Help Center/ Cloud Certificate & Manager/ SSL Certificate Manager (SCM) User Guide/ Using IAM to Grant Access to SCM/ Using IAM Identity Policies to Grant Access to SCM
Updated on 2026-02-02 GMT+08:00
View PDF
Share

Using IAM Identity Policies to Grant Access to SCM

Use IAM to manage permissions for your SCM resources through Identity policy. With IAM, you can:

  • Create IAM users or user groups for personnel based on your enterprise's organizational structure. Each IAM user has their own identity credentials for accessing SCM resources.
  • Grant only the permissions required for users to perform a task.
  • Entrust a Huawei Cloud account or cloud service to perform professional and efficient O&M on your resources.

If your Huawei Cloud account meets your permissions requirements, you can skip this section.

This section describes how to perform identity policy-based authorization. Figure 1 shows the process.

Prerequisites

Before granting permissions, learn about the SCM permissions and select them as required. For details about the system policies supported by SCM, see Identity Policy Permissions Management. For details about the permissions that can be granted to other services, see System-defined Permissions.

Process Flow

Figure 1 Process for granting SCM permissions
  1. On the IAM console, create an IAM user or create a user group.

    Create a user or user group on the IAM console.

  2. Attach a system identity policy to a user or user group.

    Assign the system-defined identity policy SCMReadOnlyPolicy to the user or user group.

  3. Log in and verify permissions.

    Log in to the console as an authorized user and verify the permissions.

    • Choose Service List > CCM. On the SCM page, click Buy Certificate in the upper right corner to purchase an SSL certificate. If the certificate cannot be purchased (assume that the current permission contains only SCMReadOnlyPolicy), the SCMReadOnlyPolicy policy has already taken effect.
    • Choose another service from Service List. If a message appears indicating that you have insufficient permissions to access the service, the SCMReadOnlyPolicy policy is in effect.

Example Custom Policies

If the system-defined policies of SCM cannot meet your needs, you can create custom identity policies. For details about the actions supported by custom identity policies, see Actions Supported by Identity Policy-based Authorization.

You can create custom identity policies in either of the following ways:

  • Visual editor: Select cloud services, actions, resources, and request conditions. This does not require knowledge of policy syntax.
  • JSON: Create a JSON policy or edit an existing one.

For details, see Creating a Custom Identity Policy and Attaching It to a Principal.

The following provides examples of custom identity policies for SCM.

  • Example 1: Allow a user to view the certificate list only. 
    {
    "Version": "5.0",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "scm:cert:list"
            ]
        }
    ]
}
  • Example 2: Defining permissions for multiple services in a policy

    A custom policy can contain the actions of multiple services. The following example grants some PCA and KMS permissions:

    {
    "Version": "5.0",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "scm:cert:list",
                "pca:ca:list",
                "kms:cmk:create"
            ]
        }
    ]
}