Permissions Management

If you need to assign different permissions to personnel in your enterprise to access your cloud resources, Identity and Access Management (IAM) is a good choice for fine-grained permissions management. IAM provides functions such as identity authentication, permissions management, and access control. If your account does not need individual IAM users for permissions management, skip this topic.

IAM is a free service. You only pay for the resources in your account.

With IAM, you can control access to specific cloud resources. For example, you can create IAM users for software developers and assign permissions to allow them to use enterprise router resources but disallow them from performing any high-risk operations such as deleting such resources.

IAM supports role/policy-based authorization and identity policy-based authorization.

The following table describes the differences between the two authorization models.

**Table 1** Differences between role/policy-based and identity policy-based authorization
Name	Authorization Using	Permissions	Authorization Method	Scenario
Role/Policy	User-permission-authorization scope	System-defined roles System-defined policies Custom policies	Assigning roles or policies to principals	To authorize a user, you need to add it to a user group first and then specify the scope of authorization. It is hard to provide fine-grained permissions control using authorization by user groups and a limited number of condition keys. This method is suitable for small- and medium-sized enterprises.
Identity policy	User-policy	System-defined policies Custom identity policies	Assigning identity policies to principals Attaching identity policies to principals	You can authorize a user by attaching an identity policy to it. User-specific authorization and a variety of key conditions allow for more fine-grained permissions control. However, this model can be hard to set up. It requires a certain amount of expertise and is suitable for medium- and large-sized enterprises.

Assume that you want to grant IAM users the permission to create enterprise routers in CN North-Beijing4 and in CN South-Guangzhou. With role/policy-based authorization, the administrator needs to create two custom policies and assign both to the IAM users. With identity policy-based authorization, the administrator only needs to create one custom identity policy, configure the condition key g:RequestedRegion for the policy, and then attach the policy to the users or grant the users the access permissions to the specified regions. Identity policy-based authorization is more flexible than role/policy-based authorization.

Policies and actions in the two authorization models are not interoperable. You are advised to use the identity policy-based authorization model. For details about system-defined permissions, see Role/Policy-based Authorization and Identity Policy-based Authorization.

For more information about IAM, see IAM Service Overview.

Role/Policy-based Authorization

Enterprise Router supports authorization with roles and policies. By default, new IAM users do not have any permissions assigned. You need to add them to one or more groups and attach policies or roles to these groups so that these users can inherit permissions from the groups and perform specified operations on cloud services.

Enterprise Router is a project-level service deployed in a specific region. You need to select a project such as ap-southeast-2 for which the permissions will be granted. If you select All projects, the permissions will be granted for all the projects. You need to switch to the authorized region before accessing an enterprise router.

Table 2 lists all the system-defined policies on enterprise routers. System-defined policies and system-defined identity policies in the two authorization models are not interoperable.

**Table 2** System-defined policies on enterprise routers
System Policy	Description	Type	Dependency
ER FullAccess	Administrator permissions for enterprise routers. Users with such permissions can operate and use all resources on enterprise routers.	System-defined policy	None
ER ReadOnlyAccess	Read-only permissions for enterprise routers. Users with such permissions can only view data on enterprise routers.	System-defined policy	None

Table 3 lists the common operations supported by each system-defined policy. You can select a proper one as required.

**Table 3** Common operations supported by each system policy
Operation	Tenant Administrator	Tenant Guest	ER FullAccess	ER ReadOnlyAccess
Creating an enterprise router	√	x	√	x
Modifying an enterprise router	√	x	√	x
Viewing an enterprise router	√	√	√	√
Deleting an enterprise router	√	x	√	x
Adding a Virtual Private Cloud (VPC) to an enterprise router	√	x	√	x
Deleting a VPC attachment	√	x	√	x
Viewing attachments of all types	√	√	√	√
Creating a route table	√	x	√	x
Renaming a route table	√	x	√	x
Viewing a route table	√	√	√	√
Deleting a route table	√	x	√	x
Creating an association for an attachment in a route table	√	x	√	x
Viewing associations in a route table	√	√	√	√
Deleting an association from a route table	√	x	√	x
Creating a propagation for an attachment in the route table	√	x	√	x
Viewing a propagation in a route table	√	√	√	√
Deleting a propagation from a route table	√	x	√	x
Creating a static route	√	x	√	x
Modifying a static route	√	x	√	x
Viewing a route	√	√	√	√
Deleting a static route	√	x	√	x
Creating a flow log	√	x	√	x
Viewing a VPC flow log	√	√	√	√
Disabling a flow log	√	x	√	x
Enabling a flow log	√	x	√	x
Deleting a flow log	√	x	√	x
Adding a resource tag	√	x	√	x
Modifying a resource tag	√	x	√	x
Viewing a resource tag	√	√	√	√
Deleting a resource tag	√	x	√	x

Identity Policy-based Authorization

Enterprise Router supports authorization with identity policies. Table 4 lists all the system-defined policies for Enterprise Router in identity policy-based authorization. System-defined identity policies and system-defined policies in the two authorization models are not interoperable.

**Table 4** System-defined identity policies
Identity Policy Name	Description	Type
ERFullAccessPolicy	All permissions for Enterprise Router	System-defined identity policy
ERReadOnlyPolicy	Read-only permission for Enterprise Router	System-defined identity policy

Table 5 lists the common operations supported by system-defined identity policies for Enterprise Router.

**Table 5** Common operations supported by each system-defined identity policy
Operation	ERFullAccessPolicy	ERReadOnlyPolicy
Creating an enterprise router	√	x
Modifying an enterprise router	√	x
Viewing an enterprise router	√	√
Deleting an enterprise router	√	x
Adding a VPC attachment to an enterprise router	√	√
Deleting a VPC attachment	√	x
Viewing attachments of all types	√	√
Creating a route table	√	x
Renaming a route table	√	x
Viewing a route table	√	√
Deleting a route table	√	x
Creating an association	√	x
Viewing an association	√	√
Deleting an association	√	x
Creating a propagation	√	x
Viewing a propagation	√	√
Deleting a propagation	√	x
Creating a static route	√	x
Modifying a static route	√	x
Viewing routes	√	√
Deleting a static route	√	x
Creating a flow log	√	x
Viewing a flow log	√	√
Disabling a flow log	√	x
Enabling a flow log	√	x
Deleting a flow log	√	x
Adding a resource tag	√	x
Modifying a resource tag	√	x
Viewing a resource tag	√	√
Deleting a resource tag	√	x