Using IAM Roles or Policies to Grant Access to AAD

Prerequisites

Before assigning permissions to a user group, you need to understand the AAD permissions that can be added to the user group and select appropriate permissions. For details about the system permissions supported by AAD, see Roles and Policies. If you need to assign permissions for services other than AAD, see System-defined Policies/Roles.

Process

Figure 1 Process for granting AAD permissions

1. Creating a User Group and Assigning Permissions

   Create a user group on the IAM console, and assign the AAD ReadOnlyAccess policy to the group.

2. Creating an IAM User

   On the IAM console, create an IAM user and add it to the user group created in 1.

3. Log in and verify the user's permissions.

   In the authorized region, perform the following operations:

   • Choose Service List > Anti-DDoS Service > Advanced Anti-DDoS. Then click Buy AAD on the Instances tab page. If a message appears indicating insufficient permissions, the AAD ReadOnlyAccess policy has already taken effect.
   • Choose any other service in the Service List. (Assume that the current policy contains only AAD ReadOnlyAccess.) If a message appears indicating insufficient permissions, the AAD ReadOnlyAccess policy has already taken effect.

Example of Custom AAD Policies

Custom policies can be created to supplement the system-defined policies of AAD. Add actions in custom policies as needed. For details about supported actions, see Actions Supported by Policy-based Authorization.

You can create custom policies in either of the following ways:

• Visual editor: Select cloud services, actions, resources, and request conditions. This does not require knowledge of policy syntax.
• JSON: Edit JSON policies from scratch or based on an existing policy.

For more details, see Creating a Custom Policy. The following lists examples of common AAD custom policies.

• Example 1: Granting a user the permission to query protection policies

  {
      "Version": "1.1",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "aad:policy:get"
              ]
          }
      ]
  }

• Example 2: Denying a user the permission to delete protection policies

  A deny policy must be used together with other policies. If the policies assigned to a user contain both Allow and Deny actions, the Deny actions take precedence over the Allow actions.

  If you grant the system policy AAD Administrator to a user but do not want the user to have the permission to delete AAD protection policies, you can create a custom policy that denies the deletion of AAD protection policies and grant it to the user. Then, the user can perform all operations on AAD except deleting AAD protection policies. The following is an example of a deny policy:

  {
      "Version": "1.1",
      "Statement": [
          {
              "Effect": "Deny",
              "Action": [
                  "aad:policy:delete"
              ]
          }
      ]
  }

• Example 3: Defining permissions for multiple services in a policy

  A custom policy can contain the actions of multiple services that are of the global or project-level type. The example is as follows.

  {
      "Version": "1.1",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "aad:policy:delete"
              ]
          },
          {
              "Effect": "Allow",
              "Action": [
                  "tms:resourceTags:list"
              ]
          }
      ]
  }