Help Center/ Database and Application Migration UGO/ User Guide/ Using IAM to Grant Access to UGO/ Using IAM Roles or Policies to Grant Access to UGO
Updated on 2025-11-15 GMT+08:00
View PDF
Share

Using IAM Roles or Policies to Grant Access to UGO

This section describes how to use IAM to implement fine-grained permissions control for your UGO resources. With IAM, you can:

  • Create IAM users for employees based on your enterprise's organizational structure. Each IAM user will have their own security credentials for accessing UGO resources.
  • Grant only the permissions required for users to perform specific tasks.
  • Entrust a Huawei Cloud account or cloud service to perform efficient O&M on your UGO resources.

If your Huawei Cloud account does not require individual IAM users, skip this section.

Figure 1 describes the process for granting permissions.

Prerequisites

Before assigning permissions to user groups, you should learn about the system-defined roles and policies listed in Supported system roles. For the system policies of other services, see System Permissions.

Process Flow

Figure 1 Process for granting UGO permissions
  1. Create a user group and assign permissions.

    Create a user group on the IAM console, and assign the UGO ReadOnlyAccess policy to the group.

  2. Create an IAM user.

    Create a user on the IAM console and add the user to the group created in 1.

  3. Log in as an IAM user and verify permissions.

    Log in to the management console using the newly created user, and verify that the user only has read permissions for UGO.

    In the service list, choose Databases > Database and Application Migration UGO. On the UGO page, choose Schema Migration > Database Evaluation, and click Create Project to create an evaluation project. If the evaluation project can be created (assume that the current permission contains only UGO Administrator), the evaluation project is UGO Administrator. The permission has taken effect.

    Custom policies

    You are advised to use system-defined policies. To create custom policies, see Permission Management.

    You can create a custom policy in either of the following ways:

    • Visual editor: Select cloud services, actions, resources, and request conditions. This does not require knowledge of policy syntax.
    • JSON: Create a JSON policy or edit an existing one.

    For details, see Creating a Custom Policy. This section contains examples of common UGO custom policies.

Examples of UGO Custom Policies

  • Example 1: Allowing a user to create an evaluation project 
    {	"Version": "1.1",	"Statement": [{		"Action": ["ugo:evaluationJob:create"]                "Effect": "Allow",	}]}
  • Example 2: Denying a user to delete an evaluation project

    A policy with only "Deny" permissions must be used together with other policies. If a permission has both Allow and Deny actions, the Deny action will be applied.

    If you grant the UGO FullAccess identity policy to a user but do not want the user to delete evaluation projects, you can create a custom policy and grant both the UGO FullAccess and custom policies to the user. The user can perform all operations on evaluation projects except deleting them. The following is an example of a deny policy:

    {	"Version": "1.1",	"Statement": [{		"Action": ["ugo:evaluationJob:delete"],		"Effect": "Deny"	}]}