System Permissions

By default, new IAM users do not have permissions assigned. You need to add a user to one or more groups, and attach permissions policies or roles to these groups. Users inherit permissions from the groups to which they are added and can perform specified operations on cloud services based on the permissions.

Scope: The projects for which permissions granted to a user group will take effect.

Global service project: Services deployed without specifying physical regions, such as Object Storage Service (OBS) and Content Delivery Network (CDN), are called global services. Permissions for these services must be assigned in the global service project.
Region-specific projects: Services deployed in specific regions, such as Elastic Cloud Server (ECS) and Bare Metal Server (BMS), are called project-level services. Permissions for these services need to be assigned in region-specific projects and take effect only for the corresponding regions.
- All projects: Permissions take effect for both the global service project and region-specific projects, including projects created later.
- Region-specific projects: Permissions take effect for the region-specific projects you select.

Type: You can grant users permissions by using roles and policies. Policies are a type of fine-grained authorization mechanism that defines permissions required to perform operations on specific cloud resources under certain conditions. For details, see Permission.

For services that provide both policies and roles, preferentially use policies to assign permissions.
For services that support policy-based access control, you can create custom policies to supplement system-defined policies to allow or deny access to specific types of resources under certain conditions.

System-Defined Policies

Service	Scope	Role/Policy Name	Type	Description
BASE	Global service project	FullAccess	Policy	Full permissions for cloud services supporting policy-based authorization.
	All projects	Tenant Administrator	Role	Full permissions for all services except IAM. NOTE: If the permissions are granted for the global service project, they take effect for the global service project. If the permissions are granted for all projects, they take effect for both the global service project and all region-specific projects, including projects created later. If the permissions are granted for certain region-specific projects, they take effect only for these projects.
	All projects	Tenant Guest		Read-only permissions for all services except IAM. NOTE: If the permissions are granted for the global service project, they take effect for the global service project. If the permissions are granted for all projects, they take effect for both the global service project and all region-specific projects, including projects created later. If the permissions are granted for certain region-specific projects, they take effect only for these projects.
	Global service project	Agent Operator		Permissions for switching roles to access resources of delegating accounts.
Elastic Cloud Server (ECS) (Project-level service)	Region-specific projects	ECS FullAccess	Policy	Full permissions for ECS.
		ECS ReadOnlyAccess		Read-only permissions for ECS.
		ECS PartnerOperations		Partner permissions for ECS.
		ECS CommonOperations	Role	Permissions for starting, stopping, restarting, and querying ECSs.
Cloud Container Engine (CCE) (Project-level service)	Region-specific projects	CCE FullAccess	Policy	Common operation permissions for CCE cluster resources, including the permissions for creating, deleting, and updating clusters. This policy does not include namespace-level permissions for clusters that have Kubernetes RBAC enabled or administrator permissions for agency configuration and cluster certificate generation. NOTE: You can grant IAM users namespace-level permissions for clusters that have Kubernetes RBAC enabled and administrator permissions for agency configuration and cluster certificate generation on the CCE console. For details, see Permissions Overview.
		CCE ReadOnlyAccess	Policy	Permissions to view CCE cluster resources, excluding namespace-level permissions for clusters that have Kubernetes RBAC enabled.
		CCE Administrator	Role	Read and write permissions for CCE clusters and all resources (including workloads, nodes, jobs, and Services) in the clusters. This role depends on the following permissions: Global service project: OBS Buckets Viewer Region-specific projects (same projects): Tenant Guest, Server Administrator, ELB Administrator, SFS Administrator, SWR Admin, and APM FullAccess NOTE: Users also granted permissions with the NAT Gateway Administrator role can use NAT Gateway functions for clusters.
Object Storage Service (OBS)	Global service project	OBS OperateAccess	Policy	Users with this permission can perform all operations specified by OBS ReadOnlyAccess and perform basic object operations, such as uploading objects, downloading objects, deleting objects, and obtaining object ACLs.
		OBS ReadOnlyAccess	Policy	Users with this permission can list buckets, obtain basic bucket information, obtain bucket metadata, and list objects.
		OBS Buckets Viewer	Role	Users with this permission can list buckets, obtain basic bucket information, and obtain bucket metadata.
Content Delivery Network (CDN) (Global service)	Global service project	CDN DomainReadOnlyAccess	Policy	Read-only permissions for CDN acceleration domain names.
		CDN StatisticsReadOnlyAccess		Read-only permissions for CDN statistics.
		CDN LogsReadOnlyAccess		Read-only permissions for CDN logs.
		CDN Domain Configuration Operator		Permissions for configuring CDN acceleration domain names.
		CDN RefreshAndPreheatAccess		Permissions for cache refreshing and preheating.
		CDN Administrator	Role	Full permissions for CDN. This role must be used together with the Tenant Guest role in the same project.
Storage Disaster Recovery Service (SDRS) (Project-level service)	Region-specific projects	SDRS Administrator	Role	Full permissions for SDRS. This role must be used together with the Tenant Guest and Server Administrator roles in the same project.
SSL Certificate Manager (SCM) (Global service) (SCM has been integrated into CCM.)	Global service project	SCM Administrator	Role	Full permissions for SCM. This role must be used together with the Tenant Guest and Server Administrator roles in the same project.
		SCM FullAccess	Policy	Full permissions for SCM.
		SCM ReadOnlyAccess	Policy	Read-only permissions for SCM. Users with these permissions can only query certificates but cannot add, delete, or modify certificates.
Situation Awareness (SA) (Global service)	Global service project	SA FullAccess	Policy	Full permissions for SA.
Situation Awareness (SA) (Global service)	Global service project	SA ReadOnlyAccess	Policy	Read-only permissions for SA. Users with the read-only permission can only query SA information but cannot perform configuration in SA.
Cloud Bastion Host (CBH) (Project-level service)	Region-specific projects	CBH FullAccess	Policy	Full permissions for CBH instances.
Cloud Bastion Host (CBH) (Project-level service)	Region-specific projects	CBH ReadOnlyAccess	Policy	Read-only permissions for CBH instances. Users who have read-only permissions granted can only view CBH instances but cannot configure or perform operations on services.
Business Support System (BSS) (Project-level service) NOTICE: These are the projects where permissions for this service can be assigned.	Region-specific projects	BSS Administrator	Role	Full permissions for Billing Center, Resource Center, and My Account.
		BSS Operator		Query permissions for Billing Center and management permissions for Resource Center and My Account.
		BSS Finance		Permissions for financial operations, including payment, consumption, and invoicing. This role does not have permissions for modifying cloud services.
		Enterprise Project BSS FullAccess	Policy	Permissions for accounting management of enterprise projects.
Elastic Cloud Server (ECS) Elastic Volume Service (EVS) Virtual Private Cloud (VPC) Image Management Service (IMS) (Project-level service)	Region-specific projects	Server Administrator	Role	Full permissions for ECS. This role must be used together with the Tenant Guest role in the same project. If a user needs to create, delete, or change resources of other services, the user must also be granted administrator permissions of the corresponding services in the same project. For example, if a user needs to create a new VPC when creating an ECS, the user must also be granted permissions with the VPC Administrator role. Full permissions for EVS. Permissions for performing operations on EIPs, security groups, and ports. This role must be used together with the Tenant Guest role in the same project. Permissions for creating, deleting, querying, modifying, and uploading images. This role must be used together with the IMS Administrator role in the same project.
Cloud Container Instance (CCI) (Project-level service)	Region-specific projects	CCI FullAccess	Policy	Full permissions for CCI. Users granted these permissions can create, delete, query, and update all CCI resources.
		CCI ReadOnlyAccess		Read-only permissions for CCI. Users granted these permissions can only view CCI resources.
		CCI CommonOperations		Common user permissions for CCI. Users granted these permissions can perform all operations except creating, deleting, and modifying role-based access control (RBAC) policies, networks, and namespaced resources.
		CCI Administrator	Role	Administrator permissions for CCI. Users granted these permissions can create, delete, query, and update all CCI resources.
Auto Scaling (AS) (Project-level service)	Region-specific projects	AutoScaling FullAccess	Policy	Full permissions for all AS resources.
		AutoScaling ReadOnlyAccess	Policy	Read-only permissions for all AS resources.
		AutoScaling Administrator	Role	Full permissions for all AS resources. This role must be used together with the ELB Administrator, CES Administrator, Server Administrator, and Tenant Administrator roles in the same project.
Image Management Service (IMS) (Project-level service)	Region-specific projects	IMS FullAccess	Policy	Full permissions for IMS.
		IMS ReadOnlyAccess	Policy	Read-only permissions for IMS.
		IMS Administrator	Role	Full permissions for IMS. This role must be used together with the Tenant Administrator role in the global service project.
Elastic Volume Service (EVS) (Project-level service)	Region-specific projects	EVS FullAccess	Policy	Full permissions for EVS. Users granted these permissions can create, mount, uninstall, query, and delete EVS resources, and expand capacity of EVS disks.
Elastic Volume Service (EVS) (Project-level service)	Region-specific projects	EVS ReadOnlyAccess	Policy	Read-only permissions for EVS. Users granted these permissions can view EVS resource data only.
Cloud Server Backup Service (CSBS) (Project-level service)	Region-specific projects	CSBS Administrator	Role	Full permissions for CSBS. This role must be used together with the Server Administrator role in the same project.
Volume Backup Service (VBS) (Project-level service)	Region-specific projects	VBS Administrator	Role	Full permissions for VBS. This role must be used together with the Tenant Guest and Server Administrator roles in the same project.
Dedicated Distributed Storage Service (DSS) (Project-level service)	Region-specific projects	DSS FullAccess	Policy	Full permissions for DSS.
	Region-specific projects	DSS ReadOnlyAccess	Policy	Read-only permissions for DSS.
Virtual Private Cloud (VPC) (Project-level service)	Region-specific projects	VPC FullAccess	Policy	Full permissions for VPC.
		VPC ReadOnlyAccess	Policy	Read-only permissions for VPC.
		VPC Administrator	Role	Permissions for VPC, excluding permissions for creating, modifying, deleting, and viewing security groups and security group rules. This role must be used together with the Tenant Guest role in the same project.
Cloud Container Engine (CCE) (Project-level service)	Region-specific projects	CCE FullAccess	Policy	Full permissions for CCE.
		CCE ReadOnlyAccess	Policy	Read-only permissions for CCE and all operations on Kubernetes resources.
		CCE Administrator	Role	Read and write permissions for CCE clusters and all resources (including workloads, nodes, jobs, and Services) in the clusters. This role depends on the following permissions: Global service project: OBS Buckets Viewer Region-specific projects (same projects): Tenant Guest, Server Administrator, ELB Administrator, SFS Administrator, SWR Admin, and APM FullAccess NOTE: Users also granted permissions with the NAT Gateway Administrator role can use NAT Gateway functions for clusters.
Application Orchestration Service (AOS) (Project-level service)	Region-specific projects	CDE Admin	Role	AOS administrator with full permissions.
	Region-specific projects	CDE Developer	Role	AOS developer.
Resource Formation (RF) (Project-level service)	Region-specific projects	RF FullAccess	Policy	Full permissions for RF.
		RF ReadOnlyAccess		Read-only permissions for RF.
		RF DeployByExecutionPlanOperations		Create, execute, and read permissions for execution plans and read permissions for stacks.
CloudTable Service (CloudTable) (Project-level service)	Region-specific projects	CloudTable Administrator	Role	Full permissions for CloudTable. This role must be used together with the Tenant Guest and Server Administrator roles in the same project.
Domain Name Service (DNS) (Project-level service)	Region-specific projects	DNS Administrator	Role	Full permissions for DNS. This role must be used together with the Tenant Guest and VPC Administrator roles in the same project.
		DNS FullAccess	Policy	Full permissions for DNS.
		DNS ReadOnlyAccess	Policy	Read-only permissions for DNS. Users granted these permissions can only view DNS resources.
VPC Endpoint (VPCEP) (Project-level service)	Region-specific projects	VPCEndpoint Administrator	Role	Full permissions for VPCEP. This role must be used together with the Server Administrator, VPC Administrator, and DNS Administrator roles in the same project.
Identity and Access Management (IAM) (Global service)	Global service project	Security Administrator	Role	Full permissions for IAM.
Identity and Access Management (IAM) (Global service)	Global service project	IAM ReadOnlyAccess	Policy	Read-only permissions for IAM.
Cloud Trace Service (CTS) (Project-level service)	Region-specific projects	CTS FullAccess	Policy	Full permissions for CTS. NOTE: To enable CTS, a user must be granted permissions using the CTS FullAccess policy and the Security Administrator role.
		CTS ReadOnlyAccess	Policy	Read-only permissions for CTS.
		CTS Administrator	Role	Full permissions for CTS. This role must be used together with the Tenant Guest and Tenant Administrator roles in the same project.
Simple Message Notification (SMN) (Project-level service)	Region-specific projects	SMN Administrator	Role	Full permissions for SMN. This role must be used together with the Tenant Guest role in the same project.
		SMN FullAccess	Policy	Full permissions for SMN.
		SMN ReadOnlyAccess	Policy	Read-only permissions for SMN.
Relational Database Service (RDS) (Project-level service)	Region-specific projects	RDS FullAccess	Policy	Full permissions for RDS.
		RDS ReadOnlyAccess		Read-only permissions for RDS.
		RDS UserAccess		Database administrator permissions for all operations except deleting RDS resources.
		RDS Administrator	Role	Full permissions for RDS. This role must be used together with the Tenant Guest and Server Administrator roles in the same project.
Distributed Message Service (DMS) (Project-level service)	Region-specific projects	DMS Administrator	Role	Full permissions for DMS.
DMS (DMS Kafka and DMS RabbitMQ) (Project-level service)	Region-specific projects	DMS UserAccess	Policy	Common user permissions for DMS (DMS for Kafka and DMS for RabbitMQ), excluding permissions for creating, modifying, deleting, scaling up instances and dumping.
		DMS ReadOnlyAccess		Read-only permissions for DMS (DMS for Kafka and DMS for RabbitMQ). Users granted these permissions can only view DMS data.
		DMS FullAccess		Administrator permissions for DMS (DMS for Kafka and DMS for RabbitMQ). Users granted these permissions can perform all operations on DMS.
Document Database Service (DDS) (Project-level service)	Region-specific projects	DDS FullAccess	Policy	Full permissions for DDS.
		DDS ReadOnlyAccess		Read-only permissions for DDS.
		DDS ManageAccess		Database administrator permissions for all operations except deleting DDS resources.
		DDS Administrator	Role	Full permissions for DDS. This role must be used together with the Tenant Guest and Server Administrator roles in the same project. If a DDS enterprise project is configured, you need to assign the DAS Admin role to users in the same project so that the users can log in to DAS from the DDS console.
Data Replication Service (DRS) (Project-level service)	Region-specific projects	DRS Administrator	Role	Full permissions for DRS. This role must be used together with the Tenant Guest and Server Administrator roles in the same project.
		DRS FullAccess	Policy	Full permissions for DRS.
		DRS ReadOnlyAccess	Policy	Read-only permissions for DRS.
Data Admin Service (DAS) (Project-level service)	Region-specific projects	DAS Administrator	Role	DAS administrator with full permissions. This role must be used together with the Tenant Guest role in the same project.
Data Admin Service (DAS) (Project-level service)	Region-specific projects	DAS FullAccess	Policy	Full permissions for DAS.
GaussDB NoSQL (Project-level service)	Region-specific projects	GaussDB NoSQL FullAccess	Policy	Full permissions for GaussDB NoSQL.
GaussDB NoSQL (Project-level service)	Region-specific projects	GaussDB NoSQL ReadOnlyAccess	Policy	Read-only permissions for GaussDB NoSQL.
GaussDB(for openGauss) (Project-level service)	Region-specific projects	GaussDB FullAccess	Policy	Full permissions for GaussDB.
GaussDB(for openGauss) (Project-level service)	Region-specific projects	GaussDB ReadOnlyAccess	Policy	Read-only permissions for GaussDB.
GaussDB(for MySQL) (Project-level service)	Region-specific projects	GaussDB FullAccess	Policy	Full permissions for GaussDB.
GaussDB(for MySQL) (Project-level service)	Region-specific projects	GaussDB ReadOnlyAccess	Policy	Read-only permissions for GaussDB.
Application Operations Management (AOM) (Project-level service)	Region-specific projects	AOM FullAccess	Policy	Full permissions for AOM.
	Region-specific projects	AOM ReadOnlyAccess	Policy	Read-only permissions for AOM.
Application Performance Management (APM) (Project-level service)	Region-specific projects	APM FullAccess	Policy	Full permissions for APM.
		APM ReadOnlyAccess	Policy	Read-only permissions for APM.
		APM Administrator	Role	Full permissions for APM.
Software Repository for Container (SWR) (Project-level service)	Region-specific projects	SWR Admin	Role	Full permissions for SWR.
		SWR FullAccess	Policy	Full permissions for SWR enterprise edition.
		SWR ReadOnlyAccess		Read-only permissions for SWR enterprise edition. Users with these permissions can query artifact repositories and charts, create temporary credentials, and download artifacts.
		SWR OperateAccess		Operation permissions for SWR enterprise edition. Users with these permissions can query enterprise edition instances, perform operations on artifact repositories and organizations, create temporary credentials, and upload and download artifacts.
Blockchain Service (BCS) (Project-level service)	Region-specific projects	BCS Administrator	Role	Administrator permissions for BCS.
		BCS FullAccess	Policy	Full permissions for BCS.
		BCS ReadOnlyAccess	Policy	Read-only permissions for BCS.
Gene Container Service (GCS) (Project-level service)	Region-specific projects	GCS Administrator	Role	GCS administrator.
		GCS FullAccess	Policy	Full permissions for GCS.
		GCS ReadOnlyAccess		Read-only permissions for GCS.
		GCS CommonOperations		Common operation permissions for GCS.
Cloud Eye (Project-level service)	Region-specific projects	CES Administrator	Role	Full permissions for Cloud Eye. This role must be used together with the Tenant Guest and Server Administrator roles in the same project.
	Region-specific projects	CES FullAccess	Policy	Administrator permissions for performing all operations on Cloud Eye. The monitoring function of Cloud Eye involves the query of cloud resources, which requires the relevant cloud services to support policy-based authorization.
	Region-specific projects	CES ReadOnlyAccess	Policy	Read-only permissions for viewing data on Cloud Eye. The monitoring function of Cloud Eye involves the query of cloud resources, which requires the relevant cloud services to support policy-based authorization.
Web Application Firewall (WAF) (Project-level service)	Region-specific projects	WAF Administrator	Role	Full permissions for WAF.
		WAF FullAccess	Policy	Full permissions for WAF.
		WAF ReadOnlyAccess	Policy	Read-only permissions for WAF.
Host Security Service (HSS) (Project-level service)	Region-specific projects	HSS Administrator	Role	Full permissions for HSS.
		HSS FullAccess	Policy	Full permissions for HSS.
		HSS ReadOnlyAccess	Policy	Read-only permissions for HSS.
Vulnerability Scan Service (VSS) (Project-level service)	Region-specific projects	VSS Administrator	Role	Full permissions for VSS.
Managed Detection and Response (MDR) (Project-level service)	Region-specific projects	SES Administrator	Role	MDR administrator with full permissions. This role must be used together with the BSS Administrator role in the same project.
Database Security Service (DBSS) (Project-level service)	Region-specific projects	DBSS System Administrator	Role	Full permissions for DBSS.
		DBSS Audit Administrator		Security auditing permissions for DBSS.
		DBSS Security Administrator		Security protection permissions for DBSS.
		DBSS FullAccess	Policy	Full permissions for DBSS.
		DBSS ReadOnlyAccess	Policy	Read-only permissions for DBSS. Users granted these permissions can only view this service and cannot configure resources in it.
Data Encryption Workshop (DEW) (Project-level service)	Region-specific projects	KMS Administrator	Role	DEW administrator with full permissions.
		KMS CMKFullAccess	Policy	Full permissions for encryption keys in DEW.
		DEW KeypairFullAccess		Full permissions for key pairs in DEW.
		DEW KeypairReadOnlyAccess		Permissions for viewing key pairs in DEW.
Anti-DDoS (Project-level service)	Region-specific projects	Anti-DDoS Administrator	Role	Full permissions for Anti-DDoS. This role must be used together with the Tenant Guest role in the same project.
Advanced Anti-DDoS (AAD) (Project-level service)	Region-specific projects	CAD Administrator	Role	AAD administrator with full permissions.
Scalable File Service (SFS) (Project-level service)	Region-specific projects	SFS FullAccess	Policy	Full permissions for SFS.
		SFS ReadOnlyAccess		Read-only permissions for SFS.
		SFS Turbo FullAccess		Full permissions for SFS Turbo.
		SFS Turbo ReadOnlyAccess		Read-only permissions for SFS Turbo.
		SFS Administrator	Role	Full permissions for SFS. This role must be used together with the Tenant Guest role in the same project.
Distributed Cache Service (DCS) (Project-level service)	Region-specific projects	DCS FullAccess	Policy	Full permissions for DCS.
		DCS UserAccess		Common user permissions for DCS operations except creating, modifying, deleting, and scaling instances.
		DCS ReadOnlyAccess		Read-only permissions for DCS.
		DCS Administrator	Role	Full permissions for DCS. This role must be used together with the Tenant Guest and Server Administrator roles in the same project.
MapReduce Service (MRS) (Project-level service)	Region-specific projects	MRS FullAccess	Policy	Full permissions for MRS.
		MRS CommonOperations		Common user permissions for MRS operations except creating and deleting resources.
		MRS ReadOnlyAccess		Read-only permissions for MRS.
		MRS Administrator	Role	Full permissions for MRS. This role must be used together with the Tenant Guest and Server Administrator roles in the same project.
ServiceStage Cloud Performance Test Service (CPTS) (Project-level service)	Region-specific projects	ServiceStage Administrator	Role	Permissions for performing operations on test resources of all users in CPTS, such as adding, deleting, modifying, and querying test resources.
		ServiceStage Developer		Permissions for performing operations only on a user's own test resources, such as adding, deleting, modifying, and querying test resources.
		ServiceStage Operator		Users can only read their own test resources.
		ServiceStage FullAccess	Policy	Full permissions for ServiceStage.
		ServiceStage ReadOnlyAccess		Read-only permissions for ServiceStage.
		ServiceStage Development		Developer permissions for ServiceStage, including permissions for performing operations on applications, components, and environments, but excluding approval permissions and permissions for creating infrastructure.
Cloud Service Engine (CSE)	Region-specific projects	CSE FullAccess	Policy	Full permissions for CSE.
Cloud Service Engine (CSE)	Region-specific projects	CSE ReadOnlyAccess	Policy	Read-only permissions for CSE.
Elastic Load Balance (ELB) (Project-level service)	Region-specific projects	ELB FullAccess	Policy	Full permissions for ELB.
		ELB ReadOnlyAccess	Policy	Read-only permissions for ELB.
		ELB Administrator	Role	Full permissions for ELB. This role must be used together with the Tenant Guest role in the same project.
NAT Gateway (Project-level service)	Region-specific projects	NAT FullAccess	Policy	Full permissions for NAT Gateway.
		NAT ReadOnlyAccess	Policy	Read-only permissions for NAT Gateway.
		NAT Gateway Administrator	Role	Full permissions for NAT Gateway. This role must be used together with the Tenant Guest role in the same project.
Direct Connect (Project-level service)	Region-specific projects	Direct Connect Administrator	Role	Full permissions for Direct Connect. This role must be used together with the Tenant Guest role in the same project.
Virtual Private Network (VPN) (Project-level service)	Region-specific projects	VPN Administrator	Policy	Administrator permissions for VPN. This role must be used together with the Tenant Guest and VPC Administrator roles in the same project.
		VPN FullAccess	Policy	Full permissions for VPN.
		VPN ReadOnlyAccess	Policy	Read-only permissions for VPN.
Cloud Backup and Recovery (CBR) (Project-level service)	Region-specific projects	CBR FullAccess	Policy	Administrator permissions for using all vaults and policies on CBR.
		CBR BackupsAndVaultsFullAccess	Policy	Common user permissions for creating, viewing, and deleting vaults on CBR.
		CBR ReadOnlyAccess	Policy	Read-only permissions for viewing data on CBR.
Graph Engine Service (GES) (Project-level service)	Region-specific projects	GES Administrator	Role	Full permissions for GES. This role must be used together with the Tenant Guest and Server Administrator roles in the same project.
		GES Manager		Advanced user of GES with permissions for performing any operations on GES resources except creating and deleting graphs. This role must be used together with the Tenant Guest role in the same project.
		GES Operator		Permissions for viewing and accessing graphs. This role must be used together with the Tenant Guest role in the same project.
	Region-specific projects	GES FullAccess	Policy	Administrator permissions for performing all operations (including creation, deletion, access, and upgrade operations) on GES.
		GES Development		Operator permissions for all operations except creating and deleting graphs.
		GES ReadOnlyAccess		Read-only permissions for viewing resources, such as graphs, metadata, and backup data.
ModelArts (Project-level service)	Region-specific projects	ModelArts FullAccess	Policy	Administrator permissions for performing all operations on ModelArts.
ModelArts (Project-level service)	Region-specific projects	ModelArts CommonOperations	Policy	Permissions for performing all operations except managing dedicated resource pools on ModelArts.
DataArts Studio (Project-level service)	Region-specific projects	DAYU Administrator	Role	Full permissions for DataArts Studio. Users with the DAYU Administrator role have all permissions for workspaces. Only DAYU Administrator has the permission to configure default items of DataArts Factory (including the periodic scheduling, multi-IF policy, hard and soft lock policy, and format of script variables). DAYU User does not have this permission.
DataArts Studio (Project-level service)	Region-specific projects	DAYU User	Role	Common DataArts Studio user. Users with the DAYU User role have the permissions of the role assigned to them in a workspace.
		DAYU User		Common DataArts Studio user. Users with the DAYU User role have the permissions of the role assigned to them in a workspace.
		DWS ReadOnlyAccess		Read-only permissions for DWS.
		DWS Administrator	Role	Full permissions for DWS. This role must be used together with the Tenant Guest and Server Administrator roles in the same project.
		DWS Database Access	Role	Permissions for accessing DWS. Users granted these permissions can generate temporary tokens for connecting to DWS cluster databases.
Data Lake Insight (DLI) (Project-level service)	Region-specific projects	DLI Service Admin	Role	Full permissions for DLI.
Data Lake Insight (DLI) (Project-level service)	Region-specific projects	DLI Service User	Role	Permissions for using DLI, but not for creating resources.
Data Ingestion Service (DIS) (Project-level service)	Region-specific projects	DIS Administrator	Role	Full permissions for DIS.
		DIS Operator		Permissions for managing streams, such as creating and deleting streams, but not for uploading and downloading data.
		DIS User		Permissions for uploading and downloading data, but not for managing streams.
Conversational Bot Service (CBS) (Project-level service)	Region-specific projects	CBS Administrator	Role	Full permissions for CBS.
Conversational Bot Service (CBS) (Project-level service)	Region-specific projects	CBS Guest	Role	Read-only permissions for CBS.
Huawei HiLens (Project-level service)	Region-specific projects	HiLens FullAccess	Policy	Administrator permissions for Huawei HiLens. Users granted these permissions can operate and use all Huawei HiLens resources. If you want to grant permissions for participating in OBT, receiving alarms, and setting skill messages, assign the SMN Administrator role in the same project.
		HiLens CommonOperations		Operation permissions for Huawei HiLens. Users granted these permissions can perform operations on Huawei HiLens, except deregistering devices and suspending skills.
		HiLens ReadOnlyAccess		Read-only permissions for Huawei HiLens. Users granted these permissions can only view Huawei HiLens data. If you want to grant permissions for participating in OBT, receiving alarms, and setting skill messages, assign the SMN Administrator role in the same project.
Trusted Intelligent Computing Service (TICS) (Project-level service)	Region-specific projects	TICS FullAccess	Policy	Full permissions for TICS.
		TICS ReadOnlyAccess		Read-only permissions for TICS.
		TICS CommonOperations		Permissions for managing alliances, jobs, agents, notifications, and datasets in TICS.
Workspace (Project-level service)	Region-specific projects	Workspace Administrator	Role	Full permissions for Workspace. This role must be used together with the Tenant Guest, Server Administrator, and VPC Administrator roles in the same project.
ROMA Connect (Project-level service)	Region-specific projects	ROMA Administrator	Role	Administrator permissions for ROMA Connect. Users granted these permissions can use all ROMA Connect functions. This role must be used together with the following dependence roles in the same project: To use VPC channels, the user must also be assigned the VPC Administrator role. To use FunctionGraph as the backend service of APIs, the user must also be assigned the FunctionGraph Administrator role. To use a rule engine to forward data to DIS, the user must also be assigned the DIS Administrator role.
		ROMA FullAccess	Policy	Full permissions for ROMA Connect. Users granted these permissions can use all ROMA Connect instances.
		ROMA CommonOperations		Common user permissions for ROMA Connect. This policy does not include permissions for creating, modifying, and deleting instances.
		ROMA ReadOnlyAccess		Read-only permissions for ROMA Connect. Users granted these permissions can only view ROMA Connect data.
Intelligent EdgeCloud (IEC) (Global service)	Global service project	IEC FullAccess	Policy	Full permissions for IEC. Users with these permissions can perform any operations on IEC resources.
Intelligent EdgeCloud (IEC) (Global service)	Global service project	IEC ReadOnlyAccess	Policy	Read-only permissions for IEC. Users with these permissions can only view IEC data, for example, viewing the usage of IEC resources.
Professional Services (Global/project-level service)	All projects	PSDMFullAccess	Policy	Full permissions for the Professional Service Delivery Management (PSDM) platform.
Professional Services (Global/project-level service)	All projects	PSDMReadOnlyAccess	Policy	Read-only permissions for the PSDM platform.
ProjectMan (Project-level service)	Region-specific projects	ProjectMan ConfigOperations	Policy	Full permissions for ProjectMan.
Dedicated Host (DeH) (Project-level service)	Region-specific projects	DeH FullAccess	Policy	Full permissions for DeH.
		DeH CommonOperations		Basic operation permissions for DeH.
		DeH ReadOnlyAccess		Read-only permissions for DeH. Users with these permissions can only query DeHs.
Data Security Center (DSC) (Project-level service)	Region-specific projects	DSC FullAccess	Policy	Full permissions for DSC.
		DSC ReadOnlyAccess		Read-only permissions for DSC.
		DSC DashboardReadOnlyAccess		Read-only permissions for the overview page of DSC.
CloudSite (Project-level service)	Region-specific projects	CloudSite FullAccess	Policy	Full permissions for CloudSite.
		CloudSite ReadOnlyAccess		Read-only permissions for CloudSite.
		CloudSite CommonOperations		Basic operation permissions for CloudSite, including the permissions for viewing and modifying site information.
DevCloud (Project-level service)	Region-specific projects	DevCloud Console FullAccess	Policy	Full permissions for the DevCloud console.
DevCloud (Project-level service)	Region-specific projects	DevCloud Console ReadOnlyAccess	Policy	Read-only permissions for the DevCloud console.
ICP License Service (Global service)	Global service project	Beian Administrator	Role	ICP License Service administrator with full permissions.
Voice Call Message & SMS (Project-level service)	Region-specific projects	RTC Administrator	Role	Full permissions for Voice Call, Message & SMS, and Private Number.
Private Number (Project-level service)	Region-specific projects	RTC Administrator	Role	Full permissions for Voice Call, Message & SMS, and Private Number.
		PrivateNumber FullAccess	Policy	Full permissions for Private Number.
		PrivateNumber ReadOnlyAccess	Policy	Read-only permissions for Private Number.
Cloud Data Migration (CDM) (Project-level service)	Region-specific projects	CDM Administrator	Role	Full permissions for CDM. This role must be used together with the Tenant Guest and Server Administrator roles in the same project.
		CDM FullAccess	Policy	Administrator permissions for performing all operations on CDM.
		CDM FullAccessExceptUpdateEIP		Permissions for performing all operations except binding and unbinding EIPs on CDM.
		CDM CommonOperations		Permissions for performing operations on CDM jobs and links.
		CDM ReadOnlyAccess		Read-only permissions for CDM. Users granted these permissions can only view CDM clusters, links, and jobs.
Server Migration Service (SMS) (Global service)	Global service project	SMS FullAccess	Policy	Full permissions for SMS.
Server Migration Service (SMS) (Global service)	Global service project	SMS ReadOnlyAccess	Policy	Read-only permissions for SMS.
Object Storage Migration Service (OMS) (Project-level service)	Region-specific projects	OMS Administrator	Role	Full permissions for OMS. To use OMS, an IAM user must also be assigned the OBS OperateAccess policy.
Cloud Connect (CC) (Global service)	Global service project	Cross Connect Administrator	Role	CC administrator with full permissions. This role must be used together with the Tenant Guest and VPC Administrator roles in the same project.
		CC FullAccess	Policy	Full permissions for CC.
		CC ReadOnlyAccess		Read-only permissions for CC.
		CC Network Depend QueryAccess		Read-only permissions required to access dependency resources when using CC.
Huawei Cloud Real-Time Communication (CloudRTC) (Global service)	Global service project	RTC FullAccess	Policy	Full permissions for CloudRTC.
	Global service project	RTC ReadOnlyAccess	Policy	Read-only permissions for CloudRTC.
Video on Demand (VOD) (Project-level service)	Region-specific projects	VOD Administrator	Role	Full permissions for operations on all media files.
		VOD Group Administrator		Permissions for operations (except global configuration and domain name management) on media files created by users in the current group.
		VOD Group Operator		Permissions for operations (except media review, media deletion, global configuration, and domain name management) on media files created by users in the current group.
		VOD Group Guest		Permissions for querying media files created by users in the current group.
		VOD Operator		Permissions for operations (except media review, global configuration, and domain name management) on video files created by users in the current group.
		VOD Guest		Read-only permissions for VOD.
		VOD FullAccess	Policy	Full permissions for VOD.
		VOD ReadOnlyAccess		Read-only permissions for VOD.
		VOD CommonOperations		Basic operation permissions for VOD, excluding permissions for global configuration, domain name management, permissions management, settings review, and audio and video hosting.
Live (Project-level service)	Region-specific projects	Live FullAccess	Policy	Full permissions for Live
Live (Project-level service)	Region-specific projects	Live ReadOnlyAccess	Policy	Read-only permissions for Live
Face Recognition Service (FRS) (Project-level service)	Region-specific projects	FRS FullAccess	Policy	Full permissions for FRS.
Face Recognition Service (FRS) (Project-level service)	Region-specific projects	FRS ReadOnlyAccess	Policy	Read-only permissions for FRS.
Distributed Database Middleware (DDM) (Project-level service)	Region-specific projects	DDM FullAccess	Policy	Full permissions for DDM.
		DDM CommonOperations		Common permissions for DDM. Users with common permissions cannot perform the following operations: Buying DDM instances Deleting DDM instances Scaling up instances Rolling back instances or clearing data when scale-up fails
		DDM ReadOnlyAccess		Read-only permissions for DDM.
Cloud Search Service (CSS) (Project-level service)	Region-specific projects	Elasticsearch Administrator	Role	Full permissions for CSS. This role must be used together with the Tenant Guest and Server Administrator roles in the same project.
API Gateway (Project-level service)	Region-specific projects	APIG Administrator	Role	Administrator permissions for API Gateway. Users granted these permissions can use all functions of the shared and dedicated gateways. To use VPC channels, the user must also be assigned the VPC Administrator role. To use custom authentication, the user must also be assigned the FunctionGraph Administrator role.
		APIG FullAccess	Policy	Full permissions for API Gateway. Users granted these permissions can use all functions of dedicated API gateways.
		APIG ReadOnlyAccess	Policy	Read-only permissions for API Gateway. Users granted these permissions can only view dedicated API gateways.
Cloud Firewall (CFW) (Project-level service)	Region-specific projects	CFW FullAccess	Policy	Full permissions for CFW.
Cloud Firewall (CFW) (Project-level service)	Region-specific projects	CFW ReadOnlyAccess	Policy	Read-only permissions for CFW.
Message Center (Global service)	Global service project	MessageCenter FullAccess	Policy	Full permissions for Message Center.
		MessageCenter ReadOnlyAccess		Read-only permissions for Message Center.
		MessageCenter RecipientManagement		Message receiving management permissions for Message Center, including permissions for configuring SMS messages, emails, and voice messages, viewing and modifying recipients.

Feedback

Was this page helpful?

Helpful Not helpful

Provide feedback

Thank you very much for your feedback. We will continue working to improve the documentation.

The system is busy. Please try again later.

Which of the following issues have you encountered?

Content is inconsistent with the product UI

Unclear descriptions

Lack of examples or code

Incorrect steps

Can't find what I need

Lack of best practices

Feedback (optional)

0/500

Select at least one type of issue, and enter your comments or suggestions.

Enter a maximum of 500 characters.

Submit Cancel