Permissions

If you need to assign different permissions to personnel in your enterprise to access your SMS resources, Identity and Access Management (IAM) is a good choice for fine-grained permissions management. IAM provides identity authentication, permissions management, and access control, helping you to securely access your Huawei Cloud resources. If your HUAWEI IDaccount does not require IAM for permissions management, you can skip this section.

IAM is a free service. You only pay for the resources in your account.

With IAM, you can control access to specific Huawei Cloud resources. For example, if you want some software developers in your enterprise to use SMS resources but do not want them to delete SMS resources or perform any other high-risk operations, you can grant the permission to use SMS resources but not the permission to delete them.

IAM supports role/policy-based authorization and identity policy-based authorization.

The following table describes the differences between these two authorization models.

**Table 1** Differences between role/policy-based and identity policy-based authorization
Authorization Model	Core Relationship	Permissions	Authorization Method	Scenario
Role/Policy	User-permission-authorization scope	System-defined roles System-defined policies Custom policies	Assigning roles or policies to principals	To authorize a user, you need to add it to a user group first and then specify the scope of authorization. It is hard to provide fine-grained permissions control using authorization by user groups and a limited number of condition keys. This method is suitable for small- and medium-sized enterprises.
Identity policy	User-policy	System-defined policies Custom identity policies	Assigning identity policies to principals Attaching identity policies to principals	You can authorize a user by attaching an identity policy to it. User-specific authorization and a variety of key conditions allow for more fine-grained permissions control. However, this model can be hard to set up. It requires a certain amount of expertise and is suitable for medium- and large-sized enterprises.

Assume that you want to grant IAM users the permissions to create ECSs in CN North-Beijing4 and OBS buckets in CN South-Guangzhou. With role/policy-based authorization, the administrator needs to create two custom policies and attach both to the IAM users. With identity policy-based authorization, the administrator only needs to create one custom policy, configure the condition key g:RequestedRegion for the policy, and attach the policy to the users or grant the users the access permissions to the specified regions. Identity policy-based authorization is more flexible than role/policy-based authorization.

Policies and actions in the two authorization models are not interoperable. You are advised to use the identity policy-based authorization model. For details about system-defined permissions in the two authorization models, see Role/Policy-based Authorization and Identity Policy-based Authorization.

Role/Policy-based Authorization

SMS supports authorization with roles and policies. By default, new IAM users do not have any permissions assigned. You need to add a user to one or more groups, and attach permissions policies or roles to these groups. Users inherit permissions from the groups to which they are added and can perform specified operations on cloud services based on the permissions.

SMS is a global service deployed for all physical regions. When you set the authorization scope to Global services, users have permission to access SMS resources in all regions.

Table 2 lists all the system-defined permissions for IMS. System-defined policies in role/policy-based authorization are not interoperable with those in identity policy-based authorization.

**Table 2** System-defined policies supported by SMS
Role/Policy Name	Description	Type	Dependency
SMS FullAccess	Full permissions for SMS. Users granted these permissions can create, operate, and view all SMS resources.	System-defined policy	ECS FullAccess, VPC FullAccess, IMS FullAccess, EVS FullAccess, and EIP FullAccess policies, which must be attached in the same project as SMS FullAccess. EVS KMSAccess must be attached if disk encryption is required.
SMS ReadOnlyAccess	Read-only permissions for SMS. Users granted these permissions can only view SMS data.	System-defined policy	None

Table 3 lists common operations and permissions supported by each system-defined policy of SMS.

**Table 3** Common operations supported by each system-defined policy
Operation	SMS FullAccess	SMS ReadOnlyAccess
Creating a migration task	Supported	Not supported
Viewing the migration progress	Supported	Supported
Creating a migration template	Supported	Not supported
Creating a server template	Supported	Not supported
Configuring the Agent	Supported	Not supported

Dependent Policy Configuration

To grant an IAM user the permissions to view or use resources of other cloud services on the SMS console, you must first grant the SMS FullAccess or SMS ReadOnlyAccess policy to the user group to which the user belongs and then grant the dependency policies and roles listed in Table 4.

**Table 4** Roles and policies of other services that the SMS Console depends on
Console Function	Dependent Services	Roles or Policies Required
Creating a migration task	ECS EIP VPC IMS EVS	To create a migration task, an IAM user must be granted SMS FullAccess, ECS FullAccess, VPC FullAccess, IMS FullAccess, EVS FullAccess, and EIP FullAccess.
Encrypting disks	EVS DEW	To use the disk encryption function, an IAM user must be granted SMS FullAccess and EVS KMSAccess.
Viewing the migration progress	/	No other roles or policies are required. To view the migration progress, an IAM user must be granted SMS ReadOnlyAccess.
Creating a migration template	/	No other roles or policies are required. To create a migration template, an IAM user must be assigned SMS FullAccess.
Creating a server template	VPC EVS ECS	To create a server template, an IAM user must be assigned SMS FullAccess, ECSReadOnlyAccess, VPC ReadOnlyAccess, and EVS ReadOnlyAccess.
Configuring the Agent	ECS EIP VPC IMS EVS	To configure the Agent, an IAM user must be assigned SMS Full Access, ECS FullAccess, VPC FullAccess, IMS FullAccess, EVS FullAccess, and EIP FullAccess.

Identity Policy-based Authorization

SMS supports authorization with identity policies. Table 5 lists all the system-defined identity policies for SMS. System-defined identity policies and system-defined policies in the two authorization models are not interoperable.

**Table 5** SMS system-defined identity policies
Identity policies	Description	Policy Type
SMSFullASMSssPolicy	Administrator permissions for SMS. Users granted these permissions can create, operate, and view all SMS resources.	System-defined identity policy
SMSReadOnlyPolicy	Read-only permissions for SMS. Users granted these permissions can only view SMS data.	System-defined identity policy

Table 6 lists the common operations supported by system-defined identity policies for SMS.

**Table 6** Common operations supported by system-defined identity policies of SMS
Operation	SMSFullAccessPolicy	SMSReadOnlyPolicy
Creating a migration task	Supported	Not supported
Viewing the overview	Supported	Supported
Listing source servers	Supported	Supported
Starting a migration task	Supported	Not supported
Pausing a migration task	Supported	Not supported
Launching a target server	Supported	Not supported
Synchronizing incremental data	Supported	Not supported
Deleting a migration task	Supported	Not supported
Deleting target server configuration	Supported	Not supported
Configuring a target server	Supported	Not supported
Cloning a target server	Supported	Not supported
Deleting a server clone	Supported	Not supported
Setting the migration traffic limits	Supported	Not supported
Configuring advanced options for a migration task	Supported	Not supported
Limiting migration resources	Supported	Not supported
Unlocking a target server	Supported	Not supported
Viewing verification results	Supported	Supported
Listing migration templates	Supported	Supported
Creating a migration template	Supported	Not supported
Listing server templates	Supported	Supported
Creating a server template	Supported	Not supported
Signing the privacy agreement	Supported	Supported
Registering a source server	Supported	Not supported