Introduction

You can use IAM to implement fine-grained permissions management for your NES resources. If your Huawei Cloud account does not need individual IAM users, then you may skip this section.

A policy is a set of permissions defined in JSON format. By default, new IAM users do not have any permissions assigned. You need to add a user to one or more groups, and assign permissions policies to these groups. The user then inherits permissions from the groups it is a member of. This process is called authorization. After authorization, the user can perform specified operations on NES based on the permissions.

You can grant users permissions by using roles and policies. Roles are provided by IAM to define service-based permissions that match users' job responsibilities. Policie are more fine-grained, API-based permissions required to perform operations on specific cloud resources under certain conditions, meeting requirements for secure access control.

For details about the NES policies, see Permissions Management.

Policy-based authorization is useful if you want to allow or deny the access to an API.

Supported Actions

Actions supported by policies are specific to APIs. Common concepts related to policies include:

• Permissions: statements in a policy that allow or deny certain operations
• APIs: APIs that will be called for performing certain operations.
• Actions: specific operations that are allowed or denied
• Dependencies: actions which a specific action depends on. When allowing an action for a user, you also need to allow its dependent actions for that user.
• Supported: IAM projects and enterprise projects

  Type of projects in which policies can be used to grant permissions. A policy can be applied to IAM projects, enterprise projects, or both. Policies that contain actions for both IAM and enterprise projects can be used and applied for both IAM and Enterprise Management. Policies that only contain actions supporting IAM projects can be assigned to user groups and only take effect for IAM. Such policies will not take effect if they are assigned to user groups in Enterprise Management. For details about the differences between IAM and enterprise projects, see What Are the Differences Between IAM and Enterprise Management?