更新时间:2024-04-30 GMT+08:00
配置IAM权限
- 使用华为云主帐号创建一个开发者用户组user_group,将开发者帐号加入用户组user_group中。具体操作请参见Step1 创建用户组并加入用户。
- 创建自定义策略。
- 使用华为云主帐号登录控制台,单击右上角用户名,在下拉框中选择“统一身份认证”,进入IAM服务。
- 在统一身份认证服务控制台的左侧菜单栏中,选择“创建自定义策略”,“策略名称”为“Policy1”,策略配置方式选择JSON视图,输入策略内容,单击“确定”。 。单击右上角
- 自定义策略“Policy1”的具体内容如下,可以直接复制粘贴。
{ "Version": "1.1", "Statement": [ { "Action": [ "modelarts:*:*" ], "Effect": "Allow" }, { "Action": [ "modelarts:pool:create", "modelarts:pool:update", "modelarts:pool:delete" ], "Effect": "Deny" }, { "Action": [ "sfsturbo:*:*", "vpc:*:*", "dss:*:get", "dss:*:list" ], "Effect": "Allow" }, { "Action": [ "ecs:*:*", "evs:*:get", "evs:*:list", "evs:volumes:create", "evs:volumes:delete", "evs:volumes:attach", "evs:volumes:detach", "evs:volumes:manage", "evs:volumes:update", "evs:volumes:use", "evs:volumes:uploadImage", "evs:snapshots:create", "vpc:*:get", "vpc:*:list", "vpc:networks:create", "vpc:networks:update", "vpc:subnets:update", "vpc:subnets:create", "vpc:ports:*", "vpc:routers:get", "vpc:routers:update", "vpc:securityGroups:*", "vpc:securityGroupRules:*", "vpc:floatingIps:*", "vpc:publicIps:*", "ims:images:create", "ims:images:delete", "ims:images:get", "ims:images:list", "ims:images:update", "ims:images:upload" ], "Effect": "Allow" }, { "Action": [ "vpc:*:*", "ecs:*:get*", "ecs:*:list*" ], "Effect": "Allow" }, { "Action": [ "kms:cmk:*", "kms:dek:*", "kms:grant:*", "kms:cmkTag:*", "kms:partition:*" ], "Effect": "Allow" } ] }
- 自定义策略“Policy2”的具体内容如下,可以直接复制粘贴。
{ "Version": "1.1", "Statement": [ { "Action": [ "obs:bucket:ListAllMybuckets", "obs:bucket:HeadBucket", "obs:bucket:ListBucket", "obs:bucket:GetBucketLocation", "obs:object:GetObject", "obs:object:GetObjectVersion", "obs:object:PutObject", "obs:object:DeleteObject", "obs:object:DeleteObjectVersion", "obs:object:ListMultipartUploadParts", "obs:object:AbortMultipartUpload", "obs:object:GetObjectAcl", "obs:object:GetObjectVersionAcl" ], "Effect": "Allow" } ] }
- 将自定义策略授权给开发者用户组user_group。
- 在统一身份认证服务控制台的左侧菜单栏中,选择“授权”,勾选策略“Policy1”、“Policy2”、“SWR Admin”。单击“下一步”。
SWR的权限有SWR FullAccess、SWR OperateAccess、SWR ReadOnlyAccess。但SWR FullAccess、SWR OperateAccess、SWR ReadOnlyAccess仅限容器镜像服务企业版使用,目前企业版已暂停公测。非企业版用户暂不支持使用此权限。因此需要在此勾选“SWR Admin” 策略。
。在用户组页面单击对应用户组名称user_group操作列的 - 选择授权范围方案为“所有资源”,单击“确定”。
- 在统一身份认证服务控制台的左侧菜单栏中,选择“授权”,勾选策略“Policy1”、“Policy2”、“SWR Admin”。单击“下一步”。
父主题: 权限配置