Updated on 2022-12-05 GMT+08:00

Permissions Management

If you need to assign different permissions to employees in your enterprise to access your ServiceStage resources, IAM is a good choice for fine-grained permissions management. IAM provides identity authentication, permissions management, and access control, helping you secure access to your resources.

With IAM, you can use your cloud service account to create IAM users for your employees, and assign permissions to the users to control their access to specific resource types. For example, some software developers in your enterprise need to use ServiceStage resources but must not delete them or perform any high-risk operations. To achieve this result, you can create IAM users for the software developers and grant them only the permissions required for using ServiceStage resources.

If your cloud service account does not need individual IAM users for permissions management, you may skip over this chapter.

IAM can be used free of charge. For more information about IAM, see IAM Service Overview.

ServiceStage Permissions

By default, new IAM users do not have any permissions assigned. You need to add a user to one or more groups, and assign permissions policies to these groups. The user then inherits permissions from the groups it is a member of. This process is called authorization. After authorization, the user can perform specified operations on ServiceStage based on the granted permissions policies.

ServiceStage is a project-level service deployed and accessed in specific physical regions. To assign ServiceStage permissions to a user group, specify the scope as region-specific projects and select projects for the permissions to take effect. If All projects is selected, the permissions will take effect for the user group in all region-specific projects. When accessing ServiceStage, the users need to switch to a region where they have been authorized to use cloud services.

You can grant users permissions by using roles and policies.

  • Roles: A type of coarse-grained authorization mechanism that defines permissions related to user responsibilities. This mechanism provides only a limited number of service-level roles for authorization. When using roles to grant permissions, you also need to assign other roles on which the permissions depend to take effect. However, roles are not an ideal choice for fine-grained authorization and secure access control.
  • Policies are a type of fine-grained authorization mechanism that defines permissions required to perform operations on specific cloud resources under certain conditions. This mechanism allows for more flexible policy-based authorization, meeting requirements for secure access control.

Table 1 lists all the system policies supported by ServiceStage.

Table 1 Permissions description

Role/Policy Name

Description

Type

Dependencies

ServiceStage FullAccess

Full permissions for ServiceStage.

System-defined policy

None

ServiceStage Developer

ServiceStage developer, who has permissions to perform operations on applications, components, and environments, but does not have permissions to approve applications or create infrastructure. .

System-defined policy

None

ServiceStage ReadOnlyAccess

Read-only permissions for ServiceStage.

System-defined policy

None

CSE Admin

Administrator permissions for CSE.

System-defined policy

None

CSE Viewer

View permissions for CSE.

System-defined policy

None

If these policies do not meet actual requirements, you can customize policies. For more information, see Creating a Custom Policy.

Table 2 lists the common operations supported by each system-defined policy of ServiceStage. Please choose proper system-defined policies according to this table.

Table 2 Common operations supported by each system policy

Operation

ServiceStage ReadOnlyAccess

ServiceStage Developer

ServiceStage FullAccess

CSE Viewer

CSE Admin

Creating an application

x

x

x

Modifying an application

x

x

x

Querying an application

x

x

Deleting an application

x

x

x

Creating a component

x

x

x

Searching for a component

x

x

Deploying a component

x

x

x

Maintaining a component

x

x

x

Deleting a component

x

x

x

Creating a build job

x

x

x

Modifying a build job

x

x

x

Querying a build job

x

x

Starting a build job

x

x

x

Deleting a build job

x

x

x

Creating a pipeline

x

x

x

Modifying a pipeline

x

x

x

Querying a pipeline

x

x

Starting a pipeline

x

x

x

Cloning a pipeline

x

x

x

Deleting a pipeline

x

x

x

Creating repository authorization

x

x

x

Modifying repository authorization

x

x

x

Querying repository authorization

x

x

Deleting repository authorization

x

x

x

Creating a microservice engine

x

x

x

Maintaining a microservice engine

x

x

x

Querying a microservice engine

Deleting a microservice engine

x

x

x

Registering a microservice

x

Configuring a microservice

x

Governing a microservice

x

x

SWR does not support fine-grained permissions. Related permissions need to be authorized separately.

To use a custom fine-grained policy, log in to the IAM console as an administrator and select the desired fine-grained permissions for ServiceStage, and CSE.

  • Table 3 describes fine-grained permission dependencies of CSE.
  • Table 4 describes fine-grained permission dependencies of ServiceStage.
Table 3 Fine-grained permission dependencies of CSE

Permission Name

Description

Permission Dependency

Application Scenario

cse:engine:list

Lists all microservice engines.

None

Engine list view

cse:engine:get

Views engine information.

cse:engine:list

Engine details view (supported by only exclusive microservice engines)

cse:engine:modify

Modifies an engine.

  • cse:engine:list
  • cse:engine:get

Engine modification, including enabling or disabling public access, enabling or disabling security authentication, and retrying failed tasks, supported by only exclusive microservice engines

cse:engine:upgrade

Upgrades an engine.

  • cse:engine:list
  • cse:engine:get

Engine upgrade, including upgrading the engine version supported by only exclusive microservice engines.

cse:engine:delete

Deletes an engine.

  • cse:engine:list
  • cse:engine:get

Engine deletion (supported by only exclusive microservice engines.)

cse:engine:create

Creates an engine.

  • cse:engine:get
  • cse:engine:list

Engine creation, including creating an engine and creating a backup or restoration task, supported by only exclusive microservice engines.

cse:config:modify

Modifies configuration and management functions.

  • cse:engine:list
  • cse:engine:get
  • cse:config:get

Modification on global and governance configurations

cse:config:get

Views configuration and management functions.

  • cse:engine:list
  • cse:engine:get

Service configuration view

cse:governance:modify

Modifies the governance center.

  • cse:engine:list
  • cse:engine:get
  • cse:config:get
  • cse:config:modify
  • cse:registry:get
  • cse:registry:modify
  • cse:governance:get

Service governance creation and modification

cse:governance:get

Views the governance center.

  • cse:engine:list
  • cse:engine:get
  • cse:config:get
  • cse:registry:get

Service governance view

cse:registry:modify

Modifies service registry and management.

  • cse:engine:list
  • cse:engine:get
  • cse:registry:get

Service modification

cse:dashboard:modify

Modifies the dashboard.

  • cse:engine:list
  • cse:engine:get
  • cse:registry:get
  • cse:dashboard:get
  • cse:registry:modify

Dashboard modification

cse:dashboard:get

Views the dashboard.

  • cse:engine:list
  • cse:engine:get
  • cse:registry:get

Dashboard view

cse:registry:get

Views service registry and management.

  • cse:engine:list
  • cse:engine:get

Service catalog view

The dashboard does not need to be authenticated but requires registry permissions, because it uses the service catalog function to distinguish services.

Table 4 Fine-grained permission dependencies of ServiceStage

Permission Name

Description

Permission Dependency

Application Scenario

servicestage:app:get

Views application information.

None

Application information view

servicestage:app:create

Creates an application.

None

Application creation

servicestage:app:modify

Updates an application.

None

Application update

servicestage:app:delete

Deletes an application.

None

Application deletion

servicestage:app:list

Views the environment and application list.

None

Environment and application list view

servicestage:environment:create

Creates an environment.

None

Environment creation

servicestage:environment:modify

Updates an environment.

None

Environment update

servicestage:environment:delete

Deletes an environment.

None

Environment deletion

servicestage:pipeline:get

Views pipeline information.

None

Pipeline information view

servicestage:pipeline:create

Creates a pipeline.

None

Pipeline creation

servicestage:pipeline:modify

Modifies a pipeline.

None

Pipeline modification

servicestage:pipeline:delete

Deletes a pipeline.

None

Pipeline deletion

servicestage:pipeline:list

Views the pipeline list.

None

Pipeline list view

servicestage:pipeline:execute

Executes a pipeline.

None

Pipeline execution.

servicestage:assembling:get

Views the build information.

None

Build information view

servicestage:assembling:create

Creates a build job.

None

Build job creation.

servicestage:assembling:modify

Modifies a build job.

None

Build job modification

servicestage:assembling:delete

Deletes a build job.

None

Build job deletion

servicestage:assembling:list

Views the build list.

None

Build list view