Using IAM Identity Policies to Grant Access to Direct Connect

Prerequisites

You have learned about system-defined permissions supported by Direct Connect. Before granting permissions, learn about system-defined permissions in Identity Policy-based Authorization. To grant permissions for other services, learn about all system-defined permissions.

Process Flow

Figure 1 Process for granting Direct Connect permissions

1. On the IAM console, create an IAM user or create a user group.

   Log in to the IAM console to create a user or user group.

2. Attach a system-defined identity policy (DCAASReadOnlyPolicy as an example) to the user or user group.
3. Log in as the IAM user and verify permissions.

   Log in to the Direct Connect console as the authorized user and verify permissions.

   • Go to the connection list page and click Create Connection in the upper right corner. If the connection cannot be created, the DCAASReadOnlyPolicy policy has already taken effect.
   • Choose any other service in Service List. If a message appears indicating that you have insufficient permissions to access the service, the DCAASReadOnlyPolicy policy has already taken effect.

Example Custom Identity Policies

You can create custom identity policies to supplement system-defined identity policies. For the actions supported for custom identity policies, see "Identity Policy-Based Authorization" in the Direct Connect API Reference.

You can create custom identity policies in either of the following ways:

• Visual editor: Select cloud services, actions, resources, and conditions. This does not require knowledge of policy grammar.
• JSON: Edit JSON policies from scratch or based on an existing policy.

For details, see Creating a Custom Identity Policy and Attaching It to a Principal.

When creating a custom Identity policy, use the Resource element to specify the resources the policy applies to and use the Condition element (service-specific condition keys) to control when the policy is in effect. For details about the supported resource types and condition keys, see "Supported Actions in Identity Policy-based Authorization" in the Direct Connect API Reference. The following are example custom identity policies created for Direct Connect.

• Example 1: Granting permission to create and modify connections

  {
      "Version": "5.0",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "dcaas:directConnect:create",
                  "dcaas:directConnect:update"
              ]
          }
      ]
  }

• Example 2: Create a custom identity policy that contains multiple actions.

  A custom identity policy can contain the actions of one or multiple services. The following is an example policy containing actions of multiple services:

  {
      "Version": "5.0",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "dcaas:directConnect:create",
                  "dcaas:directConnect:update",
                  "dcaas:vgw:create",
                  "dcaas:vif:create"
              ]
          },
          {
              "Effect": "Allow",
              "Action": [
                  "vpc:vpcs:create",
                  "vpc:vpcs:update",
                  "vpc:subnets:create",
                  "vpc:subnets:update"
              ]
          },
          {
              "Effect": "Deny",
              "Action": [
                  "dcaas:vgw:delete",
                  "dcaas:vif:delete"
              ]
          }
      ]
  }