Introduction

If you need to assign different permissions to personnel in your enterprise to access Cost Center, Identity and Access Management (IAM) is a good choice for fine-grained permissions management.

IAM is a free service. You only pay for the resources in your account. For more information about IAM, see IAM Service Overview.

System-Defined Roles

New IAM users do not have any permissions assigned by default. You need to first add them to one or more groups and attach policies or roles to these groups. The users then inherit permissions from the groups and can perform specified operations on cloud services based on the permissions they have been assigned. IAM provides frequently used roles that have permissions to access different services, and you have the permissions granted to these roles.

You can grant users permissions by using roles and policies.

Roles: A coarse-grained authorization strategy provided by IAM to assign permissions based on users' job responsibilities. Only a limited number of service-level roles are available for authorization. Huawei Cloud services depend on each other. When you grant permissions using roles, you also need to attach dependent roles. Roles are not ideal for fine-grained authorization and least privilege access.
Policies: A fine-grained authorization strategy that defines permissions required to perform operations on specific cloud resources under certain conditions. This type of authorization is more flexible and is ideal for least privilege access.

Table 1 lists all the system-defined roles for Cost Center.

**Table 1** System-defined roles
Role Name	Permissions
BSS Administrator	Full permissions for Cost Center. This role is generally granted to the administrator.
BSS Operator	Permissions include querying cost analyses, budget details, and cost tags in Cost Center. This role is generally granted to the technical personnel, such as R&D and O&M personnel.
BSS Finance	Financial permissions. Users with these permissions can perform all financial operations in Cost Center. This role is generally granted to financial personnel.

Table 2 lists the common operations supported by system-defined permissions for Cost Center.

**Table 2** Common operations supported by system-defined permissions
Page	Function	BSS Administrator	BSS Operator	BSS Finance
-	Enabling Cost Center	Supported	Not supported	Supported
Overview	Viewing current month costs	Supported	Supported	Supported
	Viewing daily costs	Supported	Supported	Supported
	Viewing current month trends	Supported	Supported	Supported
	Viewing recently accessed reports	Supported	Supported	Supported
Cost Analysis	Querying cost analyses	Supported	Supported	Supported
Cost Analysis	Exporting cost details	Supported	Not supported	Supported
Budgets	Setting a budget	Supported	Not supported	Supported
	Viewing budget details	Supported	Supported	Supported
	Exporting budgets	Supported	Not supported	Supported
Reports	Creating and saving reports	Supported	Not supported	Supported
Reports	Viewing reports	Supported	Supported	Supported
Budget Reports	Configuring budget reports	Supported	Not supported	Supported
	Deleting budget reports	Supported	Not supported	Supported
	Viewing budget reports	Supported	Supported	Supported
Cost Anomaly Detection	Creating cost monitors	Supported	Not supported	Supported
	Deleting cost monitors	Supported	Not supported	Supported
	Viewing cost monitors and anomalies	Supported	Supported	Supported
	Accessing Cost Analysis	Supported	Supported	Supported
	Disabling alerts for cost anomalies	Supported	Not supported	Supported
	Viewing cost anomaly notifications	Supported	Supported	Supported
Yearly/monthly subscriptions	Evaluating cost optimization option of changing pay-per-use to yearly/monthly	Supported	Supported	Supported
Cost Tags	Viewing cost tags	Supported	Supported	Supported
Cost Tags	Activating cost tags	Supported	Not supported	Supported
Cost Category	Creating cost categories	Supported	Not supported	Supported
	Deleting cost categories	Supported	Not supported	Supported
	Viewing cost categories	Supported	Supported	Supported
	Exporting cost splitting details	Supported	Not supported	Supported
	Viewing cost analyses	Supported	Supported	Supported
Preferences	Enabling functions	Supported	Not supported	Supported
Preferences	Disabling functions	Supported	Not supported	Supported
Export History	Exporting records	Supported	Not supported	Supported
Cost Optimization	Viewing cost optimization summary	Supported	Supported	Supported
	Viewing cost optimization subscriptions	Supported	Supported	Supported
	Configuring cost optimization subscriptions	Supported	Not supported	Supported
Cost Details Export	Exporting cost details	Supported	Not supported	Supported

Creating a Custom Policy

You can create custom policies to supplement the system-defined roles. For details about the actions supported by custom policies, see Table 3.

**Table 3** Supported actions
Fine-Grained Permissions Policy	Description
bss:costcenter:start	Enables Cost Center.
bss:costanalysis:view	Views cost analysis and overview.
bss:costanalysis:export	Exports cost details, including original and amortized cost details, with cost tags.
bss:costreport:view	Views a list of cost reports.
bss:costreport:update	Manages cost reports, including creating, modifying, and deleting custom reports. If this permission is granted to an IAM user, you must also grant the user the bss:costreport:view permission.
bss:budget:update	Manages budgets, including creating, modifying, and deleting budgets. If this permission is granted to an IAM user, you must also grant the user the bss:budget:view permission.
bss:budget:view	Views budget information, including the budget list and budget details.
bss:budgetreport:update	Adds and modifies budget reports.
bss:budgetreport:delete	Deletes budget reports.
bss:budgetreport:view	Views budget reports, including the budget list and budget details.
bss:costtag:view	Views cost tags.
bss:costtag:update	Activates or deactivates cost tags. If this permission is granted to an IAM user, you must also grant the user the bss:costtag:view permission.
bss:costunit:update	Configures cost categories, including creating and editing cost categories. If this permission is granted to an IAM user, you must also grant the user the bss:costunit:view and bss:costanalysis:view permissions.
bss:costunit:delete	Deletes cost categories. If this permission is granted to an IAM user, you must also grant the user bss:costunit:view permission.
bss:costunit:view	Views cost category information, including the cost category list and the details of each cost category.
bss:monitor:update	Adds and edits cost monitors.
bss:monitor:delete	Deletes cost monitors.
bss:monitor:view	Views cost monitors and anomalies.
bss:monitoralert:update	Creates cost anomaly notifications. If this permission is granted to an IAM user, you must also grant the user the bss:monitoralert:view permission.
bss:monitoralert:view	Views cost anomaly notifications.
bss:costoptimization:view	Evaluates cost optimization option of changing pay-per-use to yearly/monthly.
bss:costpreferences:update	Enables functions on the Preferences page.
bss:costpreferences:delete	Disables functions on the Preferences page.
bss:recommendation:view	Views cost optimization summary.
bss:recommendationsub:view	Views cost optimization subscriptions.
bss:recommendationsub:update	Configures cost optimization subscriptions.