Creating a User and Assigning Permissions

This section describes how to use IAM to control fine-grained permissions for your GeminiDB resources. With IAM, you can:

• Create IAM users for employees based on your enterprise's organizational structure. Each IAM user will have their own security credentials for accessing GeminiDB resources.
• Grant only the permissions required for users to perform a specific task.
• Entrust a Huawei Cloud account or cloud service to perform efficient O&M on your GeminiDB resources.

If your Huawei Cloud account does not require individual IAM users, skip this section.

The following describes the procedure for granting permissions (see Figure 1).

Process Flow

Figure 1 Process of granting GeminiDB permissions

1. Create a user group and assign permissions to it.

   Create a user group on the IAM console and attach the GaussDB NoSQL FullAccess policy to the group.

   

   To use some interconnected services, you also need to configure permissions of such services.

   For example, when using DAS to connect to a DB instance, you need to configure the GaussDB NoSQL FullAccess and DAS FullAccess permissions.

2. Create an IAM user and add it to a user group.

   Create a user on the IAM console and add the user to the group created in 1.

3. Log in and verify permissions.

   Log in to the management console using the created user, and verify that the user only has read permissions.

   Choose Service List > GeminiDB and click Buy DB Instance. If you can buy an instance, the required permission policy has taken effect.