Help Center> Simple Message Notification> Service Overview> Permissions Management
View PDF

Permissions Management

If you need to assign different permissions to employees in your enterprise to access your SMN resources, IAM is a good choice for fine-grained permissions management. IAM provides identity authentication, permissions management, and access control, helping you secure access to your HUAWEI CLOUD resources.

With IAM, you can use your HUAWEI CLOUD account to create IAM users, and assign permissions to the users to control their access to specific HUAWEI CLOUD resources. For example, some software developers in your enterprise need to use SMN but should not be allowed to delete other SMN resources or perform any other high-risk operations. In this scenario, you can create IAM users for the software developers and grant them only the permissions required for using SMN resources.

If your HUAWEI CLOUD account does not require individual IAM users for permissions management, skip this section.

IAM is free. You pay only for resources purchased using your account.

For more information, see IAM Service Overview.

SMN Permissions

By default, new IAM users do not have permissions assigned. You need to add a user to one or more groups, and attach permissions policies or roles to these groups. Users inherit permissions from the groups to which they are added and can perform specified operations on cloud services based on the permissions.

SMN is a project-level service deployed and accessed in specific physical regions. To assign SMN permissions to a user group, specify the scope as region-specific projects and select projects such as cn-north-1 for the permissions to take effect. If All projects is selected, the permissions will take effect for the user group in all region-specific projects. When accessing SMN, the users need to switch to a region where they have been authorized to use this service.

You can grant users permissions by using roles and policies.

  • Roles: a type of coarse-grained authorization mechanism that defines service-level permissions based on user responsibilities. There are only a limited number of roles for granting permissions to users. When using roles to grant permissions, you also need to assign dependency roles. Roles are not an ideal choice for fine-grained authorization and secure access control.
  • Policies: a type of fine-grained authorization mechanism that defines permissions required to perform operations on specific cloud resources under certain conditions. This mechanism allows for more flexible policy-based authorization and secure access control. For example, you can grant SMN users only the permissions required for managing a certain type of ECSs. Most fine-grained policies are based on APIs. The minimum granularity of a policy is API actions. For the API actions supported by SMN, see section "Permissions Policies and Supported Actions" in the Simple Message Notification API Reference.
Table 1 lists all system-defined policies supported by SMN.
Table 1 System-defined policies supported by SMN

System-defined Role/Policy Name

Description

Type

Dependency

SMN Administrator

Has all permissions for SMN resources.

Role

Depends on the Tenant Guest policy.

Tenant Guest: project-level policy, which must be assigned in the same project as the SMN Administrator

SMN FullAccess

Administrator permissions for SMN. Users granted these permissions can operate and use all SMN resources.

Policy

None

SMN ReadOnlyAccess

Read-only permissions for SMN

Users with this permission can only view SMN data.

Policy

None

Table 2 lists the common operations supported by each system-defined policy of SMN. Select the permissions as needed.

Table 2 Common operations supported by each system-defined policy of SMN

Operation

SMN Administrator

SMN FullAccess

SMN ReadOnlyAccess

Creating a topic

√

√

×

Updating a topic

√

√

×

Deleting a topic

√

√

×

Querying topics

√

√

√

Adding a subscription

√

√

×

Adding tags to a topic

√

√

×

Configuring topic policies

√

√

×

Publishing a message

√

√

×

Adding a subscription

√

√

×

Requesting subscription confirmation

√

√

×

Canceling a subscription

√

√

×

Deleting a subscription

√

√

×

Querying subscriptions

√

√

√

Creating a message template

√

√

×

Modifying a message template

√

√

×

Deleting a message template

√

√

×

Querying a message template

√

√

√

Helpful Links