Step 2: Create IAM Users and Log In

Creating IAM Users

1. Choose Users from the navigation pane, and click Create User.
2. Specify the user details and access type. To create more users, click Add User. A maximum of 10 users can be created at a time.
   

   • Users can log in to the cloud platform using the username, email address, or mobile number.
   • If users forget their password, they can reset it through email address or mobile number verification. If no email addresses or mobile numbers have been bound to users, users need to request the administrator to reset their passwords.

   Table 1 User information

   Parameter	Description
   Username	Username that will be used to log in to the cloud platform, for example, James and Alice. This field is required.
   Email Address	Email address of the IAM user that can be used as a login credential. IAM users can bind an email address after they are created. This field is required if you have selected Set by user for Credential Type.
   Mobile Number	Mobile phone number of the IAM user that can be used as a login credential. IAM users can bind a mobile number after they are created. This field is optional.
   Description	Additional information about the IAM user. This field is optional.
   External Identity ID	Identity of an enterprise user in IAM user SSO. The value contains a maximum of 128 characters. This field is mandatory when you configure IAM user SSO for federated login.

   • Programmatic access: Select this option to allow the user to access cloud services using development tools, such as APIs, CLI, and SDKs. You can generate an access key or set a password for the user.
   • Management console access: Select this option to allow the user to access cloud services using the management console. You can set or generate a password for the user or request the user to set a password at first login.
     

     • If the user accesses cloud services only by using the management console, select Management console access for Access Type and Password for Credential Type.
     • If the user accesses cloud services only through programmatic access, select Programmatic access for Access Type and Access key for Credential Type
     • If the user needs to use a password as the credential for programmatic access to certain APIs, select Programmatic access for Access Type and Password for Credential Type
     • If the user needs to perform access key verification when using certain services in the console, such as creating a data migration job in the Cloud Data Migration (CDM) console, select Programmatic access and Management console access for Access Type and Access key and Password for Credential Type.

     Table 2 Setting the credential type and login protection

     Credential Type and Login Protection		Description
     Access key		After you create the user, you can download the access key (AK/SK) generated for the user. Each user can have a maximum of two access keys.
     Password	Set now	Set a password for the user and determine whether to require the user to reset the password at first login. If you are the user, select this option and set a password for login. You do not need to select Require password reset at first login.
     	Automatically generated	The system automatically generates a login password for the user. After the user is created, download the EXCEL password file and provide the password to the user. The user can then use this password for login. This option is available only when you create a single user.
     	Set by user	A one-time login URL will be emailed to the user. The user can click on the link to log in to the console and set a password. If you do not use the IAM user, select this option and enter the email address and mobile number of the IAM user. The user can then set a password by clicking on the one-time login URL sent over email. The login URL is valid for seven days.
     Login Protection	Enable (Recommended)	If login protection is enabled, the user will need to enter a verification code in addition to the username and password during login. Enable this function for account security. You can choose from SMS-, email-, and virtual MFA–based login verification.
     	Disable	To enable login protection for an IAM user after creation, see "Viewing or Modifying IAM User Information" in the Identity and Access Management User Guide.

3. (Optional) Click Next to add the users to specific user groups.
   • The users will inherit the permissions assigned to the user groups.
   • You can also create new groups as required.
   

   The default user group admin has the administrator permissions and the permissions required to use all cloud resources. For mapping between the company employees and user groups, see Figure 1.

4. Click Create. If you have selected Programmatic access for Access Type and have selected Access key for Credential Type (see Table 2), you can download the access keys in the Finish step.
5. Repeat steps 1 through 4 to create users Charlie, Jackson, and Emily, and add them to the corresponding groups.

IAM User Login

After creating users (for example, James, Alice, Charlie, Jackson, and Emily), the administrator needs to provide the account name, IAM user names, and IAM users' initial passwords to corresponding employees. Employees can use their own usernames and passwords to access the cloud platform.