Help Center> ROMA Connect> Service Overview> Permissions Management
View PDF

Permissions Management

However, roles are not an ideal choice for fine-grained authorization and secure access control. IAM provides identity authentication, permissions management, and access control, helping you secure access to your resources.

With IAM, you can use your HUAWEI CLOUD account to create IAM users for your employees, and assign permissions to the users to control their access to specific resource types. For example, some software developers in your enterprise need to use ROMA Connect resources but should not be allowed to delete them or perform any high-risk operations. In this scenario, you can create IAM users for the software developers and grant them only the permissions required for using ROMA Connect resources.

If your HUAWEI CLOUD account does not need individual IAM users for permissions management, you may skip this chapter.

IAM is free of charge. You pay only for the resources in your account. For more information about IAM, see IAM Service Overview.

ROMA Connect Permissions

By default, new IAM users do not have permissions assigned. You need to add a user to one or more groups, and attach permissions policies or roles to these groups. Users inherit permissions from the groups to which they are added. and can perform specified operations on cloud services based on the permissions.

ROMA Connect is a project-level service deployed and accessed in specific physical regions. To assign permissions to a user group, specify the scope as region-specific projects, for example, cn-north-1 for CN North-Beijing1 and select projects for the permissions to take effect. If All projects is selected, the permissions will take effect for the user group in all region-specific projects. When accessing ROMA Connect, the users need to switch to a region where they have been authorized to use this service.

You can grant users permissions by using roles and policies.

  • Roles: A type of coarse-grained authorization mechanism first provided by IAM to define permissions related to user responsibilities. There are only a limited number of roles for granting permissions to users. When using roles to grant permissions, you may also need to assign other roles on which the permissions depend. However, roles are not an ideal choice for fine-grained authorization and secure access control.
  • Policies: A type of fine-grained authorization mechanism lately provided by IAM to define permissions required to perform operations on specific cloud resources under certain conditions. This mechanism allows for more flexible policy-based authorization and secure access control. For example, regarding ROMA Connect services, you can grant IAM users only the permissions for managing instance resources. Most policies define permissions based on APIs. For details, see .

Table 1 lists all the system roles supported by ROMA Connect.

Table 1 ROMA Connect system permissions

Role/Policy Name

Description

Type

Dependencies

ROMA FullAccess

All permissions for ROMA Connect. Users granted these permissions can operate and use all ROMA Connect instances.

System-defined policy

N/A

ROMA CommonOperations

Common user permissions for ROMA Connect. This does not include permissions to create, modify, and delete instances.

System-defined policy

N/A

ROMA ReadOnlyAccess

Read-only permissions for ROMA Connect. Users granted these permissions can only view ROMA Connect data.

System-defined policy

N/A

ROMA Administrator

All permissions for ROMA Connect. Users granted these permissions can operate and use all ROMA Connect instances.

System-defined policy
  • To use VPC channels, the user must be assigned the VPC Administrator role.
  • To use FunctionGraph as the backend service of APIs, the user must be assigned the FunctionGraph Administrator role.
  • To use the rule engine to forward data to DIS, the user must be assigned the DIS Administrator role.

Table 2 lists the common operations supported by each system-defined policy of ROMA Connect. Select the proper system-defined policies as required.

Table 2 Common operations supported by each system-defined policy or role of ROMA Connect

Operation

ROMA FullAccess

ROMA CommonOperations

ROMA ReadOnlyAccess

ROMA Administrator

Creating a ROMA Connect instance

√

x

x

√

Querying instance information

√

√

√

√

Modifying a ROMA Connect instance

√

x

x

√

Deleting a ROMA Connect instance

√

x

x

√

Operating resources in an instance

√

√

x

√

Integration Application Permissions

ROMA Connect provides strict permissions management for user resources. In one instance, IAM users can view and manage only the integration applications and resources created by themselves. With integration application authorization, IAM users can share applications and resources with other IAM users under the same account.

Table 3 User permissions for applications

Permission

FDI

APIC

MQS

LINK

Read

View data sources of applications.

View, debug, and export APIs of applications.

View topics of applications.

View devices, products, and rules of applications, and export devices and products for debugging.

Modify

Create and edit data sources under an application.

Create, edit, release, take APIs offline, and import APIs under an application.

Create a topic under an application.

Create and edit devices, products, and rules under an application, import devices and products, and reset device and product passwords.

Delete

Delete data sources of an application.

Delete APIs of an application.

Delete topics of an application.

Delete devices, products, and rules of an application, as well as product attributes, device topics, rule data source, and rule data destination.

Access

N/A

Configure authorization, access control, traffic control, and signature key binding for APIs of applications.

Configure application and user permissions for topics of applications.

Deliver commands to devices, exported devices, and configure codecs for devices that use the OPC UA or Modbus protocol.

admin

Permission of the application administrator.

ROMA Connect Business Flow Permissions

Table 4 shows all system permissions of a business flow.

Table 4 ROMA Connect business flow permissions

System Policy/Policy Name

Description

Type

Dependencies

ROMA BFS CommonOperations

Operation (such as create) permissions

System policy
  • To use FunctionGraph, you also need to have the FunctionGraph Administrator permission for project-level services.
  • To use SMN, you also need to have the SMN Administrator permission for project-level services.

ROMA BFS FullAccess

Administrator permissions

System policy
  • To use FunctionGraph, you also need to have the FunctionGraph Administrator permission for project-level services.
  • To use SMN, you also need to have the SMN Administrator permission for project-level services.
  • To use IAM, you also need to have the IAM ReadOnlyAccess permission.

ROMA BFS ReadOnlyAccess

Read-only permissions

System policy

N/A

ROMA Connect Business Flow Diagram Permissions

ROMA Connect implements strict permission management on service flow diagrams. IAM users can view and manage only the service flow diagrams created by themselves. By default, IAM users cannot view the service flow diagrams created by other IAM users. ROMA Connect business flows can be shared with other IAM users under the same account to view and use.

Table 5 ROMA Connect business flow diagram permissions

Permission

Business Flow

read

You can view the authorized business flow diagram.

modify

You can modify and save the authorized service flow diagram.

delete

You can delete the authorized business flow diagram.

operate

You can start, stop, restart, and manually schedule the authorized business flow diagram.

admin

Administrator permissions for business flow diagrams.