Help Center/ Cloud Trace Service/ Service Overview/ Permissions Management
Updated on 2022-09-27 GMT+08:00
View PDF

Permissions Management

You can use Identity and Access Management (IAM) to manage CTS permissions and control access to your resources. IAM provides identity authentication, permissions management, and access control.

You can create IAM users for your employees, and assign permissions to these users on a principle of least privilege (PoLP) basis to control their access to specific resource types. For example, you can create IAM users for software developers and assign specific permissions to allow them to use CTS resources but prevent them from deleting resources or performing any high-risk operations.

If your Huawei Cloud accountaccount does not require individual IAM users for permissions management, skip this section.

IAM can be used free of charge. You pay only for the resources in your account.

CTS Permissions

By default, new IAM users do not have any permissions assigned. To assign permissions to these new users, add them to one or more groups, and attach permissions policies or roles to these groups.

CTS is a project-level service deployed and accessed in specific physical regions. When assigning CTS permissions to a user group, specify region-specific projects where the permissions will take effect. If you select All projects, the permissions will be granted for all region-specific projects. When accessing CTS, the users need to switch to a region where they have been authorized to use this service.

You can grant users permissions by using roles and policies. Currently, only authorization by roles is supported in CTS.

  • Roles: A type of coarse-grained authorization mechanism that provides only a limited number of service-level roles. When using roles to grant permissions, you also need to assign dependency roles.
  • Policies: A type of fine-grained authorization mechanism that defines permissions required to perform operations on specific cloud resources under certain conditions. This mechanism allows for more flexible policy-based authorization for more secure access control. For example, you can grant ECS users only the permissions for managing a certain type of ECSs. Most policies define permissions based on APIs.

For the API actions supported by CTS, see Table 1.

Table 1 System-defined roles and policies supported by CTS

Role/Policy Name

Description

Type

Dependency

CTS FullAccess

Full permissions for CTS.

System-defined policy

None

CTS ReadOnlyAccess

Read-only permissions for CTS.

System-defined policy

None

CTS Administrator

Administrator permissions for CTS. Users granted these permissions can perform all operations on CTS.

System-defined role

The Tenant Guest and OBS Administrator roles need to be assigned in the same project.

Precautions

  • To enable CTS, you must have the Security Administrator permissions and full permissions for CTS (CTS FullAccess is recommended). For details about how to enable CTS, see section "Enabling CTS" in the Cloud Trace Service Getting Started. For details about how to assign permissions, see Assigning Permissions to an IAM User.
  • To use CTS after CTS is enabled, you only need to have related CTS permissions. The Security Administrator permissions are not required.