Permissions Management

Notes

As of December 30, 2024, policies will be the only way to manage VOD permissions. Policies are easy to configure and allow flexible permission settings, meeting your requirements for IAM user permissions management in different scenarios.

If you enabled VOD before December 30, 2024 and are using both roles and policies to manage VOD permissions, you can continue with the approach. For details, see Permissions Management.

To switch to the policy-only approach for VOD permissions management, submit a service ticket.

VOD Permissions

New IAM users do not have any permissions assigned by default. You need to first add them to one or more groups and then attach policies or roles to these groups. The users then inherit permissions from the groups and can perform specified operations on cloud services based on the permissions they have been assigned.

VOD is a project-level service deployed and accessed in specific physical regions. To assign permissions to a user group, specify the scope as region-specific projects and select projects for the permissions to take effect. If All projects is selected, the permissions will take effect for the user group in all region-specific projects. When accessing VOD, the users need to switch to a region where they have been authorized to use VOD.

Currently, only policies are available for fine-grained permissions management. You only need to configure policies for user groups to assign them specific permissions.

Policies: A fine-grained authorization strategy that defines permissions required to perform operations on specific cloud resources under certain conditions. This mechanism allows for more flexible policy-based authorization, meeting requirements for secure access control. For example, you can grant IAM users only the permissions for managing a certain type of VOD resources.

Table 1 lists all the system-defined policies supported by VOD.

You can configure policies for user groups to assign them permissions. For details, see Creating a User and Assigning VOD Permissions.

Table 2 lists the common operations supported by each system-defined policy of VOD. Select the policies as required.

Creating a Custom Policy

You can create a custom policy to grant granular permissions for VOD resource operations. For details, see Creating a Custom Policy.

Helpful Links

• IAM Service Overview
• Creating a User and Granting VOD Permissions

Content of the VOD FullAccess Policy

{
        "Version": "1.1",
        "Statement": [
                {
                        "Effect": "Allow",
                        "Action": [
                                "vod:*:*"
                        ]
                }
        ]
}

Content of the VOD ReadOnlyAccess Policy

{
        "Version": "1.1",
        "Statement": [
                {
                        "Effect": "Allow",
                        "Action": [
                                "vod:*:get*",
                                "vod:*:list*"
                        ]
                }
        ]
}

Content of the VOD CommonOperations Policy

{
        "Version": "1.1",
        "Statement": [
                {
                        "Effect": "Allow",
                        "Action": [
                                "vod:asset:*"
                        ]
                }
        ]
}