Help Center/ Edge Security/ User Guide/ Using IAM to Grant Access to Edgesec/ Using IAM Identity Policies to Grant Access to EdgeSec
Updated on 2026-01-09 GMT+08:00
View PDF
Share

Using IAM Identity Policies to Grant Access to EdgeSec

System-defined permissions in identity policy-based authorization provided by Identity and Access Management (IAM) let you control access to EdgeSec. With IAM, you can:

  • Create IAM users for employees based on your enterprise's organizational structure. Each IAM user will have their own security credentials for accessing EdgeSec resources.
  • Grant only the permissions required for users to perform a specific task.
  • Entrust other Huawei Cloud accountaccount or cloud service to perform professional and efficient O&M on your EdgeSec resources.

If your account meets your permissions requirements, you can skip this section.

Figure 1 shows the process flow of identity policy-based authorization.

Prerequisites

Before granting permissions, learn about the EdgeSec permissions and select them as required. For details about the system-defined identity policies supported by EdgeSec, see Identity Policy-based Permissions Management. To grant permissions for other services, learn about all system-defined permissions supported by IAM.

Process

Figure 1 Process of granting EdgeSec permissions
  1. Creating a User or Creating a User Group

    Create a user or user group on the IAM console.

  2. Attach a system identity policy to a user or user group.

    Assign the system-defined identity policy EdgeSecReadOnlyPolicy to the user or user group.

  3. Log in and verify the user's permissions.

    In the authorized region, perform the following operations:

    • In the Service List, choose CDN and Security. In the navigation pane, choose Security. On the Edge Security page, click Subscribe. If EdgeSec cannot be purchased (assume that the current permission contains only EdgeSecReadOnlyPolicy), the EdgeSecReadOnlyPolicy policy has taken effect.
    • Choose any other service from Service List. If a message appears indicating that you do not have permissions to access the service, the EdgeSecFullAccessPolicy policy has already taken effect.

Example Custom Identity Policies for EdgeSec

If the system-defined policies of EdgeSec cannot meet your needs, you can create custom identity policies. Add actions in custom identity policies as needed. For details about supported actions, see Permissions Policies and Supported Actions.

You can create custom identity policies on Huawei Cloudthe cloud platform in either of the following ways:

  • Visual editor: Select cloud services, actions, resources, and request conditions without the need to know policy syntax.
  • JSON: Create a JSON policy or edit an existing one.

For details, see Creating a Custom Identity Policy and Attaching It to a Principal.

  • Example 1: Grant permission to create protection policies. 
    {
  "Version": "5.0",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": [
        "edgesec:protectionRule:createPolicy"
      ]
    }
  ]
}
  • Example 2: Create a custom identity policy containing multiple actions.

    A custom identity policy can contain the actions of multiple services. The following is an example policy containing actions of multiple services:

    {
    "Version": "5.0",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "edgesec:protectionRule:createPolicy"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                ""cdn:configuration:query*","
            ]
        }
    ]
}
Parent Topic: Using IAM to Grant Access to Edgesec