Permissions

You can use Identity and Access Management (IAM) to manage SMN permissions and control access to your resources. IAM provides identity authentication, permissions management, and access control.

You can create IAM users for your employees, and assign permissions to these users on a principle of least privilege (PoLP) basis to control their access to specific resource types. For example, you can create IAM users for software developers and assign specific permissions to allow them to use SMN resources but prevent them from being able to delete resources or perform any high-risk operations.

If your Huawei Cloud account does not require individual IAM users for permissions management, skip this section.

IAM can be used free of charge. You pay only for the resources in your account.

For more information about IAM, see IAM Service Overview.

SMN Permissions

By default, new IAM users do not have any permissions assigned. To assign permissions to these new users, add them to one or more groups, and attach permissions policies or roles to these groups.

SMN is a project-level service deployed and accessed in specific physical regions. When assigning SMN permissions to a user group, specify region-specific projects where the permissions will take effect. If you select All projects, the permissions will be granted for all region-specific projects. When accessing SMN, the users need to switch to a region where they have been authorized to use this service.

You can grant users permissions by using roles and policies.

Roles: a type of coarse-grained authorization mechanism that provides only a limited number of service-level roles When using roles to grant permissions, you need to also assign other roles on which the permissions depend to take effect. However, roles are not an ideal choice for fine-grained authorization and secure access control.
Policies: a type of fine-grained authorization mechanism that defines permissions required to perform operations on specific cloud resources under certain conditions This mechanism allows for more flexible policy-based authorization for secure access control. For example, you can grant SMN users only the permissions for managing a certain type of ECSs. Most policies define permissions based on APIs. For the API actions supported by SMN, see section "Permissions Policies and Supported Actions" in the Simple Message Notification API Reference.

Table 1 lists all system-defined policies supported by SMN.

**Table 1** System-defined policies supported by SMN
Role/Policy Name	Description	Type	Dependency
SMN Administrator	Has all permissions for SMN resources.	System-defined role	The Tenant Guest and SMN Administrator roles need to be assigned in the same project.
SMN FullAccess	Administrator permissions for SMN. Users granted these permissions can perform all operations on SMN resources.	System-defined policy	None
SMN ReadOnlyAccess	Read-only permissions for SMN. Users granted these permissions can only view SMN data.	System-defined policy	None

Table 2 lists the common operations supported by each SMN system policy or role. Select the policies or roles as needed.

**Table 2** Common operations supported by each system-defined policy or role of SMN
Operation	SMN Administrator	SMN FullAccess	SMN ReadOnlyAccess
Creating a topic	√	√	×
Updating a topic	√	√	×
Deleting a topic	√	√	×
Querying topics	√	√	√
Adding a subscription to a topic	√	√	×
Adding tags to a topic	√	√	×
Configuring topic policies	√	√	×
Publishing a message	√	√	×
Adding a subscription	√	√	×
Requesting subscription confirmation	√	√	×
Canceling a subscription	√	√	×
Querying subscriptions	√	√	√
Creating a message template	√	√	×
Modifying a message template	√	√	×
Deleting a message template	√	√	×
Querying a message template	√	√	√