Creating an IAM User

Procedure

1. Log in to the IAM console as the administrator.
2. Choose Users from the left navigation pane and click Create User in the upper right corner.
   Figure 1 Creating an IAM user
   

3. Specify the user information on the Create User page. To create more users, click Add User. You can add a maximum of 10 users at a time.
   Figure 2 Specifying user details
   

   Table 1 User details

   Parameter	Description
   Username	This parameter is user-defined and cannot be the same as that of any other account or any IAM user in the account.
   Email Address	This parameter is user-defined and cannot be the same as that of any other account or any IAM user in the account. It can be used to authenticate the IAM user and reset the password.
   Mobile Number	This parameter is user-defined. It can be used to authenticate the IAM user and reset the password.
   External Identity ID	Identity of an enterprise user in IAM user SSO. The value contains a maximum of 128 characters. This parameter must be specified if you want to configure virtual user SSO via SAML for an IAM user.

   

   • IAM users can log in to Huawei Cloud using the username, email address, or mobile number.
   • If users forget their passwords, they can reset the passwords through email address or mobile number verification. If no email addresses or mobile numbers have been bound to users, users need to request the administrator to reset their passwords.

4. Specify Access Type.
   Figure 3 Selecting access types
   

   Table 2 Access types

   Access Type	Description
   Programmatic access	An access key or password is generated for the IAM user. This type allows access to cloud services using development tools, such as APIs, CLI, and SDKs.
   Management console access	A password is generated for the IAM user. This type allows access to cloud services using the management console. A password is mandatory for login.

   

   • If the user accesses cloud services only by using the management console, select Management console access for Access Type and Password for Credential Type.
   • If the user accesses cloud services only through programmatic access, select Programmatic access for Access Type and Access key for Credential Type
   • If the user uses a password as the credential for programmatic access to certain APIs, select Programmatic access for Access Type and Password for Credential Type
   • If the user needs to perform access key verification when using certain services in the console, select Programmatic access and Management console access for Access Type and Access key and Password for Credential Type. For example, the user needs to perform access key verification before creating a data migration job in the Cloud Data Migration (CDM) console.

5. Specify Credential Type.
   Figure 4 Selecting credential types
   

   Table 3 Credential types

   Credential Type		Description
   Access key		After creating the user, you can download the access key (AK/SK) generated for the user. Each user can have a maximum of two access keys.
   Password	Set now	Set a password for the user and determine whether to require the user to reset the password at the first login. If you will use the IAM user by yourself, you are advised to select this option, enter a password, and deselect Require password reset at first login.
   	Automatically generated	The system automatically generates a login password for the user. After the user is created, you can download the EXCEL password file and provide the password to the user. The user can then use this password for login. This option is available only when you create a single user.
   	Set by user	A one-time login URL will be emailed to the user. The user can click on the link to log in to the console and set a password. If you do not use the IAM user by yourself, select this option and enter the email address and mobile number of the IAM user. The user can then set a password by clicking on the one-time login URL sent over email. The login URL is valid for seven days.
   USB Key		A USB key is a device that stores user credentials. Identity verification with a USB key does not require a password, which prevents account security issues caused by password leakage. Once selected, the USB key is the only way for the IAM user to log in. The password will be invalidated and can no longer be used.

   Table 4 Recommended configurations

   Management Console Access	Programmatic Access	Credential Type	Recommended Access Type	Recommended Credential Type
   Select	Deselect	There are no special requirements.	Management console access	Password
   Deselect	Select	There are no special requirements.	Programmatic access	Access key
   Deselect	Select	A password is required as a credential for programmatic access (required by some APIs).	Programmatic access	Password
   Select	Select	The access key (entered by the IAM user) needs to be verified on the console. For example, the user needs to perform access key verification before creating a data migration job in the Cloud Data Migration (CDM) console.	Programmatic access and management console access	Password and access key

6. Configure login protection. This parameter is available only when you have selected Management console access for Access Type.
   Figure 5 Enabling login protection
   
   • Enable (Recommend for account security): The user needs to enter a verification code in addition to the username and password for login.

     You can choose SMS-, email-, or virtual MFA–based login verification.

   • Disable: The user does not need to enter a verification code for login. If you want to enable login protection after the user is created, see Login Protection.

7. Click Next. Select the user groups to add the user. The user will inherit the permissions assigned to the user groups.
   Figure 6 Adding the user to a user group
   
   

   • You can also create a new group and add the user to that group.
   • If you want the user to be an administrator, add the user to the default group admin.
   • You can add a user to a maximum of 10 user groups.

8. Click Create.
   • If you have selected Access key for Credential Type in 5, you can download the access key on the Finish page.
   • If you have selected Password > Automatically generated for Credential Type in 5, you can download the password file on the Finish page.
     Figure 7 Users created successfully
     

Related Operations

• IAM users created without being added to any groups do not have any permissions. The administrator can assign permissions to these IAM users on the IAM console. Then the users can use cloud resources based on the assigned permissions. For details, see Assigning Permissions to an IAM User.
• Accounts and IAM users use different methods to log in. For details about IAM user login, see Logging In as an IAM User.