Help Center> CodeArts Inspector> Service Overview> Overview> Permissions Management
View PDF

Permissions Management

VSS provides two types of default permissions: user management and resource management.
  • User management refers to the management of users, user groups, and user group rights.
  • Resource management refers to control of operations on cloud service resources.

To assign different permissions to employees in your enterprise to access your VSS resources, IAM is a good choice for fine-grained permissions management. IAM provides identity authentication, permissions management, and access control, helping you secure access to your HUAWEI CLOUD resources.

With IAM, you can use your HUAWEI CLOUD account to create IAM users for your employees, and assign permissions to the users to control their access to specific resource types. For example, some software developers in your enterprise need to use VSS resources but must not delete them or perform any high-risk operations. To achieve this result, you can create IAM users for the software developers and grant them only the permissions required for using VSS resources.

If your HUAWEI CLOUD account does not need individual IAM users for permissions management, then you may skip over this chapter.

IAM can be used free of charge. You pay only for the resources in your account. For more information about IAM, see IAM Service Overview.

VSS Permissions

By default, new IAM users do not have permissions assigned. You need to add a user to one or more groups, and attach permissions policies or roles to these groups. Users inherit permissions from the groups to which they are added and can perform specified operations on cloud services based on the permissions.

VSS is a project-level service deployed and accessed in specific physical regions. To assign VSS permissions to a user group, specify the scope as region-specific projects and select projects for the permissions to take effect. If All projects is selected, the permissions will take effect for the user group in all region-specific projects. When accessing VSS, the users need to switch to a region where they have been authorized to use the VSS service.

Table 1 lists all the system roles supported by VSS. For example, some VSS policies are dependent on the policies of other services. When assigning VSS roles to users, you also need to assign dependent roles for the VSS permissions to take effect.

Table 1 System policies supported by VSS

Role Name

Description

Dependencies

VSS Administrator

Administrator permissions for VSS

Dependent on the Tenant Guest and Server Administrator roles.

  • Tenant Guest: A global role, which must be assigned in the Global project
  • Server Administrator: A project-level role, which must be assigned in the same project.

Helpful Links

Parent topic: Overview