Caution:
This document describes the Cloud Access Management (CAM) feature for IM. For more information about CAM for other Tencent Cloud services, see CAM-Enabled Products. You can easily use preset policies in the CAM console for authorization. However, preset policies only provide coarse-grained permission control and cannot be refined to IM applications and Tencent Cloud APIs. If you need refined permission control, you must create custom policies. Custom Policy Creation Methods
The table compares several custom policy creation methods with detailed instructions for using them.
|
| Policy generator | Manual selection | Syntax description | Manual selection | Medium | Medium |
| Policy syntax | Syntax description | Syntax description | Syntax description | High | High |
CAM server API | | Syntax description | Syntax description | Syntax description | High | High |
Note:
IM does not support custom policy creation by product feature or project.
Manual selection indicates that you must select an object from the option list in the console.
Authorization Policy Syntax
Resource syntax description
As mentioned previously, the resource granularity for IM permission management is applications. Policy syntax description of applications comply with the Resource Description Method. In the following example, the developer’s root account ID is 12345678, and the developer creates three applications whose SDKAppIDs are 1400000000, 1400000001, and 1400000002 respectively. Policy syntax description for all IM applications
"resource": [
"qcs::im::uin/12345678:sdkappid/*"
]
Policy syntax description for a single application
"resource": [
"qcs::im::uin/12345678:sdkappid/1400000001"
]
Policy syntax description for multiple applications
"resource": [
"qcs::im::uin/12345678:sdkappid/1400000000",
"qcs::im::uin/12345678:sdkappid/1400000001"
]
Action syntax description
As mentioned previously, the action granularity of TRTC permission management is Tencent Cloud APIs. In the following example, Tencent Cloud APIs such as DescribeAppStatList
(for obtaining the application list) and DescribeSdkAppInfo
(for obtaining application information) are used.
Policy syntax description for all Tencent Cloud APIs for IM
Policy syntax description for a single Tencent Cloud API
"action": [
"name/im:DescribeAppStatList"
]
Policy syntax description for multiple Tencent Cloud APIs
"action": [
"name/im:DescribeAppStatList",
"name/im:DescribeTrtcAppAndAccountInfo"
]
Custom Policy Usage Example
Using the policy generator
In the following example, we will create a custom policy that allows all operations on the IM application whose SDKAppID is 1400000001.
1. Log in to the Policies page in the CAM console with the root account. Then, click Create Custom Policy. 2. Select Create by Policy Generator to go to the policy creation page.
3. In the Select Service and Action step:
Select Allow for Effect.
Select IM for Service.
Select all items for Action.
Condition is optional.
Click Add Statement. A statement that allows all operations for the IM application 1400000001 appears.
4. Continue to add another statement on the same page by configuring the following settings:
Select Deny for Effect.
Select IM for Service.
Select RemoveUser
for Action. (You can quickly find RemoveUser
with the search feature.)
Condition is optional.
Click Add Statement. A statement that rejects the RemoveUser
operation for IM application 1400000001 appears.
5. Click Next and rename the policy as needed (You can also retain the current policy name).
6. Click Done.
Using the policy syntax
In the following example, we will create a custom policy that allows all operations for the IM applications whose SDKAppIDs are 1400000001 and 1400000002.
1. Log in to the Policies page in the CAM console with the root account. Then, click Create Custom Policy. 2. Select Create by Policy Syntax to go to the creation page.
3. In the Select a template type area, select Blank Template.
Note:
A policy template is used to create a policy by copying an existing policy (a preset or custom policy) and then modifying the policy. You can select an appropriate policy template to reduce the difficulty and workload of policy definition.
4. Click Next and rename the policy as needed (You can also retain the current policy name).
5. Copy and paste the following content in the Policy Content box:
{
"version": "2.0",
"statement": [
{
"effect": "allow",
"action": [
"name/im:*"
],
"resource": [
"qcs::im::uin/12345678:sdkappid/1400000001",
"qcs::im::uin/12345678:sdkappid/1400000002"
]
},
{
"effect": "deny",
"action": [
"name/im:RemoveUser"
],
"resource": [
"qcs::im::uin/12345678:sdkappid/1400000001"
]
}
]
}
Using server APIs provided by CAM
For most developers, performing permission management operations in the console can meet their business needs. However, if you need to automate and systematize your permission management capabilities, you can use server APIs.
Policy-related server APIs are included in CAM. For more information, see CAM documentation. Among these APIs, the major ones include:
Was this page helpful?