Permissions

If you need to assign different permissions to your enterprise personnel for ECSs, Identity and Access Management (IAM) is a good choice. IAM provides identity authentication, fine-grained permissions management, and access control. IAM helps you securely access your Huawei Cloud resources. If your Huawei Cloud account does not require IAM for permissions management, you can skip this section.

IAM is a free service. You only pay for the resources in your account.

With IAM, you can control access to specific Huawei Cloud resources. For example, if you want some software developers in your enterprise to use ECSs but do not want them to delete ECSs or perform any other high-risk operations, you can grant permission to use ECSs but not permission to delete them.

IAM supports role/policy-based authorization and identity policy-based authorization.

The following table describes the differences between these two authorization models.

**Table 1** Differences between role/policy-based authorization and identity policy-based authorization
Authorization Model	Authorization Using	Permissions	Authorization Method	Scenario
Role/Policy	User-permission-authorization scope	System-defined roles System-defined policies Custom policies	Assigning roles or policies to principals	To authorize a user, you need to add it to a user group first and then specify the scope of authorization. It provides a limited number of condition keys and cannot meet the requirements of fine-grained permissions control. This method is suitable for small- and medium-sized enterprises.
Identity policy	User-policy	System-defined identity policy Custom identity policies	Assigning identity policies to principals Attaching identity policies to principals	You can authorize a user by attaching an identity policy to it. User-specific authorization and a variety of key conditions allow for more fine-grained permissions control. However, this model can be hard to set up. It requires a certain amount of expertise and is suitable for medium- and large-sized enterprises.

Assume that you want to grant IAM users permission to create ECSs in CN North-Beijing4 and OBS buckets in CN South-Guangzhou. With role/policy-based authorization, the administrator needs to create two custom policies and assign both to the IAM users. With identity policy-based authorization, the administrator only needs to create one custom identity policy and configure the condition key g:RequestedRegion for the policy, and then attach the policy to the users or grant the users the access permissions to the specified regions. Identity policy-based authorization is more flexible than role/policy-based authorization.

Policies/identity policies and actions in the two authorization models are not interoperable. You are advised to use the identity policy-based authorization model. For details about system-defined permissions, see Role/Policy-based Authorization and Identity Policy-based Authorization.

For more information about IAM, see IAM Service Overview.

Role/Policy-based Authorization

ECS supports authorization with roles and policies. New IAM users do not have any permissions assigned by default. You need to first add them to one or more groups and attach policies or roles to these groups. The users then inherit permissions from the groups and can perform specified operations on cloud services based on the permissions they have been assigned.

ECS is a project-level service deployed for specific regions. When you set Scope to Region-specific projects and select the specified projects (for example, ap-southeast-2) in the specified regions (for example, AP-Bangkok), the users only have permissions for load balancers in the selected projects. If you set Scope to All resources, the users have permissions for ECSs in all region-specific projects. When accessing ECSs, the users need to switch to the authorized region.

Table 2 lists all the system-defined policies for ECS with RBAC. System-defined policies in role/policy-based authorization and identity policy-based authorization are not interoperable.

**Table 2** System-defined policies for ECS
Role/Policy Name	Description	Type	Dependencies
ECS FullAccess	Administrator permissions for ECS. Users with these permissions can perform all operations on ECSs.	System-defined policy	None
ECS CommonOperations	Common user permissions for ECS. Users with these permissions can start, stop, restart, and query ECSs.	System-defined policy	None
ECS ReadOnlyAccess	Read-only permissions for ECS. Users with these permissions can only view ECS data.	System-defined policy	None
Server Administrator	Permissions include: Creating, deleting, and modifying ECSs Creating, deleting, and modifying EVS disks All operations on security groups, security group rules, ports, firewalls, EIPs, and bandwidth if the Tenant Guest role is also assigned. Creating, deleting, querying, and modifying images	System-defined role	Tenant Guest and Tenant Administrator roles, which must be attached in the same project as the Server Administrator role

Table 3 lists the common operations supported by system-defined permissions for ECS.

**Table 3** Common operations supported by system-defined permissions
Operation	ECS FullAccess	ECS CommonOperations	ECS ReadOnlyAccess	Server Administrator
Creating an ECS	Supported	Not supported	Not supported	Supported
Remotely logging in to an ECS on the management console	Supported	Supported	Not supported (VNC login not supported)	Supported
Querying ECSs	Supported	Supported	Supported	Supported
Querying details about an ECS	Supported	Supported	Supported	Supported
Modifying an ECS	Supported	Not supported	Not supported	Supported
Starting an ECS	Supported	Supported	Not supported	Supported
Stopping an ECS	Supported	Supported	Not supported	Supported
Restarting an ECS	Supported	Supported	Not supported	Supported
Deleting an ECS	Supported	Not supported	Not supported	Supported
Reinstalling an ECS OS	Supported	Not supported	Not supported	Supported
Changing an ECS OS	Supported	Not supported	Not supported	Supported
Attaching a disk to an ECS	Supported	Not supported	Not supported	Supported
Detaching a disk from an ECS	Supported	Not supported	Not supported	Supported
Querying the disks attached to an ECS	Supported	Supported	Supported	Supported
Adding a NIC to an ECS	Supported	Not supported	Not supported	Supported
Deleting a NIC from an ECS	Supported	Not supported	Not supported	Supported
Querying the NICs of an ECS	Supported	Supported	Supported	Supported
Adding tags to an ECS	Supported	Supported	Not supported	Supported
Modifying ECS specifications	Supported	Not supported	Not supported	Supported
Querying ECS specifications	Supported	Supported	Supported	Supported
Querying ECS groups	Supported	Supported	Supported	Supported

Role/Policy Dependencies of the ECS Console

**Table 4** Role/Policy dependencies of the ECS console
Console Function	Dependency	Role/Policy Required
ECS host security	Host Security Service (HSS)	To view host security information, an IAM user must be granted ECS FullAccess and HSS ReadOnlyAccess.
ECS console overview	Dedicated Host (DeH)	To view existing DeHs, an IAM user must be granted ECS FullAccess and DeH ReadOnlyAccess.
ECS purchase	Tag Management Service (TMS)	To view predefined tags, an IAM user must be granted ECS FullAccess and TMS ReadOnlyAccess.
ECS monitoring	Cloud Eye	To view ECS monitoring metrics, an IAM user must be granted ECS FullAccess and CES ReadOnlyAccess.

Identity Policy-based Authorization

ECS supports authorization with identity policies. Table 5 lists all the system-defined identity policies for ECS. System-defined identity policies and system-defined policies in the two authorization models are not interoperable.

**Table 5** System-defined identity policies for ECS
System-defined Identity Policy Name	Description	Type
ECSFullPolicy	Administrator permissions for ECS. Users with these permissions can perform all operations on ECSs.	System-defined identity policy
ECSCommonOperationsPolicy	Common user permissions for ECS. Users with these permissions can start, stop, restart, and query ECSs.	System-defined identity policy
ECSReadOnlyPolicy	Read-only permissions for ECS. Users with these permissions can only view ECS data.	System-defined identity policy

Table 6 lists the common operations supported by system-defined identity policies for ECS.

**Table 6** Common operations supported by system-defined identity policies of ECS
Operation	ECSFullPolicy	ECSCommonOperationsPolicy	ECSReadOnlyPolicy
Creating an ECS	Supported	Not supported	Not supported
Remotely logging in to an ECS on the management console	Supported	Supported	Not supported (VNC login not supported)
Querying ECSs	Supported	Supported	Supported
Querying details about an ECS	Supported	Supported	Supported
Modifying an ECS	Supported	Not supported	Not supported
Starting an ECS	Supported	Supported	Not supported
Stopping an ECS	Supported	Supported	Not supported
Restarting an ECS	Supported	Supported	Not supported
Deleting an ECS	Supported	Not supported	Not supported
Reinstalling an ECS OS	Supported	Not supported	Not supported
Changing an ECS OS	Supported	Not supported	Not supported
Attaching a disk to an ECS	Supported	Not supported	Not supported
Detaching a disk from an ECS	Supported	Not supported	Not supported
Querying the disks attached to an ECS	Supported	Supported	Supported
Adding a NIC to an ECS	Supported	Not supported	Not supported
Deleting a NIC from an ECS	Supported	Not supported	Not supported
Querying the NICs of an ECS	Supported	Supported	Supported
Adding tags to an ECS	Supported	Supported	Not supported
Modifying ECS specifications	Supported	Not supported	Not supported
Querying ECS specifications	Supported	Supported	Supported
Querying ECS groups	Supported	Supported	Supported

Identity Policy Dependencies of the ECS Console

When using IAM identity policy-based authorization, you need to additionally configure the following roles/policies for IAM users:

cbr:vaults:addResources
eip:globalEips:list
iam:agencies:listAgencies
evs:backups:list

**Table 7** Identity policy dependencies of the ECS console
Console Function	Dependency	Identity Policy Required
ECS host security	Host Security Service (HSS)	To view host security information, an IAM user must be granted ECSFullPolicy and HSSReadOnlyPolicy.
ECS console overview	Dedicated Host (DeH)	To view existing DeHs, an IAM user must be granted ECSFullPolicy and DeHReadOnlyPolicy.
ECS purchase	Tag Management Service (TMS)	To view predefined tags, an IAM user must be granted ECSFullPolicy and TMSReadOnlyPolicy.
ECS monitoring	Cloud Eye	To view ECS monitoring metrics, an IAM user must be granted ECSFullPolicy and CESReadOnlyPolicy.