Help Center> Tag Management Service> Service Overview> Permissions Management
View PDF

Permissions Management

If you need to assign different permissions to employees in your enterprise to access your cloud resources, IAM is a good choice for fine-grained permissions management. IAM provides identity authentication, permissions management, and access control, helping you securely access to your HUAWEI CLOUD resources.

With IAM, you can use your HUAWEI CLOUD account to create IAM users for your employees, and assign permissions to the users to control their access to specific resource types. For example, some software developers in your enterprise need to use TMS but must not delete cloud resources or perform any high-risk operations. To achieve this result, you can create IAM users for the software developers and grant them only the permissions required for using TMS.

If your HUAWEI CLOUD account does not need individual IAM users for permissions management, you may skip over this topic.

IAM can be used free of charge. You pay only for the resources in your account. For more information about IAM, see IAM Service Overview.

TMS Permissions

By default, new IAM users do not have any permissions granted. You need to add a user to one or more groups, and assign policies or roles to these groups. The user then inherits permissions from the groups it is a member of. This process is called authorization. After authorization, the user can perform specified operations on cloud services based on the permissions.

TMS is a global service deployed for all physical regions. Therefore, TMS permissions are assigned to users in the Global project, and the users do not need to switch regions when accessing TMS.

You can grant users permissions by using roles and policies.

  • Roles: A coarse-grained authorization mechanism provided by IAM to define permissions based on users' job responsibilities. This mechanism provides only a limited number of service-level roles for authorization. When using roles to grant permissions, you also need to assign other roles that the permissions depend on to take effect. However, roles are not an ideal choice for fine-grained authorization and secure access control.
  • Policies: A fine-grained authorization mechanism that defines permissions required to perform operations on specific cloud resources under certain conditions. This mechanism allows for more flexible policy-based authorization, meeting requirements for secure access control. For example, you can grant TMS users only the permissions for managing a certain type of cloud servers. Most policies define permissions based on APIs. For the API actions supported by TMS, see Permissions Policies and Supported Actions.

Table 1 lists all the system policies supported by TMS. Dependencies are policies on which a policy depends to take effect. For example, the TMS policy is dependent on the policies of other services. When assigning TMS permissions to users, you need to also assign dependent policies for the TMS permissions to take effect.

Table 1 System policy summary

Policy Name

Description

Dependencies

TMS Administrator

Users with this permission can create, modify, and delete predefined tags.

Dependent on the following policies:

  • Tenant Guest: a global or project-level policy, which must be assigned in the Global project
  • Server Administrator: a project-level policy, which must be assigned in the same project as the TMS Administrator policy
  • Tenant Guest: a global policy, which must be assigned in the OBS project
  • Tenant Administrator: a global policy, which must be assigned in the OBS project
  • IMS Administrator: a project-level policy, which must be assigned in the same project as the TMS Administrator policy
  • AutoScaling Administrator: a project-level policy, which must be assigned in the same project as the TMS Administrator policy
  • VPC Administrator: a project-level policy, which must be assigned in the same project as the TMS Administrator policy
  • VBS Administrator: a project-level policy, which must be assigned in the same project as the TMS Administrator policy

Table 2 lists the common operations supported by each system policy of TMS. Choose proper system policies according to this table.

Table 2 Common operations supported by the TMS system policy

Operation

TMS Administrator

Querying the cloud resource list

x (depending on Tenant Guest)

Creating keys

x (depending on Tenant Guest)

Managing tags

x (depends on Tenant Guest and the project policy corresponding to the cloud resource. For example, if you want to manage the VPC tags,

Select in the same project.)

Creating predefined tags

√

Modifying predefined tags

√

Deleting predefined tags

√

Helpful Links