Custom Policies
notice
This document describes the management of access to TRTC. For access management of other Tencent Cloud services, see CAM-Enabled Products.
It may be convenient to use a preset policy for access management in TRTC, but with preset policies, the granularity level of permissions is low, and permission granting cannot be specific to TRTC applications or TencentCloud APIs. To perform fine-grained authorization, you need to create custom policies.
Custom Policy Creation
There are multiple ways to create a custom policy. The table below offers a comparison of different methods. For detailed directions, see the remaining part of the document.
Access | Tool | Effect | Resource | Action | Flexibility | Complexity |
Policy generator | Manual selection | Syntax conventions | Manual selection | Medium | Medium | |
Policy syntax | Syntax conventions | Syntax conventions | Syntax conventions | High | High | |
CAM server API | Syntax conventions | Syntax conventions | Syntax conventions | High | High |
explain
TRTC does not support custom policy creation by product feature or project.
Manual selection means that you can select an object from a list of candidates offered in the console.
Syntax conventions means using the permission policy syntax to describe an object.
Permission Policy Syntax
Resource syntax conventions
The granularity level of manageable resources in TRTC access management is applications. Syntax conventions of permission policies for applications are in line with the Resource Description Method. In the example below, the developer (root account ID:
12345678) has created three applications, whose SDKAppIDs are 1400000000, 1400000001, and 1400000002.Syntax convention of permission policy for all TRTC applications
"resource": ["qcs::trtc::uin/12345678:sdkappid/*"]
Syntax convention of permission policy for single TRTC applications
"resource": ["qcs::trtc::uin/12345678:sdkappid/1400000001"]
Syntax convention of permission policy for multiple TRTC applications
"resource": ["qcs::trtc::uin/12345678:sdkappid/1400000000","qcs::trtc::uin/12345678:sdkappid/1400000001"]
Action syntax conventions
The granularity level of authorizable actions in TRTC access management is TencentCloud APIs. For details, see Manageable Resources and Actions. The examples below use TencentCloud APIs such as
DescribeAppList (gets application list) and DescribeAppInfo (gets application information).Syntax convention of permission policy for all TencentCloud APIs
"action": ["name/trtc:*"]
Syntax convention of permission policy for single TencentCloud APIs
"action": ["name/trtc:DescribeAppStatList"]
Syntax convention of permission policy for multiple TencentCloud APIs
"action": ["name/trtc:DescribeAppStatList","name/trtc:DescribeTrtcAppAndAccountInfo"]
Examples of Using Custom Policies
Using the policy generator
In the example below, we create a custom policy that allows all actions under TRTC application
1400000001 except calling the server API RemoveUser.1. Go to the Policy page of the CAM console using a Tencent Cloud root account and click Create Custom Policy.
2. Select Create by Policy Generator.
3. Select the service and action.
For Effect, select Allow.
For Service, select Tencent Real-Time Communication (trtc) .
For Action, check all the items.
For Resource, enter
qcs::trtc::uin/12345678:sdkappid/1400000001, which aligns with the syntax described in Resource syntax conventions.No configuration is needed for Condition.
Click Add Statement, and a statement indicating that any action is allowed under TRTC application
1400000001 appears below.4. Add another statement on the same page.
For Effect, select Deny.
For Service, select Tencent Real-Time Communication (trtc).
For Action, select
RemoveUser. You can use the search feature to quickly locate the action.For Resource, enter
qcs::trtc::uin/12345678:sdkappid/1400000001, which aligns with the syntax described in Resource syntax conventions.No configuration is needed for Condition.
Click Add Statement, and a statement indicating that calling
RemoveUser is forbidden under TRTC application 1400000001 appears below.5. Click Next and rename the policy if necessary.
6. Click Done to complete the creation.
You can then grant the policy to other sub-accounts as described in Granting read-and-write permission to existing sub-account.
Using the policy syntax
In the example below, we create a custom policy that allows all actions under TRTC application
1400000002 and all actions but calling RemoveUser under 1400000001.1. Go to the Policy page of the CAM console using a Tencent Cloud root account and click Create Custom Policy.
2. Select Create by Policy Syntax.
3. In the Select a template type section, select Blank Template.
explain
A policy template allows you to create a policy by modifying a copy of an existing policy (preset or custom). You can choose a policy template that fits your actual conditions to reduce the complexity and workload of writing permission policies.
4. Click Next and rename the policy if necessary.
5. Enter the following content in the Policy Content box.
{"version": "2.0","statement":[{"effect": "allow","action": ["name/trtc:*"],"resource": ["qcs::trtc::uin/12345678:sdkappid/1400000001","qcs::trtc::uin/12345678:sdkappid/1400000002"]},{"effect": "deny","action": ["name/trtc:RemoveUser"],"resource": ["qcs::trtc::uin/12345678:sdkappid/1400000001"]}]}
explain
Policy content must align with the Syntax Logic. About the syntax of the resource and action elements, see Resource syntax conventions and Action syntax conventions above.
6. Click Create Policy to complete the creation.
You can then grant the policy to other sub-accounts as described in Granting read-and-write permission to existing sub-account.
Using server APIs provided by CAM
Managing access in the console can meet the business needs of most developers, but to automate and systematize your access management, you need to use server APIs.
Permission policy-related server APIs belong to CAM. For details, see CAM documentation. Only a few main APIs are listed below: