Prerequisites

Before creating a user group, complete the following operations:

• Understand the basic concepts of permissions.
• For the permissions of all cloud services supported by IAM, see System Permissions.

Creating a User Group

1. Log in to the IAM console as an administrator.
2. On the IAM console, choose User Groups from the navigation pane, and click Create User Group in the upper right corner.
   Figure 1 Creating a user group
   

3. Enter a user group name, for example, Developers.
   Figure 2 Entering a user group name
   

4. Click OK.
   

   You can create a maximum of 20 user groups. To create more user groups, increase the quota by referring to How Do I Increase My Quota?

Assigning Permissions to a User Group

To assign permissions to a user group, do as follows:

1. In the user group list, choose Authorize in the row that contains the Developers group.
   Figure 3 Going to the user group authorization page
   

2. On the Authorize User Group page, select the permissions to be assigned to the user group and click Next.
   If the system-defined policies do not meet your requirements, click Create Policy in the upper right to create custom policies. You can use them to supplement system-defined policies for refined permissions control. For details, see Creating a Custom Policy.

   Figure 4 Selecting permissions
   

3. Specify the scope. The system automatically recommends an authorization scope for the permissions you selected. Table 1 describes all the authorization scopes provided by IAM.

   Table 1 Authorization scopes

   Scope	Description
   All resources	IAM users can use the resources in all region-specific projects and the global service project in your account as specified by the permissions.
   Enterprise projects	IAM users can use the resources in the enterprise projects you select, as specified by the permissions. This option is available only when the enterprise project function has been enabled. For details about enterprise projects, see What is Enterprise Project Management Service? To enable the enterprise project function, see Enabling the Enterprise Project Function.
   Region-specific projects	IAM users can use the resources in the region-specific projects you select, as specified by the permissions. If some of the selected permissions belong to global services, the system automatically sets the authorization scope of these permissions to All resources. Selected permissions for project-level services will take effect for the region-specific projects you select.
   Global service project	IAM users can use global services as specified by the permissions. Global services are deployed with no physical regions specified. IAM users do not need to specify a region when accessing these services, such as Object Storage Service (OBS) and Content Delivery Network (CDN). If some of the selected permissions belong to project-level services, the system automatically sets the authorization scope of these permissions to All resources. Selected permissions for global services will take effect for the global service project.

4. Click OK.

Table 2 lists the common permissions. For the complete list of service-specific permissions, see System Permissions.

• If you add a user to multiple groups, the user will inherit all the permissions that have been assigned to the groups.

• For more information about permissions management, see Assigning Permissions to O&M Personnel, Assigning Dependency Roles, and Custom Policy Use Cases.