Creating a User and Assigning DSC Permissions

This section describes IAM's fine-grained permissions management for your DSC resources. With IAM, you can:

Create IAM users for employees based on the organizational structure of your enterprise. Each IAM user has their own security credentials, providing access to DSC resources.
Grant only the permissions required for users to perform a task.
Entrust a HUAWEI CLOUD account or cloud service to perform professional and efficient O&M on your DSC resources.

If your HUAWEI CLOUD account does not require individual IAM users, skip this section.

This section describes the procedure for granting permissions (see Figure 1).

Learn about the permissions supported by DSC in Table 1 and choose policies or roles based on your requirements.

**Table 1** DSC system permissions
Policy	Description	Type	Dependency
DSC DashboardReadOnlyAccess	Read-only permissions for the overview page of DSC	System-defined policy	None
DSC FullAccess	All permissions for DSC	System-defined policy	To purchase a yearly/monthly RDS DB instance, you need to configure the following actions: bss:order:update bss:order:pay
DSC ReadOnlyAccess	Read-only permissions for Data Security Center	System-defined policy	None

Figure 1 Process for granting permissions

Create a user group and assign permissions.
Create a user group on the IAM console, and assign the DSC FullAccess permissions to the group.
Creating an IAM User.
Create a user on the IAM console and add it to the group created in 1.
Logging In as an IAM User and verify permissions.
Log in to the DSC console using the created user and verify that the user has administrator permissions for DSC.

Assume you are granted only the DSC FullAccess permission. Choose any other service in the Service List. If a message appears indicating insufficient permissions to access the service, the permission setting has already taken effect.