Permissions Management

If you need to assign different permissions to employees in your enterprise to access your IEF resources, Identity and Access Management (IAM) is a good choice for fine-grained permissions management. IAM provides identity authentication, permissions management, and access control, helping you secure access to your Huawei Cloud resources.

With IAM, you can use your account to create IAM users for your employees, and assign permissions to the users to control their access to specific resource types. For example, some software developers in your enterprise need to use IEF resources but must not delete them or perform any high-risk operations. To achieve this result, you can create IAM users for the software developers and grant them only the permissions required for using IEF resources.

If your Huawei Cloud account does not require individual IAM users for permissions management, skip this section.

IAM is a free service. You only pay for the resources in your account. For more information about IAM, see the IAM Service Overview.

IEF Permissions

New IAM users do not have any permissions assigned by default. You need to first add them to one or more groups and then attach policies or roles to these groups. The users then inherit permissions from the groups and can perform specified operations on cloud services based on the permissions they have been assigned.

IEF is a project-level service deployed for specific regions. To assign IEF permissions to a user group, specify the scope as region-specific projects and select projects for the permissions to take effect. If All projects is selected, the permissions will take effect for the user group in all region-specific projects. When accessing IEF, the users need to switch to the authorized region.

You can grant permissions by using roles and policies.

Roles: A coarse-grained authorization strategy that defines permissions by job responsibility. Users with the Tenant Administrator role can perform operations on all IEF resources.
Policies: A fine-grained authorization strategy that defines permissions required to perform operations on specific cloud resources under certain conditions. This type of authorization is more flexible and is ideal for least privilege access. Most policies define permissions based on APIs.

Table 1 lists all the system-defined permissions for IEF.

**Table 1** IEF system permissions
System Role/Policy Name	Description	Type	Dependencies
IEF FullAccess	Administrator permissions for IEF. Users with these permissions can perform all operations on basic IEF resources. Note: To perform operations on all IEF resources, configure the Tenant Administrator role.	System-defined policy	None
IEF ReadOnlyAccess	Read-only permissions for IEF. Users with these permissions can only view IEF resources.	System-defined policy	None

Table 2 lists the common operations supported by system-defined permissions for IEF.

**Table 2** Common operations supported by system-defined permissions
Operation	IEF FullAccess	IEF ReadOnlyAccess	Tenant Administrator
Creating, deleting, or modifying an instance	√	x	√
Querying an instance	√	√	√
Switching an instance	√	√	√
Creating, deleting, or modifying an edge node	√	x	√
Viewing an edge node	√	√	√
Creating, deleting, or modifying an edge node group	√	x	√
Viewing an edge node group	√	√	√
Creating, deleting, or modifying an edge containerized application	√	x	√
Viewing an edge containerized application	√	√	√
Creating, deleting, or modifying a device	√	x	√
Viewing a device	√	√	√
Creating, deleting, or modifying an application deployment	√	x	√
Viewing an application deployment	√	√	√
Creating, deleting, or modifying an application template	√	x	√
Viewing an application template	√	√	√
Creating, deleting, or modifying a node registration job	√	x	√
Viewing a node registration job	√	√	√
Creating, deleting, or modifying a message endpoint	√	x	√
Viewing a message endpoint	√	√	√
Creating, deleting, or modifying a message route	√	x	√
Viewing a message route	√	√	√
Creating, deleting, or modifying a batch job	√	x	√
Viewing a batch job	√	√	√
Creating, deleting, or modifying a ConfigMap	√	x	√
Viewing a ConfigMap	√	√	√
Creating, deleting, or modifying a key	√	x	√
Viewing a key	√	√	√
Creating, deleting, or modifying encrypted data	√	x	√
View encrypted data	√	√	√
Creating, deleting, or modifying a system subscription	√	x	√
Viewing a system subscription	√	√	√
Creating, deleting, or modifying a plug-in	√	x	√
Viewing a plug-in	√	√	√