Permissions and Supported Actions

This chapter describes fine-grained permissions management for your RFS resources. If your account does not need individual IAM users, you can skip the operations in this chapter.

By default, new IAM users do not have permissions assigned. You need to add a user to one or more groups, and attach permissions policies or roles to these groups. Users inherit permissions from the groups to which they are added and can perform specified operations on cloud services based on the permissions.

You can grant users permissions by using roles and policies. Roles are a type of service-based, coarse-grained authorization mechanism that defines permissions related to user responsibilities. Policies define API-based permissions for operations on specific resources under certain conditions, allowing for more fine-grained, secure access control of cloud resources.

If you want to allow or deny the access to an API, fine-grained authorization is a good choice.

An account has all the permissions required to call all APIs, but IAM users must be assigned the permissions to call the required APIs. The permissions required for calling an API are determined by the actions supported by the API. Only users who have been granted permissions can call the API successfully. For example, if an IAM user wants to query ECSs using an API, the user must have been granted permissions that allow the ecs:servers:list action.

Supported Actions in IAM

IAM provides system-defined policies that can be directly used. You can also create custom policies to supplement system-defined policies for more refined access control. Operations supported by policies are specific to APIs. The following are common concepts related to policies:

Permission: a statement in a policy that allows or denies certain operations.
APIs: APIs that can be called in a custom policy.
Actions: added to a custom policy to control permissions for specific operations.
Dependent actions: actions on which a specific action depends to take effect. When assigning permissions for the action to a user, you also need to assign permissions for the dependent actions.
IAM project/Enterprise project: An action in a custom policy can be applied to either or both of these projects. Policies that contain actions supporting both IAM and enterprise projects can be assigned to user groups and take effect in both IAM and Enterprise Management. Policies that only contain actions supporting IAM projects can be assigned to user groups and only take effect for IAM. Such policies will not take effect if they are assigned to user groups in enterprise management. For details about the differences between IAM and enterprise projects, see What Are the Differences Between IAM and Enterprise Management?

The check mark (√) and cross symbol (x) respectively indicate that an action takes effect or does not take effect for the corresponding type of projects.

RFS supports the following actions in custom policies.

**Table 1** Private template
Permission	API	Action	IAM Project	Enterprise Project
Create private templates	POST /v1/{project_id}/templates	rf:privateTemplate:create	√	x
Create a private template version	POST /v1/{project_id}/templates/{template_name}/versions	rf:privateTemplate:createVersion	√	x
Delete a private template	DELETE /v1/{project_id}/templates/{template_name}	rf:privateTemplate:delete	√	x
Delete a private template version	DELETE /v1/{project_id}/templates/{template_name}/versions/{version_id}	rf:privateTemplate:deleteVersion	√	x
List all private templates in a project	GET /v1/{project_id}/templates	rf:privateTemplate:list	√	x
Display all versions of a private template	GET /v1/{project_id}/templates/{template_name}/versions	rf:privateTemplate:listVersions	√	x
Display private template information	GET /v1/{project_id}/templates/{template_name}/metadata	rf:privateTemplate:showMetadata	√	x
Obtain the content of a private template version	GET /v1/{project_id}/templates/{template_name}/versions/{version_id}	rf:privateTemplate:showVersionContent	√	x
Obtain the metadata of a private template version	GET /v1/{project_id}/templates/{template_name}/versions/{version_id}/metadata	rf:privateTemplate:showVersionMetadata	√	x
Update the metadata of a private template	PATCH /v1/{project_id}/templates/{template_name}/metadata	rf:privateTemplate:updateMetadata	√	x

**Table 2** Stack
Permission	API	Action	IAM Project	Enterprise Project
Apply an execution plan	POST /v1/{project_id}/stacks/{stack_name}/execution-plans/{execution_plan_name}	rf:stack:applyExecutionPlan	√	x
Continue to deploy a stack	POST /v1/{project_id}/stacks/{stack_name}/continuations	rf:stack:continueDeployStack	√	x
Continue to roll back a stack	POST /v1/{project_id}/stacks/{stack_name}/rollbacks	rf:stack:continueRollbackStack	√	x
Create an execution plan	POST /v1/{project_id}/stacks/{stack_name}/execution-plans	rf:stack:createExecutionPlan	√	x
Create a stack	POST /v1/{project_id}/stacks	rf:stack:createStack	√	x
Delete an execution plan	DELETE /v1/{project_id}/stacks/{stack_name}/execution-plans/{execution_plan_name}	rf:stack:deleteExecutionPlan	√	x
Delete a stack	DELETE /v1/{project_id}/stacks/{stack_name}	rf:stack:deleteStack	√	x
Deploy a stack	PATCH /v1/{project_id}/stacks/{stack_name}/deployment	rf:stack:deployStack	√	x
Estimate the price of an execution plan	GET /v1/{project_id}/stacks/{stack_name}/execution-plans/{execution_plan_name}/prices	rf:stack:estimateExecutionPlanPrice	√	x
Obtain execution plans	GET /v1/{project_id}/stacks/{stack_name}/execution-plans/{execution_plan_name}	rf:stack:getExecutionPlan	√	x
Obtain execution plan metadata	GET /v1/{project_id}/stacks/{stack_name}/execution-plans/{execution_plan_name}/metadata	rf:stack:getExecutionPlanMetadata	√	x
Obtain an execution plan template	GET /v1/{project_id}/stacks/{stack_name}/execution-plans/{execution_plan_name}/templates	rf:stack:getExecutionPlanTemplate	√	x
Obtain stack metadata	GET /v1/{project_id}/stacks/{stack_name}/metadata	rf:stack:getStackMetadata	√	x
Obtain a stack template	GET /v1/{project_id}/stacks/{stack_name}/templates	rf:stack:getStackTemplate	√	x
Import stack resources	PATCH /v1/{project_id}/stacks/{stack_name}/resources	rf:stack:importResources	√	x
Query execution plans	GET /v1/{project_id}/stacks/{stack_name}/execution-plans	rf:stack:listExecutionPlans	√	x
Query deployment events of a stack	GET /v1/{project_id}/stacks/{stack_name}/events	rf:stack:listStackEvents	√	x
Query stack outputs	GET /v1/{project_id}/stacks/{stack_name}/outputs	rf:stack:listStackOutputs	√	x
Query stack resources	GET /v1/{project_id}/stacks/{stack_name}/resources	rf:stack:listStackResources	√	x
Query stacks	GET /v1/{project_id}/stacks	rf:stack:listStacks	√	x
Update a stack	PATCH /v1/{project_id}/stacks/{stack_name}	rf:stack:updateStack	√	x
Modify stack deletion protection	PUT /v1/{project_id}/stacks/{stack_name}/deletion-protections	rf:stack:updateStackDeletionProtection	√	x

**Table 3** Stack set
Permission	API	Action	IAM Project	Enterprise Project
Create a stack set	POST /v1/stack-sets	rf:stackSet:create	√	x
Create stack instances	POST /v1/stack-sets/{stack_set_name}/stack-instances	rf:stackSet:createStackInstances	√	x
Delete a stack set	DELETE /v1/stack-sets/{stack_set_name}	rf:stackSet:delete	√	x
Delete stack instances	DELETE /v1/stack-sets/{stack_set_name}/stack-instances	rf:stackSet:deleteStackInstances	√	x
Deploy a stack set	POST /v1/stack-sets/{stack_set_name}/deployments	rf:stackSet:deploy	√	x
Query stack sets	GET /v1/stack-sets	rf:stackSet:list	√	x
Query stack set operations	GET /v1/stack-sets/{stack_set_name}/operations	rf:stackSet:listOperations	√	x
Query stack instances	GET /v1/stack-sets/{stack_set_name}/stack-instances	rf:stackSet:listStackInstances	√	x
Obtain metadata of a stack set	GET /v1/stack-sets/{stack_set_name}/metadata	rf:stackSet:showMetadata	√	x
Obtain metadata of a stack set operation	GET /v1/stack-sets/{stack_set_name}/operations/{stack_set_operation_id}/metadata	rf:stackSet:showOperationMetadata	√	x
Obtain a stack instance	GET /v1/stack-sets/{stack_set_name}/stack-instances/{stack_instance_addr}	rf:stackSet:showStackInstance	√	x
Obtain a stack set template	GET /v1/stack-sets/{stack_set_name}/templates	rf:stackSet:showTemplate	√	x
Update a stack set	PATCH /v1/stack-sets/{stack_set_name}	rf:stackSet:update	√	x
Update stack instances	PATCH /v1/stack-sets/{stack_set_name}/stack-instances	rf:stackSet:updateStackInstances	√	x