Help Center/ Cloud Application Engine/ User Guide/ Using IAM to Grant Access to CAE/ Using IAM Identity Policies to Allow Access to CAE
Updated on 2026-01-05 GMT+08:00
View PDF
Share

Using IAM Identity Policies to Allow Access to CAE

System-defined permissions in "Identity Policy-based Authorization" provided by Identity and Access Management (IAM) let you control access to CAE. With IAM, you can:

  • Create IAM users or user groups for personnel based on your enterprise's organizational structure. Each IAM user has their own identity credentials for accessing CAE resources.
  • Grant only the permissions required for users to perform a specific task.
  • Entrust a Huawei Cloud account or a cloud service to perform efficient O&M on your CAE resources.

If your Huawei Cloud account meets your permissions requirements, you can skip this section.

Figure 1 shows the process flow of identity policy-based authorization.

Prerequisites

Before granting permissions, learn about system-defined permissions for CAE. For details about the system-defined identity policies supported by CAE, see Identity Policy-based Permissions Management. To grant permissions for other services, learn about all system-defined permissions supported by IAM.

Process Flow

Figure 1 Process for granting CAE permissions
  1. On the IAM console, create an IAM user or create a user group.

    Create a user or user group on the IAM console.

  2. Attach a system-defined identity policy to the user or user group.

    Attach the system-defined identity policy CAEReadOnlyPolicy to the user or user group.

  3. Log in as the IAM user and verify permissions.

    In the authorized region, perform the following operations:

    • In Service List, choose Cloud Application Engine. On the CAE console, choose Components > Create Component. If a message appears indicating insufficient permissions after you click Create and Deploy Component, the CAEReadOnlyPolicy policy has taken effect.
    • Choose any other service in Service List. If a message appears indicating insufficient permissions, the CAEReadOnlyPolicy policy has taken effect.

Example Custom Identity Policies

You can create custom identity policies to supplement the system-defined identity policies of CAE. For details about the actions supported by custom identity policies, see Actions Supported by Identity Policy-based Authorization.

To create a custom identity policy, choose either visual editor or JSON.

  • Visual editor: Select cloud services, actions, resources, and request conditions. This does not require knowledge of policy syntax.
  • JSON: Create a JSON policy or edit an existing one.

For details, see Creating a Custom Identity Policy and Attaching It to a Principal.

When creating a custom identity policy, use the Resource element to specify the resources the identity policy applies to and use the Condition element (service-specific condition keys) to control when the identity policy is in effect. For details about the supported resource types and condition keys, see Actions Supported by Identity Policy-based Authorization. The following provides examples of custom CAE identity policies.

  • Example 1: Grant the permission to create and delete CAE components. 
    {
    "Version": "5.0",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "cae:component:createComponent",
                "cae:component:deleteComponent"
            ]
        }
    ]
}
  • Example 2: Create a custom identity policy containing multiple actions.

    A custom identity policy can contain the actions of one or multiple services. The following is an example policy containing multiple actions.

    {
    "Version": "5.0",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "cae:environment:createEnvironment",
                "cae:environment:deleteEnvironment"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "aom:metric:list",
                "aom:alarm:list"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "lts:logGroup:getLogGroup",
            ]
        }
    ]
}