Permissions

If you need to assign different permissions to personnel in your enterprise to access your VPCs, Identity and Access Management (IAM) is a good choice for fine-grained permissions management. IAM provides identity authentication, permissions management, and access control, helping you to securely access your Huawei Cloud resources. If your HUAWEI ID does not require IAM for permissions management, you can skip this section.

IAM is a free service. You only pay for the resources in your account.

With IAM, you can create IAM users and assign permissions enabling them to control their access to specific resources. For example, if you want some software developers in your enterprise to use VPCs but do not want them to delete VPCs or perform any other high-risk operations, you can grant permissions to use VPCs but not permissions to delete them.

IAM supports role/policy-based authorization and identity policy-based authorization.

The following table describes the differences between these two authorization models.

**Table 1** Differences between role/policy-based and identity policy-based authorization
Authorization Model	Authorization Using	Permissions	Authorization Method	Scenario
Role/Policy	User-permission-authorization scope	System-defined roles System-defined policies Custom policies	Granting roles or policies to principals	To authorize a user, you need to add it to a user group first and then specify the scope of authorization. It is hard to provide fine-grained permissions control using authorization by user groups and a limited number of condition keys. This method is suitable for small- and medium-sized enterprises.
Identity policy	Policies	System-defined policies Custom identity policies	Granting policies to principals Attaching identity policies to principals	You can authorize a user by attaching an identity policy to it. User-specific authorization and a variety of key conditions allow for more fine-grained permissions control. However, this model can be hard to set up. It requires a certain amount of expertise and is suitable for medium- and large-sized enterprises.

Assume that you want to grant IAM users the permissions to create VPCs in CN North-Beijing4 and OBS buckets in CN South-Guangzhou. With role/policy-based authorization, the administrator needs to create two custom policies and attach both to the IAM users. With identity policy-based authorization, the administrator only needs to create one custom policy and configure the condition key g:RequestedRegion for the policy, and then attach the policy to the principals or grant the principals the access permissions to the specified regions. Identity policy-based authorization is more flexible than role/policy-based authorization.

Policies and actions in the two authorization models are not interoperable. You are advised to use the identity policy-based authorization model. For details about system-defined permissions, see Role/Policy-based Authorization and Identity Policy-based Authorization.

For more information about IAM, see IAM Service Overview.

Role/Policy-based Authorization

VPC supports authorization with roles and policies. New IAM users do not have any permissions assigned by default. You need to first add them to one or more groups and attach policies or roles to these groups. The users then inherit permissions from the groups and can perform specified operations on cloud services based on the permissions they have been assigned.

VPC is a project-level service deployed for specific regions. When you set Scope to Region-specific projects and select the specified projects (for example, ap-southeast-2) in the specified regions (for example, AP-Bangkok), the users only have permissions for VPCs in the selected projects. If you set Scope to All resources, users have permissions for VPCs in all region-specific projects. When accessing VPCs, the users need to switch to the authorized region.

Table 2 lists all the system-defined permissions for VPC. System-defined policies in role/policy-based authorization are not interoperable with those in identity policy-based authorization.

**Table 2** System-defined permissions for VPC
Role/Policy Name	Description	Type	Dependencies
VPCFullAccess	Full permissions for VPC.	System-defined policy	None
VPCReadOnlyAccess	Read-only permissions on VPC.	System-defined policy	None
VPC Administrator	Most permissions on VPC, excluding creating, modifying, deleting, and viewing security groups and security group rules. To be granted this permission, users must also have the Tenant Guest permission.	System-defined role	Tenant Guest policy, which must be attached in the same project as VPC Administrator.

Table 3 lists the common operations supported by system-defined permissions for VPC.

**Table 3** Common operations supported by system-defined permissions
Operation	VPCReadOnlyAccess	VPC Administrator	VPCFullAccess
Creating a VPC	Not supported	Supported	Supported
Modifying a VPC	Not supported	Supported	Supported
Deleting a VPC	Not supported	Supported	Supported
Viewing VPC information	Supported	Supported	Supported
Creating a subnet	Not supported	Supported	Supported
Viewing subnet information	Supported	Supported	Supported
Modifying a subnet	Not supported	Supported	Supported
Deleting a subnet	Not supported	Supported	Supported
Creating a security group	Not supported	Not supported	Supported
Viewing security group information	Supported	Not supported	Supported
Modifying a security group	Not supported	Not supported	Supported
Deleting a security group	Not supported	Not supported	Supported
Adding a security group rule	Not supported	Not supported	Supported
Viewing a security group rule	Supported	Not supported	Supported
Modifying a security group rule	Not supported	Not supported	Supported
Deleting a security group rule	Not supported	Not supported	Supported
Creating a network ACL	Not supported	Supported	Supported
Viewing a network ACL	Supported	Supported	Supported
Modifying a network ACL	Not supported	Supported	Supported
Deleting a network ACL	Not supported	Supported	Supported
Adding a network ACL rule	Not supported	Supported	Supported
Modifying a network ACL rule	Not supported	Supported	Supported
Deleting a network ACL rule	Not supported	Supported	Supported
Creating a VPC peering connection	Not supported	Supported	Supported
Modifying a VPC peering connection	Not supported	Supported	Supported
Deleting a VPC peering connection	Not supported	Supported	Supported
Querying a VPC peering connection	Supported	Supported	Supported
Accepting a VPC peering connection request	Not supported	Supported	Supported
Rejecting a VPC peering connection request	Not supported	Supported	Supported
Creating a route table	Not supported	Supported	Supported
Deleting a route table	Not supported	Supported	Supported
Modifying a route table	Not supported	Supported	Supported
Associating a route table with a subnet	Not supported	Supported	Supported
Adding a route	Not supported	Supported	Supported
Modifying a route	Not supported	Supported	Supported
Deleting a route	Not supported	Supported	Supported
Creating a VPC flow log	Not supported	Supported	Supported
Viewing a VPC flow log	Supported	Supported	Supported
Enabling or disabling a VPC flow log	Not supported	Supported	Supported
Deleting a VPC flow log	Not supported	Supported	Supported
Creating an IP address group	Not supported	Supported	Supported
Associating an IP address group with resources	Not supported	Supported	Supported
Disassociating an IP address group from resources	Not supported	Supported	Supported
Adding IP addresses to an IP address group	Not supported	Supported	Supported
Deleting IP addresses from an IP address group	Not supported	Supported	Supported
Modifying an IP address group	Not supported	Supported	Supported
Deleting an IP address group	Not supported	Supported	Supported
Creating a mirror filter	Not supported	Supported	Supported
Adding an inbound or outbound mirror filter rule	Not supported	Supported	Supported
Modifying an inbound or outbound mirror filter rule	Not supported	Supported	Supported
Deleting an inbound or outbound mirror filter rule	Not supported	Supported	Supported
Modifying basic information about a mirror filter	Not supported	Supported	Supported
Viewing the details about a mirror filter	Supported	Supported	Supported
Deleting a mirror filter	Not supported	Supported	Supported
Creating a mirror session	Not supported	Supported	Supported
Enabling or disabling a mirror session	Not supported	Supported	Supported
Associating mirror sources with a mirror session	Not supported	Supported	Supported
Disassociating mirror sources from a mirror session	Not supported	Supported	Supported
Changing the mirror filter for a mirror session	Not supported	Supported	Supported
Changing the mirror target of a mirror session	Not supported	Supported	Supported
Modifying the basic information about a mirror session	Not supported	Supported	Supported
Viewing the details about a mirror session	Supported	Supported	Supported
Deleting a mirror session	Not supported	Supported	Supported

Identity Policy-based Authorization

VPC supports authorization with identity policies. Table 4 lists all the system-defined policies for VPC in identity policy-based authorization. System-defined policies in identity policy-based authorization are not interoperable with those in role/policy-based authorization.

**Table 4** System-defined identity policies for VPC
Identity Policy	Description	Type
VPCFullAccessPolicy	Full permissions for VPC.	System-defined identity policies
VPCReadOnlyPolicy	Read-only permissions for VPC.	System-defined identity policies
VPCConsoleFullAccessPolicy	Permissions for all operations on the VPC console.	System-defined identity policies
VPCConsoleReadOnlyPolicy	Read-only permissions for the VPC console.	System-defined identity policies

Table 5 lists the common operations supported by system-defined identity policies for VPC.

**Table 5** Common operations supported by system-defined identity policies
Operation	VPCFullAccessPolicy	VPCReadOnlyPolicy	VPCConsoleFullAccessPolicy	VPCConsoleReadOnlyPolicy
Creating a VPC	Supported	Not supported	Supported	Not supported
Modifying a VPC	Supported	Not supported	Supported	Not supported
Deleting a VPC	Supported	Not supported	Supported	Not supported
Viewing VPC information	Supported	Supported	Supported	Supported
Creating a subnet	Supported	Not supported	Supported	Not supported
Viewing subnet information	Supported	Supported	Supported	Supported
Modifying a subnet	Supported	Not supported	Supported	Not supported
Deleting a subnet	Supported	Not supported	Supported	Not supported
Creating a security group	Supported	Not supported	Supported	Not supported
Viewing security group information	Supported	Supported	Supported	Supported
Modifying a security group	Supported	Not supported	Supported	Not supported
Deleting a security group	Supported	Not supported	Supported	Not supported
Adding a security group rule	Supported	Not supported	Supported	Not supported
Viewing a security group rule	Supported	Supported	Supported	Supported
Modifying a security group rule	Supported	Not supported	Supported	Not supported
Deleting a security group rule	Supported	Not supported	Supported	Not supported
Creating a network ACL	Supported	Not supported	Supported	Not supported
Viewing a network ACL	Supported	Supported	Supported	Supported
Modifying a network ACL	Supported	Not supported	Supported	Not supported
Deleting a network ACL	Supported	Not supported	Supported	Not supported
Adding a network ACL rule	Supported	Not supported	Supported	Not supported
Modifying a network ACL rule	Supported	Not supported	Supported	Not supported
Deleting a network ACL rule	Supported	Not supported	Supported	Not supported
Creating a VPC peering connection	Supported	Not supported	Supported	Not supported
Modifying a VPC peering connection	Supported	Not supported	Supported	Not supported
Deleting a VPC peering connection	Supported	Not supported	Supported	Not supported
Creating a route table	Supported	Not supported	Supported	Not supported
Deleting a route table	Supported	Not supported	Supported	Not supported
Adding a route	Supported	Not supported	Supported	Not supported
Modifying a route	Supported	Not supported	Supported	Not supported
Deleting a route	Supported	Not supported	Supported	Not supported
Creating a VPC flow log	Supported	Not supported	Supported	Not supported
Viewing a VPC flow log	Supported	Supported	Supported	Supported
Enabling or disabling a VPC flow log	Supported	Not supported	Supported	Not supported
Deleting a VPC flow log	Supported	Not supported	Supported	Not supported
Assigning a virtual IP address	Supported	Not supported	Supported	Not supported
Binding a virtual IP address to a resource	Supported	Not supported	Supported	Not supported
Unbinding a virtual IP address from a resource	Supported	Not supported	Supported	Not supported
Releasing a virtual IP address	Supported	Not supported	Supported	Not supported
Creating an IP address group	Supported	Not supported	Supported	Not supported
Associating an IP address group with resources	Supported	Not supported	Supported	Not supported
Disassociating an IP address group from resources	Supported	Not supported	Supported	Not supported
Adding IP addresses to an IP address group	Supported	Not supported	Supported	Not supported
Deleting IP addresses from an IP address group	Supported	Not supported	Supported	Not supported
Modifying an IP address group	Supported	Not supported	Supported	Not supported
Deleting an IP address group	Supported	Not supported	Supported	Not supported
Creating a mirror filter	Supported	Not supported	Supported	Not supported
Adding an inbound or outbound mirror filter rule	Supported	Not supported	Supported	Not supported
Modifying an inbound or outbound mirror filter rule	Supported	Not supported	Supported	Not supported
Deleting an inbound or outbound mirror filter rule	Supported	Not supported	Supported	Not supported
Modifying basic information about a mirror filter	Supported	Not supported	Supported	Not supported
Viewing the details about a mirror filter	Supported	Supported	Supported	Supported
Deleting a mirror filter	Supported	Not supported	Supported	Not supported
Creating a mirror session	Supported	Not supported	Supported	Not supported
Enabling or disabling a mirror session	Supported	Not supported	Supported	Not supported
Associating mirror sources with a mirror session	Supported	Not supported	Supported	Not supported
Disassociating mirror sources from a mirror session	Supported	Not supported	Supported	Not supported
Changing the mirror filter for a mirror session	Supported	Not supported	Supported	Not supported
Changing the mirror target of a mirror session	Supported	Not supported	Supported	Not supported
Modifying the basic information about a mirror session	Supported	Not supported	Supported	Not supported
Viewing the details about a mirror session	Supported	Supported	Supported	Supported
Deleting a mirror session	Supported	Not supported	Supported	Not supported

Roles or Policies Required for Operations on the VPC Console

**Table 6** Roles or policies required for operations on the VPC console
Console Function	Dependency	Identity Policies Required
Binding a virtual IP address to a Layer 2 connection	Enterprise Switch	After assigning the VPCConsoleFullAccessPolicy permission to an IAM user, you need to assign the VPC ReadOnlyAccess permission to this user so that they can access Layer 2 connections. IAM users with the VPC FullAccess permission can directly access the Layer 2 connections.
Binding a global EIP to a virtual IP address	Elastic IP (EIP)	After assigning the VPCConsoleFullAccessPolicy permission to an IAM user, you need to assign the EIP ReadOnlyAccess permission to this user so that they can access global EIPs.