Help Center/ Identity and Access Management/ FAQs/ Basic Concepts/ What Are the Differences Between Identity Policies and Policies?
Updated on 2026-09-23 GMT+08:00
View PDF
Share

What Are the Differences Between Identity Policies and Policies?

This section introduces the differences between Huawei Cloud identity policies and policies.

Identity Policy

IAM 5.0 supports an identity-policy-based authorization model. Compared with role- and policy-based models, it enables finer-grained and more precise security control. The core relationship in this model is user–identity policy. When new resources are added, identity-policy authorization can grant permissions to users more quickly and flexibly than role/policy models. This approach provides greater flexibility and simplifies permission assignment. However, it also makes the overall permission management model more complex and requires a higher level of expertise from administrators, making it more suitable for medium-to-large enterprises. Each request is evaluated according to policy evaluation logic to allow or deny. For more on policies, see Basic Concepts About Permissions.

Policy

IAM 2.0 supports role- and policy-based authorization. Roles are the original coarse-grained mechanism defining permissions by job function; policies are the later fine-grained capability precise to operations, resources, and conditions. Policy-based authorization is more flexible and meets least-privilege requirements. For example, for ECS, an administrator can limit an IAM user to specified management operations on a certain type of cloud server. Policies include system policies and custom policies. For more, see IAM Permission Basic Concepts.

Parent topic: Basic Concepts