Help Center> Anti-DDoS Service> Service Overview> Permissions Management> AAD Permissions
View PDF

AAD Permissions

If you need to assign different permissions to employees in your enterprise to access your AAD resources, IAM is a good choice for fine-grained permissions management. IAM provides identity authentication, permissions management, and access control, helping you efficiently manage access to your AAD resources.

With IAM, you can use your HUAWEI CLOUD account to create IAM users for your employees, and assign permissions to the users to control their access to specific resource types. For example, some software developers in your enterprise need to use AAD resources but must not delete them or perform any high-risk operations. To achieve this result, you can create IAM users for the software developers and grant them only the permissions required for using AAD resources.

If your HUAWEI CLOUD account does not need individual IAM users for permissions management, skip this section.

IAM is free. You pay only for the resources in your account. For more information about IAM, see the IAM Service Overview.

AAD Permissions

By default, new IAM users do not have any permissions. You need to add a user to one or more groups, and attach permission policies or roles to these groups. Users inherit permissions from their groups and can perform specified operations on cloud services based on the permissions.

AAD is a project-level service deployed and accessed in specific physical regions. To assign AAD permissions to a user group, specify the scope as region-specific projects and select projects for the permissions to take effect. If All projects is selected, the permissions will take effect for the user group in all region-specific projects. When accessing AAD, the users need to switch to a region where they have been authorized to use cloud services.

Table 1 lists all system roles supported by AAD.

Table 1 AAD system role

Role Name

Description

Dependency

CAD Administrator

Administrator permissions for AAD

Either the CAD Administrator and BSS Administrator roles or the Tenant Administrator role is required for purchasing an AAD instance or upgrading the specifications of an AAD instance.

  • BSS Administrator: has all permissions on account center, billing center, and resource center. It is a project-level role, which must be assigned in the same project.
  • Tenant Administrator: has all permissions on all services except on IAM.
Parent topic: Permissions Management