Help Center> Workspace> User Guide (Application Streaming)> Overview> Permissions Management
Updated on 2024-03-12 GMT+08:00
View PDF

Permissions Management

  • The Identity and Access Management (IAM) service is used to manage the permissions for accessing cloud services and resources.
  • Workspace Application Streaming is a regional project. You can create multiple IAM user groups and grant them the Workspace Application Streaming administrator permissions of different projects to manage users' access to Workspace Application Streaming resources.
  • If your Huawei Cloud account does not require individual IAM users for permissions management, skip this section.

Related Concepts

IAM is a free service. You only pay for the resources in your account. For more information about IAM, see What Is IAM?

Account

An account is created after you successfully sign up for Huawei Cloud, and you can use it to purchase Huawei Cloud resources. The account has full access permissions for your cloud resources and can be used to make payments for them. You can use the account to reset user passwords, assign permissions, and receive and pay all bills generated by your IAM users for their usage of resources.

You cannot modify or delete your account in IAM, but you can do so in My Account.

IAM user

You can use your account to create IAM users and assign permissions for specific resources. Each IAM user has their own identity credentials (passwords or access keys) and uses cloud resources based on assigned permissions. IAM users cannot make payments themselves. You can use your account to pay their bills.

User group

You can use user groups to assign permissions to IAM users. New IAM users do not have any permissions assigned by default. You need to add them to one or more groups. The users then inherit permissions from the groups and can perform specified operations on resources or cloud services based on the permissions they have been assigned. If you add a user to multiple user groups, the user inherits all the permissions that are assigned to these groups.

The default user group admin has all the permissions for using all of the cloud resources. IAM users in this group can perform operations on all resources, including but not limited to creating user groups and users, assigning permissions, and managing resources.

Examples

For example, you want to isolate permissions of employees in groups a and b. That is, employees in group a use Workspace Application Streaming resources in region 1, and employees in group b use Workspace Application Streaming resources in region 2.

  1. You can create user groups A and B and assign them permissions. That is, assign user group A the Workspace Application Streaming administrator permissions in region 1, and assign user group B the Workspace Application Streaming administrator permissions in region 2.
  2. Create two IAM users user1 and user2, and add user1 to user group A and user2 to user group B. user1 has the Workspace Application Streaming administrator permissions in region 1, and user2 has the Workspace Application Streaming administrator permissions in region 2.
  3. The administrator of group a can use the account of user1 to log in to Huawei Cloud and go to the Workspace Application Streaming console of the project in region 1 to publish applications for the employees of group a and manage the applications of the project in region 1. The administrator of group b can use the account of user2 to log in to Huawei Cloud and go to the Workspace Application Streaming console of the project in region 2 to publish applications for the employees of group b and manage the applications of the project in region 2. Figure 1 shows the process. For details about how to create an IAM user, see Creating an IAM User.
Figure 1 Operation process

Workspace Application Streaming Administrator Permissions

By default, new IAM users do not have permissions assigned. You need to add a user to one or more groups, and grant Workspace Application Streaming administrator permissions to these groups. Users inherit permissions from their groups. After authorization, IAM users can perform operations on Workspace Application Streaming resources in the corresponding projects.

Table 1 lists all system permissions of Workspace (Application Streaming) and operation permissions required by dependent services. The Dependency column indicates roles on which a Workspace (Application Streaming) system permission depends to take effect. Workspace (Application Streaming) roles are dependent on the roles of other services because Huawei Cloud services interact with each other. Therefore, when assigning Workspace Application Streaming permissions to a user group, you need to select the permissions listed in Table 1. Do not cancel other dependent permissions that are selected by default. Otherwise, the Workspace Application Streaming permissions do not take effect.

Table 1 System permissions of Workspace (Application Streaming)

System Permission

Description

Dependency

Workspace Administrator

Workspace (Application Streaming) administrator permissions. Users granted these permissions can perform all operations allowed by Workspace (Application Streaming).

This role depends on the Tenant Guest, Server Administrator, and VPC Administrator roles.

  • Tenant Guest: read-only permissions for all cloud services (except IAM)
  • Server Administrator: server administrator
  • VPC Administrator: network administrator

IMS Administrator

Full permissions for IMS.

This role depends on the Tenant Administrator role.

Creating an IAM User for Workspace Application Streaming

  1. Create a user group and assign permissions.

    Create a user group on the IAM console, and assign the Workspace Administrator, IMS Administrator, and ECS FullAccess permissions listed in Table 1 to the group. Then select the authorization scope.

  2. Create a user and add them to the user group.

    Create a user on the IAM console and add the user to the group created in 1.

  3. Log in and verify permissions.

    Log in to the Workspace Application Streaming console as the newly created user, and verify whether the user has the administrator permissions.

    1. Log in to the Workspace Application Streaming console.
    2. Select Authorize. The Workspace Application Streaming console is displayed.

      Workspace Application Streaming supports elastic scaling. You need to obtain user authorization to create an agency account so that the system can automatically scale in or out after elastic scaling is enabled.

    3. After the service is enabled, click Server Groups in the navigation pane. On the Server Groups page, click Create Server Group in the upper right corner. If no message indicating insufficient permissions is displayed, the granted permissions have taken effect.

Parent topic: Overview