Updated on 2023-11-29 GMT+08:00

Permissions

If you need to assign different permissions to employees in your enterprise to access your Huawei Cloud ROMA Connect resources, IAM is a good choice for fine-grained permissions management. IAM provides identity authentication, permissions management, and access control, helping you secure access to your resources.

With IAM, you can use your Huawei Cloud account to create IAM users for your employees, and assign permissions to the users to control their access to specific resource types. For example, some software developers in your enterprise need to use ROMA Connect resources but should not be allowed to delete them or perform any high-risk operations. In this scenario, you can create IAM users for the software developers and grant them only the permissions required for using ROMA Connect resources.

If your Huawei Cloud account does not need individual IAM users for permissions management, you may skip this chapter.

IAM is free of charge. You pay only for the resources in your account. For more information about IAM, see IAM Service Overview.

ROMA Connect Permissions

By default, new IAM users do not have any permissions assigned. To assign permissions to these new users, add them to one or more groups, and attach permissions policies or roles to these groups.

ROMA Connect is a project-level service deployed and accessed in specific physical regions. To assign permissions to a user group, specify the scope as region-specific projects and select projects for the permissions to take effect. If All projects is selected, the permissions will take effect for the user group in all region-specific projects. When accessing ROMA Connect, the users need to switch to a region where they have been authorized to use this service.

You can grant users permissions by using roles and policies.

  • Roles: A type of coarse-grained authorization mechanism first provided by IAM to define permissions related to user responsibilities. There are only a limited number of roles for granting permissions to users. When using roles to grant permissions, you may also need to assign other roles on which the permissions depend. However, roles are not an ideal choice for fine-grained authorization and secure access control.
  • Policies: A type of fine-grained authorization mechanism lately provided by IAM to define permissions required to perform operations on specific cloud resources under certain conditions. This mechanism allows for more flexible policy-based authorization and secure access control. For example, regarding ROMA Connect services, you can grant IAM users only the permissions for managing instance resources. Most policies define permissions based on APIs. For details, see supported actions of fine-grained policies.

Table 1 lists all the system roles supported by ROMA Connect.

Table 1 ROMA Connect system permissions

Role/Policy Name

Description

Type

Dependency

ROMA FullAccess

Full permissions for ROMA Connect. Users granted these permissions can operate and use all ROMA Connect instances.

System-defined policy

None

ROMA CommonOperations

Common user permissions for ROMA Connect. This does not include permissions to create, modify, and delete instances.

System-defined policy

None

ROMA ReadOnlyAccess

Read-only permissions for ROMA Connect. Users granted these permissions can only view ROMA Connect data.

System-defined policy

None

ROMA Administrator

All permissions for ROMA Connect. Users granted these permissions can operate and use all ROMA Connect instances.

System-defined policy

None

Table 2 lists the common operations supported by each system-defined policy of ROMA Connect. Select the proper system-defined policies as required.

Table 2 Common operations supported by each system-defined policy or role of ROMA Connect

Operation

ROMA FullAccess

ROMA CommonOperations

ROMA ReadOnlyAccess

ROMA Administrator

Creating a ROMA Connect instance

x

x

Querying instance information

Modifying a ROMA Connect instance

x

x

Deleting a ROMA Connect instance

x

x

Operating resources in an instance

x

Integration Application Permissions

ROMA Connect provides strict permissions management for user resources. In one instance, IAM users can view and manage only the integration applications and resources created by themselves. With integration application authorization, IAMusers can share applications and resources with other IAMusers under the same account.

Table 3 Application permissions

Permission

FDI

APIC

MQS

LINK

read

View data sources of applications.

View, debug, and export APIs of applications.

View and export topics of applications.

View and export devices, products, and rules of applications, as well as debug devices.

modify

Create and edit data sources of applications.

Create, edit, release, take APIs offline, and import APIs of applications.

Create and edit topics of applications.

Create, edit, and import devices, products, and rules of applications, as well as reset device and product passwords.

delete

Delete data sources of applications.

Delete APIs of applications.

Delete topics of applications.

Delete devices, products, and rules of applications, product properties, device topics, as well as rule data sources and destinations.

access

N/A

Configure authorization, access control, request throttling, and signature key binding for APIs of applications.

Configure permissions for topics of applications.

Deliver commands to and forcibly take offline devices, as well as configure plug-ins for devices that use the OPC UA or Modbus protocol.

admin

Application administrator permissions.

ABM Permissions

Table 4 lists all the system policies or roles supported by ABM.

Table 4 ABM system permissions

Role/Policy Name

Description

Type

Dependency

ROMA ABM FullAccess

Full permissions for ROMA ABM

System-defined policy

None

ROMA ABM CommonOperations

Common user permissions for ROMA ABM. This does not include permissions to create, modify, and delete instances.

System-defined policy

None

ROMA ABM ReadOnlyAccess

Read-only permissions for ROMA ABM

System-defined policy

None

ROMA Connect Business Flow Permissions

Table 5 shows all system permissions of a business flow.

Table 5 ROMA Connect business flow permissions

System Policy/Policy Name

Description

Type

Dependency

ROMA BFS CommonOperations

Operation (such as create) permissions

System-defined policy

None

ROMA BFS FullAccess

Administrator permissions

System-defined policy

None

ROMA BFS ReadOnlyAccess

Read-only permissions

System-defined policy

None

ROMA Connect Business Flow Diagram Permissions

ROMA Connect implements strict permission management on service flow diagrams. IAM users can view and manage only the service flow diagrams created by themselves. By default, IAM users cannot view the service flow diagrams created by other IAM users. ROMA Connect business flows can be shared with other IAM users under the same account to view and use.

Table 6 ROMA Connect business flow diagram permissions

Permission

Business Flow

read

You can view the authorized business flow diagram.

modify

You can modify and save the authorized service flow diagram.

delete

You can delete the authorized business flow diagram.

operate

You can start, stop, restart, and manually schedule the authorized business flow diagram.

admin

Administrator permissions for business flow diagrams.