Before You Start

Overview

Welcome to Identity and Access Management (IAM). IAM provides identity authentication, permissions management, and access control. With IAM, you can create and manage users and grant them permissions to allow or deny their access to cloud resources.

IAM supports the console access and programmatic access (API access). This document describes how to use APIs to perform operations on IAM, such as creating users and user groups, and obtaining tokens. If you intend to access IAM through APIs, ensure that you are familiar with IAM concepts. For details, see Service Overview.

API Calling

Welcome to Identity and Access Management (IAM). IAM provides identity authentication, permissions management, and access control. With IAM, you can create and manage users and grant them permissions to allow or deny their access to cloud resources.

IAM supports the console access and programmatic access (API access). This document describes how to use APIs to perform operations on IAM, such as creating users and user groups, and obtaining tokens. If you intend to access IAM through APIs, ensure that you are familiar with IAM concepts. For details, see Service Overview.

Endpoints

An endpoint is the request address for calling an API. Endpoints vary depending on services and regions. For the endpoint of each service, see Regions and Endpoints.

Table 1 lists IAM endpoints. IAM is a global service with all data stored in the Global service project. All APIs of IAM can be called using the endpoint of a global service. To facilitate access from region-specific services using APIs or the CLI, IAM provides some APIs for other regions except the Global region. You can use the endpoint of the region closest to you to call these APIs (learn about the Notes and Constraints).

URI Parameters

The following table lists a few API parameters and their names displayed on the console.

Basic Concepts

Common concepts used when you call APIs are described as follows:

• Account

  An account is created upon successful registration with Huawei Cloud. The account has full access permissions for all of its cloud services and resources. It can be used to reset user passwords and grant user permissions. The account is a payment entity and should not be used directly to perform routine management. For security purposes, create IAM users and grant them permissions for routine management.

• IAM user

  An IAM user is created by an account to use cloud services. Each IAM user has its own identity credentials (password or access keys).

  An IAM user can view the account ID and IAM user ID on the My Credentials page of the console. The account name, username, and password will be required for API authentication.

• Region

  Regions are divided based on geographical location and network latency. Public services, such as Elastic Cloud Server (ECS), Elastic Volume Service (EVS), Object Storage Service (OBS), Virtual Private Cloud (VPC), Elastic IP (EIP), and Image Management Service (IMS), are shared within the same region. Regions are classified into universal regions and dedicated regions. A universal region provides universal cloud services for common tenants. A dedicated region provides specific services for specific tenants.

• AZ

  An availability zone (AZ) comprises one or more physical data centers equipped with independent ventilation, fire, water, and electricity facilities. Compute, network, storage, and other resources in an AZ are logically divided into multiple clusters. AZs within a region are interconnected by optical fibers for high-availability networking.

• Project

  Projects group and isolate resources (including compute, storage, and network resources) across physical regions. A default project is provided for each Huawei Cloud region, and subprojects can be created under each default project. Users can be granted permissions to access all resources in a specific project. If you need more refined access control, you can create subprojects under a default project and purchase resources in subprojects. Then you can grant users the permissions required to access only the resources in specific subprojects.

  Figure 1 Project isolating model
  

• Enterprise Project

  Enterprise projects allow you to group and manage resources across regions. Resources in enterprise projects are logically isolated from each other. An enterprise project can contain resources of multiple regions, and you can easily add resources to or remove resources from enterprise projects.

  For details about how to obtain enterprise project IDs and features, see the Enterprise Management User Guide.