- What's New
- Function Overview
- Service Overview
- Billing
- Getting Started
-
User Guide
- Service Provisioning
- Allowing or Disallowing Access to Cloud Assets
- Asset Map
- Asset Management
- Sensitive Data Identification
- Policy Center
- Data Asset Protection
- Data Security Operations
- Alarm Notifications
- Multi-Account Management
- Permissions Management
- Key DSC Operations
- Best Practices
-
API Reference
- Before You Start
- Calling APIs
-
API Description
- Data Watermarking
- Resource Management
- Dynamic Data Masking
- Alarm Notifications
-
Image Watermarking
- Injecting Invisible Watermarks into Images
- Extracting Invisible Text Watermarks
- Extracting Invisible Watermarks from Images
- Injecting Invisible Watermarks into Images (Image Addresses)
- Extracting Dark Watermarks from Images (Image Addresses)
- Extracting Invisible Image Watermarks from Images (Image Addresses)
- Asset Management
- Document Watermarking
-
Sensitive Data Discovery
- Querying the Identification Task List
- Querying the Result of an Identification Task
- Viewing the Rule List
- Creating a Sensitive Data Scanning Rule
- Modifying a Sensitive Data Scanning Rule
- Deleting a Sensitive Data Scanning Rule
- Querying Sensitive Data Scanning Rule Groups
- Creating a Sensitive Data Scanning Rule Group
- Deleting a Sensitive Data Scanning Rule Group
- Creating a Sensitive Data Scanning Task
- Deleting a Sensitive Data Scanning Task
- Static Data Masking
- API Call Records
- Appendixes
- SDK Reference
-
FAQs
- Product Consulting
- Regions and AZs
- Asset Authorization
-
Sensitive Data Identification and Masking
- What Services Can Use DSC to Scan for Sensitive Data?
- How Long Does It Take for DSC to Identify and Mask Sensitive Data?
- What Are the Built-in Identification Rules of DSC?
- What Are the Identification Rules in the Built-in Identification Template of DSC?
- Does Data Masking Affect My Raw Data?
- Does DSC Have Specific Requirements on the Character Set for Which Sensitive Data Is to Be Identified and Masked?
- Why Cannot I Find a Table in an Existing Database When Creating a Database Data Masking Task?
- Data Watermarking
- Data Usage Audit
- Videos
-
More Documents
-
User Guide (ME-Abu Dhabi Region)
- Service Overview
- Service Provisioning
- Assets
- Overview
- Sensitive Data Identification
- Data Masking
- Data Watermarking
- Alarm Notifications
- Permissions Management
-
FAQs
- Product Consulting
- Adding Data Assets
-
Sensitive Data Identification and Masking
- What Services Can Use DSC to Scan for Sensitive Data?
- How Long Does It Take for DSC to Identify and Mask Sensitive Data?
- Which Types of Sensitive Data Can Be Identified by DSC?
- Does Data Masking Affect My Raw Data?
- Does DSC Have Specific Requirements on the Character Set for Which Sensitive Data Is to Be Identified and Masked?
- How Do I Add Multiple Identification Rule Groups?
- Data Watermarking
- Change History
-
API Reference (ME-Abu Dhabi Region)
- Before You Start
- Calling APIs
-
API Description
- Data Watermarking
- Resource Management
- Dynamic Data Masking
- Alarm Notifications
-
Image Watermarking
- Injecting Invisible Watermarks into Images
- Extracting Invisible Text Watermarks
- Extracting Invisible Watermarks from Images
- Injecting Invisible Watermarks into Images (Image Addresses)
- Extracting Dark Watermarks from Images (Image Addresses)
- Extracting Invisible Image Watermarks from Images (Image Addresses)
- Asset Management
- Document Watermarking
-
Sensitive Data Discovery
- Querying the Identification Task List
- Querying the Result of an Identification Task
- Viewing the Rule List
- Creating a Sensitive Data Scanning Rule
- Modifying a Sensitive Data Scanning Rule
- Deleting a Sensitive Data Scanning Rule
- Querying Sensitive Data Scanning Rule Groups
- Creating a Sensitive Data Scanning Rule Group
- Deleting a Sensitive Data Scanning Rule Group
- Creating a Sensitive Data Scanning Task
- Querying the Database Lineage Graph
- Querying the Table Lineage Graph in Pages
- Querying Data Linage Graph at the Column Level
- Querying the OBS Bucket Lineage Graph
- Querying the OBS File Linage Graph in Pages
- Static Data Masking
- API Call Records
- Appendixes
- Change History
-
User Guide (ME-Abu Dhabi Region)
- General Reference
Show all
Copied.
Permissions Management
If you want to assign different access permissions to employees in an enterprise for the DSC resources purchased on HUAWEI CLOUD, you can use Identity and Access Management (IAM) to perform refined permission management. IAM provides identity authentication, permissions management, and access control, helping you efficiently manage access to your DSC resources.
With IAM, you can create IAM users under your account for your employees, and assign permissions to these IAM users to control their access to DSC resources. For example, if you have software developers and you want to assign them the permission to access DSC but not to delete DSC or its resources, you can create an IAM policy to assign the developers the permission to access DSC but prevent them from deleting DSC data.
If your HUAWEI CLOUD account does not require individual IAM users for permissions management, skip this section.
IAM is free. You pay only for the resources in your account. For more information about IAM, see What Is IAM?
DSC Permissions
By default, new IAM users do not have any permissions. You need to add a user to one or more groups, and attach permission policies or roles to these groups. Users inherit permissions from their groups and can perform specified operations on cloud services based on the permissions.
DSC is a project-level service deployed and accessed in specific physical regions. To assign permissions to a user group, specify the scope as region-specific projects and select projects for the permissions to take effect. If All projects is selected, the permissions will take effect for the user group in all region-specific projects. To access DSC, the users need to switch to a region where they have been authorized to use cloud services.
- Roles: A coarse-grained authorization mechanism provided by IAM to define permissions based on users' job responsibilities. This mechanism provides a limited number of service-level roles for authorization. You need to also assign other dependent roles for the permission control to take effect. Roles are not an ideal choice for fine-grained authorization and secure access control.
- Policies: A fine-grained authorization mechanism that defines permissions required to perform operations on specific cloud resources under certain conditions. This mechanism allows for more flexible policy-based authorization, meeting requirements for secure access control. For example, you can grant DSC users the permissions to manage only a certain type of resources.
Table 1 describes the system-defined policies of DSC.
Policy |
Description |
Type |
Dependency |
---|---|---|---|
DSC DashboardReadOnlyAccess |
Read-only permissions for the overview page of DSC |
System-defined policy |
None |
DSC FullAccess |
All permissions for DSC |
System-defined policy |
To purchase a yearly/monthly RDS DB instance, you need to configure the following actions: bss:order:update bss:order:pay |
DSC ReadOnlyAccess |
Read-only permissions for Data Security Center |
System-defined policy |
None |
Only users with the Security Administrator permission can perform Allowing or Disallowing Access to Cloud Assets.
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot