Permissions

If you need to grant your enterprise personnel permission to access your CTS resources, use Identity and Access Management (IAM). IAM provides identity authentication, fine-grained permissions management, and access control. IAM helps you secure access to your Huawei Cloud resources.

With IAM, you can create IAM users and assign permissions to control their access to specific resources. For example, if you want some software developers in your enterprise to be able to use CTS resources but do not want them to be able to delete CTS resources or perform any other high-risk operations, you can create IAM users and grant permission to use CTS resources but not permission to delete them.

If your Huawei Cloud account does not require individual IAM users for permissions management, you can skip this section.

IAM is a free service. You only pay for the resources in your account. For details, see IAM Service Overview.

CTS Permissions

New IAM users do not have any permissions assigned by default. You need to first add them to one or more groups and then attach policies or roles to these groups. The users then inherit permissions from the groups and can perform specified operations on cloud services based on the permissions they have been assigned.

CTS is a project-level service deployed for specific regions. To assign CTS permissions to a user group, specify the scope as region-specific projects and select projects for the permissions to take effect. If All projects is selected, the permissions will take effect for the user group in all region-specific projects. When accessing CTS, the users need to switch to the authorized region.

You can grant users permissions by using roles and policies.

Roles: A coarse-grained authorization strategy that defines permissions by job responsibility. Only a limited number of service-level roles are available for authorization. Cloud services often depend on each other. When you grant permissions using roles, you also need to attach any existing role dependencies. Roles are not ideal for fine-grained authorization and least privilege access.
Policies: A fine-grained authorization strategy that defines permissions required to perform operations on specific cloud resources under certain conditions. This type of authorization is more flexible and is ideal for least privilege access. For example, you can grant users only permission to manage a certain type of CTS resources. A majority of fine-grained policies contain permissions for specific APIs, and permissions are defined using API actions. For the API actions supported by CTS, see Permissions Policies and Supported Actions.

Table 1 lists all the system-defined permissions for CTS.

**Table 1** System-defined permissions for CTS
Role/Policy Name	Description	Type	Dependencies
CTS FullAccess	Full permissions for CTS.	System-defined policy	None
CTS ReadOnlyAccess	Read-only permissions for CTS.	System-defined policy	None
CTS Administrator	Administrator permissions for CTS. Users granted these permissions can perform all operations on CTS. Users with this permission can perform read-only operations on all services except IAM.	System-defined role	This role must be used together with the Tenant Guest, OBS Administrator, and Security Administrator roles in the same project.

Table 2 lists the common operations supported by system-defined permissions for CTS.

**Table 2** Common operations supported by system-defined permissions
Operation	CTS FullAccess	CTS ReadOnlyAccess	CTS Administrator
Querying traces	√	√	√
Querying quotas	√	√	√
Creating a tracker	√	×	√
Modifying a tracker	√	×	√
Disabling a tracker	√	×	√
Enabling a tracker	√	×	√
Querying a tracker	√	√	√
Deleting a tracker	√	×	√
Creating a key event notification	√	×	√
Modifying a key event notification	√	×	√
Disabling a key event notification	√	×	√
Enabling a key event notification	√	×	√
Querying a key event notification	√	√	√
Deleting a key event notification	√	×	√
Adding tags in batches	√	×	√
Deleting tags in batches	√	×	√

Fine-grained Permissions

To use a custom fine-grained policy, log in to IAM as the administrator and select fine-grained permissions of CTS as required. For details about fine-grained permissions of CTS, see Table 3.

**Table 3** CTS fine-grained permissions
Permission	Description	Dependency	Application Scenario
cts:quota:get	Querying the tracker quota of a tenant	-	Querying the tracker quota of a tenant
cts:trace:list	Querying real-time traces	-	Querying records of operations on resources in the last seven days
cts:trace:listResource		-
cts:trace:listTraceUser		-
cts:notification:create	Creating a key event notification	smn:topic:listTopic iam:agencies:listAgencies iam:agencies:createAgency iam:permissions:grantRoleToAgencyOnProject iam:permissions:listRolesForAgencyOnProject iam:projects:listProjects iam:groups:listGroups iam:users:listUsers iam:users:listUsersForGroup	Creating a key event notification
cts:notification:update	Modifying a key event notification		Modifying a key event notification
cts:notification:delete	Deleting a key event notification	-	Deleting a key event notification
cts:notification:list	Querying all key event notifications	-	Querying all key event notifications
cts:tracker:delete	Deleting a tracker	-	Deleting a created tracker
cts:tracker:update	Updating a tracker	iam:agencies:listAgencies iam:agencies:createAgency iam:permissions:grantRoleToAgencyOnProject iam:permissions:listRolesForAgencyOnProject iam:projects:listProjects iam:groups:listGroups iam:users:listUsersForGroup lts:topics:list lts:topics:create lts:topics:get lts:logstreams:list lts:groups:get lts:groups:list lts:groups:create obs:bucket:CreateBucket obs:bucket:HeadBucket obs:bucket:GetLifecycleConfiguration obs:bucket:PutLifecycleConfiguration obs:bucket:GetBucketAcl obs:bucket:PutBucketAcl obs:bucket:ListAllMyBuckets kms:cmk:list kms:cmk:get eps:enterpriseProjects:list organizations:trustedServices:list organizations:organizations:get organizations:deletgatedAdministrators:list organizations:accounts:list organizations:deletgatedServices:list	Modifying configurations of a created tracker
cts:tracker:create	Creating a tracker		Creating a tracker to associate all operations recorded by the system
cts:tracker:list	Querying all trackers	obs:bucket:GetBucketAcl obs:bucket:ListAllMyBuckets	Viewing details of trackers
cts:tag:create	Adding resource tags in batches	-	Adding resource tags in batches
cts:tag:delete	Deleting resource tags in batches	-	Deleting resource tags in batches