Permissions Management

You can use Identity and Access Management (IAM) to manage CTS permissions and control access to your resources. IAM provides identity authentication, permissions management, and access control.

With IAM, you can use your Huawei Cloud account to create IAM users for your employees, and assign permissions to the users to control their access to specific resource types. For example, you can create IAM users for software developers and assign specific permissions to allow them to use CTS resources but prevent them from deleting resources or performing any high-risk operations.

If your Huawei Cloud account does not require IAM users for permissions management, you may skip this section.

IAM can be used free of charge. You pay only for the resources in your account. For details, see IAM Service Overview.

CTS Permissions

By default, new IAM users do not have any permissions assigned. To assign permissions to these new users, add them to one or more groups, and attach permissions policies or roles to these groups.

CTS is a project-level service deployed and accessed in specific physical regions. When assigning CTS permissions to a user group, specify region-specific projects where the permissions will take effect. If you select All projects, the permissions will be granted for all region-specific projects. When accessing CTS, the users need to switch to a region where they have been authorized to use this service.

You can grant users permissions by using roles and policies.

Roles: A type of coarse-grained authorization mechanism that provides only a limited number of service-level roles. When using roles to grant permissions, you also need to assign dependency roles. Roles are not an ideal choice for fine-grained authorization and secure access control.
Policies: A type of fine-grained authorization mechanism that defines permissions required to perform operations on specific cloud resources under certain conditions. This mechanism allows for more flexible policy-based authorization for more secure access control. For example, you can grant ECS users only the permissions for managing a certain type of ECSs. Most policies define permissions based on APIs.

For the API actions supported by CTS, see Table 1.

**Table 1** System-defined roles and policies supported by CTS
Role/Policy Name	Description	Type	Dependency
CTS FullAccess	Full permissions for CTS.	System-defined policy	None
CTS ReadOnlyAccess	Read-only permissions for CTS.	System-defined policy	None
CTS Administrator	Administrator permissions for CTS. Users granted these permissions can perform all operations on CTS. Users with this permission can perform read-only operations on all services except IAM.	System-defined role	This role must be used together with the Tenant Guest and OBS Administrator roles in the same project.

Table 2 lists the common operations supported by each system-defined policy or role of CTS. Select the policies or roles as required.

**Table 2** Common operations supported by system-defined policies or roles
Operation	CTS FullAccess	CTS ReadOnlyAccess	CTS Administrator
Querying traces	√	√	√
Querying quotas	√	√	√
Creating a tracker	√	×	√
Modifying a tracker	√	×	√
Disabling a tracker	√	×	√
Enabling a tracker	√	×	√
Querying a tracker	√	√	√
Deleting a tracker	√	×	√
Creating a key event notification	√	×	√
Modifying a key event notification	√	×	√
Disabling a key event notification	√	×	√
Enabling a key event notification	√	×	√
Querying a key event notification	√	√	√
Deleting a key event notification	√	×	√

Fine-grained Permissions

To use a custom fine-grained policy, log in to IAM as the administrator and select fine-grained permissions of CTS as required. For details about fine-grained permissions of CTS, see Table 3.

**Table 3** CTS fine-grained permissions
Permission	Description	Dependency	Application Scenario
cts:quota:get	Querying the tracker quota of a tenant	-	Querying the tracker quota of a tenant
cts:trace:list	Querying real-time traces	-	Querying records of operations on resources in the last seven days
cts:trace:listResource		-
cts:trace:listTraceUser		-
cts:notification:create	Creating a key event notification	smn:topic:listTopic iam:agencies:listAgencies iam:agencies:createAgency iam:permissions:grantRoleToAgencyOnProject iam:permissions:listRolesForAgencyOnProject iam:projects:listProjects iam:groups:listGroups iam:users:listUsers iam:users:listUsersForGroup	Creating a key event notification
cts:notification:update	Modifying a key event notification		Modifying a key event notification
cts:notification:delete	Deleting a key event notification	-	Deleting a key event notification
cts:notification:list	Querying all key event notifications	-	Querying all key event notifications
cts:tracker:delete	Deleting a tracker	-	Deleting a created tracker
cts:tracker:update	Updating a tracker	iam:agencies:listAgencies iam:agencies:createAgency iam:permissions:grantRoleToAgencyOnProject iam:permissions:listRolesForAgencyOnProject iam:projects:listProjects iam:groups:listGroups iam:users:listUsersForGroup lts:topics:list lts:topics:create lts:topics:get lts:logstreams:list lts:groups:get lts:groups:list lts:groups:create obs:bucket:CreateBucket obs:bucket:HeadBucket obs:bucket:GetLifecycleConfiguration obs:bucket:PutLifecycleConfiguration obs:bucket:GetBucketAcl obs:bucket:PutBucketAcl obs:bucket:ListAllMyBuckets kms:cmk:list kms:cmk:get eps:enterpriseProjects:list organizations:trustedServices:list organizations:organizations:get organizations:deletgatedAdministrators:list organizations:accounts:list organizations:deletgatedServices:list	Modifying configurations of a created tracker
cts:tracker:create	Creating a tracker		Creating a tracker to associate all operations recorded by the system
cts:tracker:list	Querying all trackers	obs:bucket:GetBucketAcl obs:bucket:ListAllMyBuckets	Viewing details of trackers
cts:tag:create	Adding resource tags in batches	-	Adding resource tags in batches
cts:tag:delete	Deleting resource tags in batches	-	Deleting resource tags in batches