Permissions

If you need to assign different permissions to personnel in your enterprise to access your DMS for Kafka resources, Identity and Access Management (IAM) is a good choice for fine-grained permissions management. IAM provides identity authentication, permissions management, and access control, helping you to securely access your Huawei Cloud resources. If your HUAWEI ID does not require individual IAM users for permissions management, you can skip this section.

IAM is a free service. You only pay for the resources in your account.

With IAM, you can control access to specific Huawei Cloud resources. For example, if you want some software developers in your enterprise to use DMS for Kafka resources but do not want them to delete Kafka instances or perform any other high-risk operations, you can grant permission to use Kafka instances but not permission to delete them.

IAM supports role/policy-based authorization and identity policy-based authorization.

The following table describes the differences between these two authorization models.

**Table 1** Differences between role/policy-based authorization and identity policy-based authorization
Authorization Model	Authorization Using	Permissions	Authorization Method	Scenario
Role/Policy-based authorization	User-permission-authorization scope	System-defined role System-defined policies Custom policies	Granting roles or policies to principals	To grant permissions to a user, you need to add it to a user group and then grant permissions to the user group. You cannot directly grant permissions to a user. There are a lot of user groups for management but only a limited number of condition keys for use. It is hard to provide fine-grained permissions control. This method is suitable for small- and medium-sized enterprises.
Identity policy-based authorization	Policies	System-defined identity policies Custom identity policies	Assigning identity policies to principals Attaching identity policies to principals	You can authorize a user by attaching an identity policy to it. User-specific authorization and a variety of key conditions allow for more fine-grained permissions control. However, this model can be hard to set up. It requires a certain amount of expertise and is suitable for medium- and large-sized enterprises.

Assume that you want to grant IAM users permission to create ECSs in AP-Bangkok and OBS buckets in AP-Singapore. With role/policy-based authorization, the administrator needs to create two custom policies and assign both to the IAM users. With identity policy-based authorization, the administrator only needs to create one custom policy, configure the condition key g:RequestedRegion for the policy, and then attach the policy to the users or grant the users the access permissions to the specified regions. Identity policy-based authorization is more flexible than role/policy-based authorization.

Policies/identity policies and actions in the two authorization models are not interoperable. You are advised to use the identity policy-based authorization model. For details about system-defined permissions, see Role/Policy-based Permissions Management and Identity Policy-based Permissions Management.

For more information about IAM, see IAM Service Overview.

Role/Policy-based Permissions Management

DMS for Kafka supports role/policy-based authorization. New IAM users do not have any permissions assigned by default. You need to first add them to one or more groups and attach policies or roles to these groups. The users then inherit permissions from the groups and can perform specified operations on cloud services based on the permissions they have been assigned.

DMS for Kafka is a project-level service deployed for specific regions. When you set Scope to Region-specific projects and select the specified projects (for example, ap-southeast-2) in the specified regions (for example, AP-Bangkok), the users only have permissions for resources in the selected projects. If you set Scope to All resources, the users have permissions for resources in all region-specific projects. When accessing DMS for Kafka, the users need to switch to the authorized region.

Table 2 lists all the system-defined permissions for DMS for Kafka. System-defined policies in role/policy-based authorization are not interoperable with those in identity policy-based authorization.

**Table 2** System-defined permissions for DMS for Kafka
Role/Policy Name	Description	Type	Dependencies
DMS FullAccess	Administrator permissions for DMS. Users with these permissions can perform all operations on DMS.	System-defined policy	None
DMS UserAccess	Common user permissions for DMS, excluding permissions for creating, modifying, deleting, dumping, and scaling up instances.	System-defined policy	None
DMS ReadOnlyAccess	Read-only permissions for DMS. Users granted these permissions can only view DMS data.	System-defined policy	None
DMS VPCAccess	VPC operation permissions to assign to DMS agencies.	System-defined policy	None
DMS KMSAccess	KMS operation permissions to assign to DMS agencies.	System-defined policies	None
DMS ELBAccess	ELB operation permissions to assign to DMS agencies.	System-defined policy	None
DMS VPCEndpointAccess	VPC endpoint operation permissions to assign to DMS agencies.	System-defined policy	None
DMSAgencyCheckAccessPolicy	IAM operation permissions to assign to DMS agencies.	System-defined policy	None
DMS BSSAccess	BSS operation permissions to assign to DMS agencies.	System-defined policies	None
DMS OBSAccess	OBS operation permissions to assign to DMS agencies.	System-defined policies	None
DMS Administrator	Administrator permissions for DMS.	System-defined role	Tenant Guest and VPC Administrator roles, which must be attached in the same project as the DMS Administrator role

Table 3 lists the common operations supported by system-defined permissions for DMS for Kafka.

**Table 3** Common operations supported by system-defined policies
Operation	DMS FullAccess	DMS UserAccess	DMS ReadOnlyAccess
Creating an instance	√	×	×
Modifying an instance	√	×	×
Deleting an instance	√	×	×
Modifying instance specifications	√	×	×
Enabling Smart Connect	√	×	×
Creating a Smart Connect task	√	√	×
Restarting an instance	√	√	×
Querying instance information	√	√	√

Only system-defined policies listed in Table 3 have permissions to perform common operations on DMS for Kafka.

Identity Policy-based Permissions Management

DMS for Kafka supports identity policy-based authorization. Table 4 lists the system-defined identity policies for DMS for Kafka. System-defined policies in identity policy-based authorization are not interoperable with those in role/policy-based authorization.

**Table 4** System-defined identity policies for DMS for Kafka
Policy Name	Description	Type
DMSReadOnlyAccessPolicy	Read-only permissions for DMS	System-defined identity policies
DMSUserAccessPolicy	Common user permissions for DMS, excluding permissions for creating, modifying, deleting, dumping, and scaling up instances.	System-defined identity policies
DMSFullAccessPolicy	Full permissions for DMS	System-defined identity policies
DMSServiceLinkedAgencyPolicy	Permissions of service-linked agencies for DMS.	System-defined identity policies
DMSSmartConnectAccessOBSPolicy	DMS permissions for Smart Connect to access OBS.	System-defined identity policies
DMSConsoleFullAccessPolicy	Full permissions for operations on the DMS console.	System-defined identity policies

Table 5 lists the common operations supported by system-defined identity policies for DMS for Kafka.

**Table 5** Common operations supported by system-defined identity policies
Operation	DMSReadOnlyAccessPolicy	DMSUserAccessPolicy	DMSFullAccessPolicy	DMSConsoleFullAccessPolicy
Creating an instance	×	×	√	√
Modifying an instance	×	×	√	√
Deleting an instance	×	×	√	√
Modifying instance specifications	×	×	√	√
Enabling Smart Connect	×	×	√	√
Creating a Smart Connect task	×	√	√	√
Restarting an instance	×	√	√	√
Querying instance information	√	√	√	√