Configuring Agency Permissions

Overview

FunctionGraph works with other cloud services in most scenarios. Create a cloud service agency so that FunctionGraph can perform resource O&M in other cloud services on your behalf.

Scenario

Before using FunctionGraph, create an agency and select the required action by referring to Table 1.

Creating an Agency

In the following example, the Tenant Administrator permission is assigned to FunctionGraph and this setting takes effect only in the authorized regions.

Create an agency by referring to Creating an Agency and set parameters as follows:

1. Log in to the IAM console.
2. On the IAM console, choose Agencies from the navigation pane, and click Create Agency in the upper right corner.
   Figure 1 Creating an agency
   
3. Configure the agency.
   Figure 2 Setting basic information
   
   • For Agency Name, enter serverless-trust.
   • For Agency Type, select Cloud service.
   • For Cloud Service, select FunctionGraph.
   • For Validity Period, select Unlimited.
   • Description: Enter the description.

4. Click Next. On the displayed page, search for the permissions to be added in the search box on the right and select the permissions. The Tenant Administrator permission is used as an example.
   Figure 3 Selecting policies
   

   Table 2 Example of agency permissions

   Policy Name	Scenario
   Tenant Administrator	Administrator for all cloud services except IAM. This user can perform any operations on all cloud resources of the enterprise.

5. Click Next and select the scope.

Configuring an Agency

1. Log in to the FunctionGraph console. In the navigation pane, choose Functions > Function List.
2. Click the function to be configured to go to the function details page.
3. Choose Configuration > Permissions, click Create Agency, and set an agency based on site requirements by referring to 2–5.

   Table 3 Agency configuration parameters

   Parameter	Description
   Configuration Agency	Select a function that you have created.
   Execution Agency	Mandatory if you select Specify an exclusive agency for function execution.

   

   • To ensure optimal performance, select Specify an exclusive agency for function execution and set different agencies for function configuration and execution. You can also use no agency or specify the same agency for both purposes. Figure 4 shows the agency options.
     Figure 4 Setting agencies
     
   • Configuration Agency: For example, to create Data Ingestion Service (DIS) triggers, first specify an agency with DIS permissions. If such an agency is not specified or the specified agency does not exist, no DIS triggers can be created.
   • Execution Agency: This type of agency enables you to obtain a token and AK/SK from the context in the function handler for accessing other cloud services.

4. Click Save.

Modifying an Agency

Modifying an agency: You can modify the permissions, validity period, and description of an agency on the IAM console.

After an agency is modified, it takes about 10 minutes for the modification (for example, context.getToken) to take effect.