Permissions Management

If you need to assign different permissions to employees in your enterprise to access your APM resources, Identity and Access Management (IAM) is a good choice for fine-grained permissions management. IAM provides identity authentication, permissions management, and access control, helping you secure access to your cloud resources.

With IAM, you can use your cloud account to create IAM users for your employees, and assign permissions to the users to control their access to specific resources. For example, some software developers in your enterprise need to use APM resources but must not delete them or perform any high-risk operations. To achieve this result, you can create IAM users for the software developers and grant them only the permissions required for using APM resources.

If your cloud account does not need individual IAM users for permissions management, you may skip over this chapter.

IAM can be used free of charge. You pay only for the resources in your cloud account. For more information about IAM, see Identity and Access Management Service Overview.

APM Permissions

By default, new IAM users do not have any permissions assigned. You need to add a user to one or more groups, and assign permissions policies or roles to these groups. The user then inherits permissions from the groups it is a member of. This process is called authorization. After authorization, the user can perform specified operations on APM.

APM is a project-level service deployed and accessed in specific physical regions. To assign APM permissions to a user group, specify the scope as region-specific projects and select projects for the permissions to take effect. If All projects is selected, the permissions will take effect for the user group in all region-specific projects. When accessing APM, the users need to switch to a region where they have been authorized to use this service.

Table 1 lists all the system permissions supported by APM.

**Table 1** System permissions supported by APM
Role	Description	Category
APM FullAccess	Full permissions for APM	System-defined policy
APM ReadOnlyAccess	Read-only permissions for APM	System-defined policy
APM Administrator	Full permissions for APM	System-defined role

Table 2 lists the common operations supported by each system-defined policy or role of APM. Choose appropriate policies or roles as required.

**Table 2** Common operations supported by each system-defined policy or role of APM
Operation	APM FullAccess	APM ReadOnlyAccess	APM Administrator
Obtaining application topology information	√	√	√
Modifying application topology configuration	√	x	√
Deleting application topology configuration	√	x	√
Adding application topology configuration	√	x	√
Obtaining slow SQL analysis results	√	√	√
Obtaining tracing data	√	√	√
Updating tracing configuration	√	x	√
Querying APM configuration	√	√	√
Adding APM configuration	√	x	√
Deleting APM configuration	√	x	√
Querying the ICAgent list	√	√	√
Installing the ICAgent	√	x	√
Querying the ICAgent version	√	√	√
Upgrading the ICAgent version	√	x	√
Uninstalling the ICAgent	√	x	√
Delivering an ICAgent event	√	x	√