How Do I Adjust Agency Permissions of My Service?

Due to account security concerns, unnecessary agency permissions should be deleted for your enhanced Hyperledger Fabric instances.

The procedure is as follows.

1. Log in to the IAM console, click Agencies, and search for bcs_admin_trust.
2. Click Modify.
3. Go to the Permissions tab page and confirm that the following permissions have been correctly configured:
   • Configuration of BCS agency policy for global:

     {
         "Version": "1.1",
         "Statement": [
             {
                 "Effect": "Allow",
                 "Action": [
                     "obs:object:DeleteObject",
                     "obs:bucket:HeadBucket",
                     "obs:object:PutObject",
                     "obs:bucket:CreateBucket"
                 ]
             }
         ]
     }

   • Configuration of BCS agency policy for project:

     {
         "Version": "1.1",
         "Statement": [
             {
                 "Action": [
                     "cce:cluster:get",
                     "cce:node:list",
                     "ecs:cloudServers:listServerInterfaces",
                     "ecs:cloudServers:list",
                     "ecs:serverInterfaces:get",
                     "vpc:publicIps:list",
                     "vpc:publicIps:update",
                     "vpc:ports:get",
                     "cbr:vaults:delete",
                     "cbr:vaults:get",
                     "cbr:vaults:removeResources",
                     "cbr:vaults:addResources",
                     "cbr:vaults:create",
                     "cbr:vaults:update",
                     "cbr:vaults:backup",
                     "cbr:backups:delete",
                     "cbr:backups:list",
                     "evs:volumes:list",
                     "sfsturbo:shares:getShare"
                 ],
                 "Effect": "Allow"
             }
         ]
     }

4. Delete the following unnecessary permissions:
   • SFS Administrator
   • ECS FullAccess
   • VPC Administrator
   • EPS FullAccess
   • CCE Administrator
   • AOM FullAccess
   • APM FullAccess
   • OBS Administrator
   • CBR FullAccess
   • BCS Administrator