Using IAM Roles or Policies to Grant Access to Anti-DDoS

Prerequisites

Before assigning permissions to a user group, you need to understand the Anti-DDoS permissions that can be added to the user group and select the permissions as required. For details about the system permissions supported by Anti-DDoS, see Anti-DDoS Permissions. If you need to assign permissions for services other than Anti-DDoS, see System-defined Policies/Roles.

Process

Figure 1 Process for granting Anti-DDoS permissions

1. Creating a User Group and Assigning Permissions

   Create a user group on the IAM console, and assign the Anti-DDoS ReadOnlyAccess policy to the group.

2. Creating an IAM User

   On the IAM console, create an IAM user and add it to the user group created in 1.

3. Log in and verify the user's permissions.

   Log in to the Anti-DDoS console by using the created user, and verify that the user has the following permissions:

   • Log in to the AAD console, locate the row that contains the public IP address, click Set Protection, and set the traffic cleaning threshold. If the threshold cannot be set, the Anti-DDoS ReadOnlyAccess policy has taken effect.
   • Select any service except Anti-DDoS (assume that the current policy contains only Anti-DDoS ReadOnlyAccess). If the system displays a message indicating that you do not have the required permission, the Anti-DDoS ReadOnlyAccess policy has taken effect.

Anti-DDoS Custom Policy Examples

Custom policies can be created to supplement the system-defined policies of Anti-DDoS. Add actions in custom policies as needed. For details about supported actions, see Actions Supported by Policy-based Authorization.

You can create custom policies in either of the following ways:

• Visual editor: Select cloud services, actions, resources, and request conditions. This does not require knowledge of policy syntax.
• JSON: Edit JSON policies from scratch or based on an existing policy.

For more details, see Creating a Custom Policy. The following provides examples of custom Anti-DDoS policies.

• Example 1: Authorizing a user to query the default Anti-DDoS policy

  {
      "Version": "1.1",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "
                     anti-ddos:defaultDefensePolicy:get
                   "
              ]
          }
      ]
  }

• Example 2: Denying users to delete the default Anti-DDoS protection policy

  A deny policy must be used together with other policies. If the policies assigned to a user contain both Allow and Deny actions, the Deny actions take precedence over the Allow actions.

  If you have granted the system policy Anti-DDoS Administrator to a user but do not want the user to have the permission to delete the default Anti-DDoS protection policy defined in Anti-DDoS Administrator, you can create a custom policy that denies the deletion of the default Anti-DDoS protection policy and grant it to the user. Then, the user can perform all operations on Anti-DDoS except deleting the default Anti-DDoS protection policy. The following is an example of a deny policy:

  {
          "Version": "1.1",
          "Statement": [
                  {
                          "Action": [
                                  "anti-ddos:defaultDefensePolicy:delete"
                          ],
                          "Effect": "Deny"
                  }
          ]
  }

• Example 3: Defining permissions for multiple services in a policy

  A custom policy can contain the actions of multiple services that are of the global or project-level type. The example is as follows:

  {
          "Version": "1.1",
          "Statement": [
                  {
                          "Effect": "Allow",
                          "Action": [
                                  "anti-ddos:defaultDefensePolicy:get",
                                  "anti-ddos:defaultDefensePolicy:create"
                          ]
                  },
                 {
                          "Effect": "Allow",
                          "Action": [
                                  "waf:instance:get",
                                  "waf:certificate:get",
                          ]
                  }
          ]
  }