Skip to main content

Alibaba Cloud RAM Setup for CCLEE OSS

For site admins | About 10 minutes Least privilege: the policy only allows writing/deleting objects in one bucket β€” nothing else in the account is touched

This guide is written for Alibaba Cloud International accounts (alibabacloud.com). On a China-site account (aliyun.com)? The steps are identical β€” use ram.console.aliyun.com (Chinese UI) instead.

Before You Start​

  1. An existing bucket. If you don't have one, create it in the OSS console and set read/write permission to public-read; note the bucket name and region
  2. Access to the RAM console at ram.console.alibabacloud.com

Step 1: Create a Policy​

RAM console β†’ Permissions β†’ Policies β†’ Create Policy β†’ switch to the JSON tab, paste the JSON below, and replace both <bucket> placeholders with your bucket name:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["oss:PutObject", "oss:DeleteObject"],
      "Resource": [
        "acs:oss:*:*:<bucket>",
        "acs:oss:*:*:<bucket>/*"
      ]
    }
  ]
}

Click through to the basic info screen, name it cclee-oss-minimal, and save.

If a "policy optimization" prompt appears, don't worry: the JSON may look different, the permissions are unchanged. Prefer a visual editor? Select Object Storage OSS as the service, check the PutObject and DeleteObject actions, and add the two ARNs above as resources β€” everything else is the same.

Step 2: Create a User and Generate an AccessKey​

  1. RAM console β†’ Identities β†’ Users β†’ Create User
  2. Logon name: cclee-oss; for access mode select OpenAPI only (no console sign-in)
  3. Save the AccessKey ID and Secret immediately after creation β€” the Secret is shown only once

Step 3: Grant the Permission​

Users list β†’ find cclee-oss β†’ Add Permissions in the actions column β†’ scope Alibaba Cloud account β†’ Custom Policy tab β†’ check cclee-oss-minimal β†’ confirm.

Step 4: Fill in the Plugin​

WordPress admin β†’ Settings β†’ CCLEE OSS, fill in:

SettingValue
Access Key ID / SecretThe keys saved in Step 2
BucketYour bucket name
EndpointThe public endpoint of the bucket's region, e.g. oss-ap-southeast-1.aliyuncs.com (Singapore)
CDN DomainOptional; leave empty to use the bucket's public domain

Save, then upload a test image β€” if the frontend image URL points to your OSS domain, everything works.