Using IAM Roles or Policies to Grant Access to Billing Center

Prerequisites

Before granting permissions to user groups, learn about system-defined permissions in system-defined permissions in Role/Policy-based Authorization for Billing Center. To grant permissions for other services, learn about all system-defined permissions supported by IAM.

Process Flow

Figure 1 Process of using identity policy-based authorization to grant permissions to use Billing Center

1. On the IAM console, create a user group and grant it permissions (BSS ReadonlyAccess as an example).
2. Create an IAM user and add it to the created user group.

   On the IAM console, create a user and add it to the user group created in 1.

3. Log in as the IAM user and verify permissions.

   Use the created IAM user to log in to Billing Center, and verify that the IAM user can make payments.

   Choose Funds Management > Pay page. Then, make payments. If a message appears indicating that you have insufficient permissions to perform the operation, the BSS ReadonlyAccess policy is in effect.

Example Custom Policies for Billing Center

You can create custom policies to supplement the system-defined policies of Billing Center. For details about actions supported in custom policies, see Actions Supported by Policy-based Authorization.

You can create custom policies in either of the following ways:

• Visual editor: Select cloud services, actions, resources, and conditions. This does not require knowledge of policy syntax.
• JSON: Create a JSON policy or edit an existing one.

For details, see Creating a Custom Policy. The following provides examples of custom policies in Billing Center.

• Example 1: Grant users all permissions to Billing Center.

  {
      "Version": "1.1",
      "Statement": [
          {
              "Action": [
                  "BSS:*:*"
              ],
              "Effect": "Allow"
          }
      ]
  }

• Example 2: Grant users the permission to view orders and expenditure summary.
  A custom policy can contain the actions of multiple services that are of the global or project-level type. The following is an example policy containing multiple actions:

  {
      "Version": "1.1",
      "Statement": [
          {
              "Action": [
                  "bss:account:update",
                  "bss:order:view",
                  "bss:bill:view",
  
              ],
              "Effect": "Allow"
          }
      ]
  }