      Manual selection
      Syntax conventions
      Manual selection
      Medium
      Medium
      Policy syntax
      Syntax conventions
      Syntax conventions
      Syntax conventions
      High
      High
      CAM server API
      Syntax conventions
      Syntax conventions
      Syntax conventions
      High
      High
      
      explain
      TRTC does not support custom policy creation by product feature or project.
      Manual selection means that you can select an object from a list of candidates offered in the console.
      Syntax conventions means using the permission policy syntax to describe an object.
      

      Permission Policy Syntax

      Resource syntax conventions

      The granularity level of manageable resources in TRTC access management is applications. Syntax conventions of permission policies for applications are in line with the Resource Description Method. In the example below, the developer (root account ID: 12345678) has created three applications, whose SDKAppIDs are 1400000000, 1400000001, and 1400000002.
      Syntax convention of permission policy for all TRTC applications
      "resource": [
        "qcs::trtc::uin/12345678:sdkappid/*"
      ]
      Syntax convention of permission policy for single TRTC applications
      "resource": [
        "qcs::trtc::uin/12345678:sdkappid/1400000001"
      ]
      Syntax convention of permission policy for multiple TRTC applications
      "resource": [
        "qcs::trtc::uin/12345678:sdkappid/1400000000",
        "qcs::trtc::uin/12345678:sdkappid/1400000001"
      ]
      

      Action syntax conventions

      The granularity level of authorizable actions in TRTC access management is TencentCloud APIs. For details, see Manageable Resources and Actions. The examples below use TencentCloud APIs such as DescribeAppList (gets application list) and DescribeAppInfo (gets application information).
      Syntax convention of permission policy for all TencentCloud APIs
      "action": [
        "name/trtc:*"
      ]
      Syntax convention of permission policy for single TencentCloud APIs
      "action": [
        "name/trtc:DescribeAppStatList"
      ]
      Syntax convention of permission policy for multiple TencentCloud APIs
      "action": [
        "name/trtc:DescribeAppStatList",
        "name/trtc:DescribeTrtcAppAndAccountInfo"
      ]

      Examples of Using Custom Policies

      Using the policy generator

      In the example below, we create a custom policy that allows all actions under TRTC application 1400000001 except calling the server API RemoveUser.
      1. Go to the Policy page of the CAM console using a Tencent Cloud root account and click Create Custom Policy.
      2. Select Create by Policy Generator.
      3. Select the service and action.
      For Effect, select Allow.
      For Service, select Tencent Real-Time Communication (trtc) .
      For Action, check all the items.
      For Resource, enter qcs::trtc::uin/12345678:sdkappid/1400000001, which aligns with the syntax described in Resource syntax conventions.
      No configuration is needed for Condition.
      Click Add Statement, and a statement indicating that any action is allowed under TRTC application 1400000001 appears below.
      4. Add another statement on the same page.
      For Effect, select Deny.
      For Service, select Tencent Real-Time Communication (trtc).
      For Action, select RemoveUser. You can use the search feature to quickly locate the action.
      For Resource, enter qcs::trtc::uin/12345678:sdkappid/1400000001, which aligns with the syntax described in Resource syntax conventions.
      No configuration is needed for Condition.
      Click Add Statement, and a statement indicating that calling RemoveUser is forbidden under TRTC application 1400000001 appears below.
      5. Click Next and rename the policy if necessary.
      6. Click Done to complete the creation.
      You can then grant the policy to other sub-accounts as described in Granting read-and-write permission to existing sub-account.

      Using the policy syntax

      In the example below, we create a custom policy that allows all actions under TRTC application 1400000002 and all actions but calling RemoveUser under 1400000001.
      1. Go to the Policy page of the CAM console using a Tencent Cloud root account and click Create Custom Policy.
      2. Select Create by Policy Syntax.
      3. In the Select a template type section, select Blank Template.
      explain
      A policy template allows you to create a policy by modifying a copy of an existing policy (preset or custom). You can choose a policy template that fits your actual conditions to reduce the complexity and workload of writing permission policies.
      4. Click Next and rename the policy if necessary.
      5. Enter the following content in the Policy Content box.
      {
       "version": "2.0",
       "statement":[
           {
               "effect": "allow",
               "action": [
                   "name/trtc:*"
               ],
               "resource": [
                   "qcs::trtc::uin/12345678:sdkappid/1400000001",
                   "qcs::trtc::uin/12345678:sdkappid/1400000002"
               ]
           },
           {
               "effect": "deny",
               "action": [
                   "name/trtc:RemoveUser"
               ],
               "resource": [
                   "qcs::trtc::uin/12345678:sdkappid/1400000001"
               ]
           }
       ]
      }
      explain
      Policy content must align with the Syntax Logic. About the syntax of the resource and action elements, see Resource syntax conventions and Action syntax conventions above.
      6. Click Create Policy to complete the creation.
      You can then grant the policy to other sub-accounts as described in Granting read-and-write permission to existing sub-account.

      Using server APIs provided by CAM

      Managing access in the console can meet the business needs of most developers, but to automate and systematize your access management, you need to use server APIs. Permission policy-related server APIs belong to CAM. For details, see CAM documentation. Only a few main APIs are listed below:
      CreatePolicy
      DeletePolicy
      AttachUserPolicy
      DetachUserPolicy
      Contact Us

      Contact our sales team or business advisors to help your business.

      Contact Us
      Technical Support

      Open a ticket if you're looking for further assistance. Our Ticket is 7x24 avaliable.

      Submit a Ticket
      7x24 Phone Support
      Copyright © 2013-2024 Tencent Cloud. All Rights Reserved.
      Privacy PolicyLegalCookie Policy