Agency Management (New)

Solution

• Method 1: Use the master account to create a task again because the master account has the Security Administrator permission by default. After the task is created using the master account, an agency is created.
• Method 2: Use the master account to add the Security Administrator permission to the user group to which the member account belongs, and create a task again. For details about how to add permissions, see Creating a User Group and Assigning Permissions.
• Method 3: Use the master account to add a custom policy to the user group to which the member account belongs, and create a task again. The procedure is as follows:
  1. Log in to Huawei Cloud using the master account and click Console in the upper right corner.
  2. On the management console, hover the mouse pointer over the username in the upper right corner, and choose Identity and Access Management from the drop-down list.
  3. On the IAM console, choose Permissions > Policies/Roles from the navigation pane, and click Create Custom Policy in the upper right corner.
  4. Enter a policy name. Configure the following content in the Policy Content area. For details about how to create a custom policy, see Creating a Custom Policy.
     • Creating an agency: iam:agencies:createAgency
     • Querying the agency list: iam:agencies:listAgencies
     • Assigning permissions to an agency: iam:permissions:grantRoleToAgency, iam:permissions:grantRoleToAgencyOnProject and iam:permissions:grantRoleToAgencyOnDomain
     • Querying agency permissions: iam:roles:listRoles, iam:permissions:listRolesForAgencyOnProject and iam:permissions:listRolesForAgencyOnDomain
  5. After the policy is created, add the custom policy created in 4 to the user group to which the member account belongs. Select Global services for Scope. For details about how to add a custom policy, see Creating a User Group and Assigning Permissions.
• Method 4: Manually add an agency. The procedure is as follows:
  1. Log in to Huawei Cloud using the master account and click Console in the upper right corner.
  2. On the management console, hover the mouse pointer over the username in the upper right corner, and choose Identity and Access Management from the drop-down list.
  3. In the navigation pane on the left, click Agencies.
  4. In the upper right corner, click Create Agency.
  5. Enter DRS_AGENTCY in field Agency Name. If you select Account for Agency Type, enter op_svc_rds in field Delegated Account. If you select Cloud service for Agency Type, select MySQL for Delegated Account. Select Unlimited for Validity Period and then click OK.
     
     

  6. On the Select Policy/Role page, select policies based on the task type and click Next in the lower right corner.
     • Self-built tasks: DRS FullAccess
     • To-the-cloud or out-of-cloud tasks: DRS FullAccess and ReadOnlyAccess of the source and destination databases

     For example, for a to-the-cloud migration task from MySQL to MySQL, you need to select the DRS FullAccess and RDS ReadOnlyAccess policies.

     For details about the permissions required by different DB engines, see Table 1.

     Table 1 DB engines and policies

     DB Engine	Authorization Policy
     MySQL	RDS ReadOnlyAccess
     Microsoft SQL Server	RDS ReadOnlyAccess
     PostgreSQL	RDS ReadOnlyAccess
     MongoDB	DDS ReadOnlyAccess
     DDS	DDS ReadOnlyAccess
     GaussDB(DWS)	DWS ReadOnlyAccess
     TaurusDB	GaussDBReadOnlyAccess
     DDM	DDMReadOnlyAccess and RDSReadOnlyAccess
     GaussDB Distributed	GaussDBReadOnlyAccess
     GaussDB Centralized	GaussDBReadOnlyAccess
     GeminiDB Mongo	GeminiDBReadOnlyAccess
     Cassandra	GeminiDBReadOnlyAccess
     GeminiDB Redis	GeminiDBReadOnlyAccess
     MariaDB	RDSReadOnlyAccess
     GeminiDB Cassandra	GeminiDBReadOnlyAccess

     Figure 1 Selecting a policy
     
  7. On the Select Scope page, select the scope for minimum authorization and click OK.
     • You need to select Global services and then Region-specific projects for the DRS FullAccess permission.
     • You need to select Region-specific projects for the ReadOnlyAccess permission of the source and destination databases.
     Figure 2 Authorization for region-specific projects
     
  8. Click the agency name. On the Permissions tab, you can view permissions for the agency.
  9. The authorization takes effect after 15 to 30 minutes.