Help Center/ MetaStudio/ Service Overview/ Permissions Management
Updated on 2025-08-22 GMT+08:00
View PDF
Share

Permissions Management

If you need to grant different permissions to employees in your organization to access your purchased MetaStudio resources, Identity and Access Management (IAM) is a good choice. IAM provides identity authentication, fine-grained permissions management, and access control, securing the access to your cloud resources.

With IAM, you can create IAM users and grant them permissions to access only specific resources. For example, you can create IAM users for some software developers in your organization to allow them to use MetaStudio resources but not to delete resources.

If your account does not need individual IAM users for permissions management, skip this section.

IAM is a free service. You pay only for the resources in your account. For more information about IAM, see IAM Service Overview.

MetaStudio does not support enterprise projects.

MetaStudio Permissions

By default, new IAM users do not have permissions granted. You need to add a user to one or more groups, and attach permissions policies or roles to these groups. Users inherit permissions from the groups to which they are added and can perform specified operations on cloud services based on the permissions.

MetaStudio is a project-level service deployed and accessed in specific physical regions. To grant MetaStudio permissions to a user group, specify the scope as region-specific projects and select projects (such as ap-southeast-2). If you select All projects, the permissions will take effect for user groups in all region-specific projects. When accessing MetaStudio, the users need to switch to a region where they have been granted permissions to use this service.

You can grant users permissions by using roles and policies.
  • Roles: A type of coarse-grained authorization mechanism that defines permissions related to user responsibilities. This mechanism provides only a limited number of service-level roles for authorization. When using roles to grant permissions, you also need to assign other roles on which the permissions depend to take effect. However, roles are not an ideal choice for fine-grained authorization and secure access control.
  • Policies: A fine-grained authorization strategy that defines permissions required to perform operations on specific cloud resources under certain conditions. This mechanism allows for more flexible policy-based authorization, meeting requirements for secure access control.
See Table 1.
Table 1 System-defined policies of MetaStudio

Policy Name

Description

Type

Policy Content

MetaStudio FullAccess

Administrator permissions of MetaStudio. This policy contains all permissions of MetaStudio.

System-defined policy

MetaStudio FullAccess Policy

MetaStudio ReadOnlyAccess

Read-only permissions of MetaStudio. Users granted these permissions can only view MetaStudio data.

System-defined policy

MetaStudio ReadOnlyAccess Policy

Helpful Links

MetaStudio FullAccess Policy

{
            "Version": "1.1",
            "Statement": [
                {
                    "Action": [
                        "metastudio:*:*"
                    ],
                    "Effect": "Allow"
                }
            ]
}

MetaStudio ReadOnlyAccess Policy

{
            "Version": "1.1",
            "Statement": [
                {
                    "Action": [
                        "metastudio:*:show*"
                    ],
                    "Effect": "Allow"
                }
            ]
}