Creating a User and Granting CDN Permissions

This chapter describes how to use to implement fine-grained permissions control for your CDN resources. With IAM, you can:

Create IAM users for employees based on your enterprise's organizational structure. Each IAM user will have their own security credentials for accessing CDN resources.
Grant only the permissions required for users to perform a specific task.
Entrust an account or cloud service to perform professional and efficient O&M on your CDN resources.

If your account does not require individual IAM users, skip this chapter.

This section describes the procedure for granting permissions.

Learn about the permissions (see ) supported by CDN and choose policies or roles according to your requirements.

Figure 1 shows the process of granting CDN permissions.

Figure 1 Process of granting CDN permissions

Create a user group and assign permissions.
Create a user group on the IAM console, and assign the CDN DomainReadOnlyAccess policy to the group.
Create an IAM user and add it to the user group.
Create a user on the IAM console and add the user to the group created in 1.
Log in as the IAM user and verify permissions.
Log in to the CDN console as the created user, and verify that it only has read permissions for CDN domain names.
- Enable or disable an acceleration domain name. If a message appears indicating that you have insufficient permissions to perform the operation, the CDN DomainReadOnlyAccess policy has already taken effect.
- Choose any other service in Service List. If a message appears indicating that you have insufficient permissions to access the service, the CDN DomainReadOnlyAccess policy has already taken effect.