Updated on 2023-12-26 GMT+08:00

Introduction

If you need to assign different permissions to personnel in your enterprise to access Cost Center, Identity and Access Management (IAM) is a good choice for fine-grained permissions management.

IAM is a free service. You only pay for the resources in your account. For more information about IAM, see IAM Service Overview.

System-Defined Roles

New IAM users do not have any permissions assigned by default. You need to first add them to one or more groups and attach policies or roles to these groups. The users then inherit permissions from the groups and can perform specified operations on cloud services based on the permissions they have been assigned. IAM provides frequently used roles that have permissions to access different services, and you have the permissions granted to these roles.

You can grant users permissions by using roles and policies.

  • Roles: A coarse-grained authorization strategy provided by IAM to assign permissions based on users' job responsibilities. Only a limited number of service-level roles are available for authorization. Huawei Cloud services depend on each other. When you grant permissions using roles, you also need to attach dependent roles. Roles are not ideal for fine-grained authorization and least privilege access.
  • Policies: A fine-grained authorization strategy that defines permissions required to perform operations on specific cloud resources under certain conditions. This type of authorization is more flexible and is ideal for least privilege access.

Table 1 lists all the system-defined roles for Cost Center.

Table 1 System-defined roles

Role Name

Permissions

BSS Administrator

Full permissions for Cost Center. This role is generally granted to the administrator.

BSS Operator

Permissions include querying cost analyses, budget details, and cost tags in Cost Center. This role is generally granted to the technical personnel, such as R&D and O&M personnel.

BSS Finance

Financial permissions. Users with these permissions can perform all financial operations in Cost Center. This role is generally granted to financial personnel.

Table 2 lists the common operations supported by system-defined roles for Cost Center.

Table 2 Common operations supported by system-defined roles

Page

Function

BSS Administrator

BSS Operator

BSS Finance

-

Enabling Cost Center

Supported

Not supported

Supported

Overview

Viewing current month costs

Supported

Supported

Supported

Viewing daily costs

Supported

Supported

Supported

Viewing current month trends

Supported

Supported

Supported

Viewing recently accessed reports

Supported

Supported

Supported

Cost Analysis

Querying cost analyses

Supported

Supported

Supported

Exporting cost details

Supported

Not supported

Supported

Budgets

Setting a budget

Supported

Not supported

Supported

Viewing budget details

Supported

Supported

Supported

Exporting budgets

Supported

Not supported

Supported

Reports

Creating and saving reports

Supported

Not supported

Supported

Viewing reports

Supported

Supported

Supported

Budget Reports

Configuring budget reports

Supported

Not supported

Supported

Deleting budget reports

Supported

Not supported

Supported

Viewing budget reports

Supported

Supported

Supported

Cost Anomaly Detection

Creating cost monitors

Supported

Not supported

Supported

Deleting cost monitors

Supported

Not supported

Supported

Viewing cost monitors and anomalies

Supported

Supported

Supported

Accessing Cost Analysis

Supported

Supported

Supported

Disabling alerts for cost anomalies

Supported

Not supported

Supported

Viewing alert settings for cost anomalies

Supported

Supported

Supported

Reserved Instances

Analyzing RI utilization and coverage

Supported

Supported

Supported

Exporting RI utilization and coverage analyses

Supported

Not supported

Supported

Creating and saving reports

Supported

Not supported

Supported

Yearly/monthly subscriptions

Evaluating cost optimization option of changing pay-per-use to yearly/monthly

Supported

Supported

Supported

Savings Plans

Viewing savings plans (summary)

Supported

Supported

Supported

Analyzing utilization and coverage of savings plans

Supported

Supported

Supported

Viewing savings plans recommendations

Supported

Not supported

Supported

Cost Tags

Viewing cost tags

Supported

Supported

Supported

Activating cost tags

Supported

Not supported

Supported

Cost Category

Creating cost categories

Supported

Not supported

Supported

Deleting cost categories

Supported

Not supported

Supported

Viewing cost categories

Supported

Supported

Supported

Exporting cost splitting details

Supported

Not supported

Supported

Viewing cost analyses

Supported

Supported

Supported

Preferences

Enabling functions

Supported

Not supported

Supported

Disabling functions

Supported

Not supported

Supported

Export History

Exporting historical records

Supported

Not supported

Supported

Cost Optimization

Viewing cost optimization summary

Supported

Supported

Supported

Viewing cost optimization subscriptions

Supported

Supported

Supported

Configuring cost optimization subscriptions

Supported

Not supported

Supported

Cost Details Export

Exporting cost details

Supported

Not supported

Supported

Creating a Custom Policy

You can create custom policies to supplement the system-defined roles. For details about the actions supported by custom policies, see Table 3.

Table 3 Supported actions

Fine-Grained Permissions Policy

Description

bss:costcenter:start

Enables Cost Center.

bss:costanalysis:view

Views cost analysis and overview.

bss:costanalysis:export

Exports cost details, including original and amortized cost details, with cost tags.

bss:costreport:view

Views a list of cost reports.

bss:costreport:update

Manages cost reports, including creating, modifying, and deleting custom reports.

If this permission is granted to an IAM user, you must also grant the user the bss:costreport:view permission.

bss:budget:update

Manages budgets, including creating, modifying, and deleting budgets.

If this permission is granted to an IAM user, you must also grant the user the bss:budget:view permission.

bss:budget:view

Views budget information, including the budget list and budget details.

bss:budgetreport:update

Adds and modifies budget reports.

bss:budgetreport:delete

Deletes budget reports.

bss:budgetreport:view

Views budget reports, including the budget list and budget details.

bss:riusageanalysis:view

Views the analysis of RI utilization and coverage.

bss:costtag:view

Views cost tags.

bss:costtag:update

Activates or deactivates cost tags.

If this permission is granted to an IAM user, you must also grant the user the bss:costtag:view permission.

bss:costunit:update

Configures cost categories, including creating and editing cost categories. If this permission is granted to an IAM user, you must also grant the user the bss:costunit:view and bss:costanalysis:view permissions.

bss:costunit:delete

Deletes cost categories. If this permission is granted to an IAM user, you must also grant the user bss:costunit:view permission.

bss:costunit:view

Views the list of cost categories and the details of each cost category.

bss:monitor:update

Adds or edits cost monitors.

bss:monitor:delete

Deletes cost monitors.

bss:monitor:view

Views cost monitors and anomalies.

bss:monitoralert:update

Creates cost anomaly notifications.

If this permission is granted to an IAM user, you must also grant the user the bss:monitoralert:view permission.

bss:monitoralert:view

Views cost anomaly notifications.

bss:costoptimization:view

Evaluates cost optimization option of changing pay-per-use to yearly/monthly.

bss:costpreferences:update

Enables functions on the Preferences page.

bss:costpreferences:delete

Disables functions on the Preferences page.

bss:savingsplan:view

Views savings plans.

bss:savingsplan:analysis

Views the analysis of savings plan utilization and coverage.

bss:savingsplan:suggest

Obtains recommendations for savings plans.

bss:recommendation:view

Views cost optimization summary.

bss:recommendationsub:view

Views cost optimization subscriptions.

bss:recommendationsub:update

Configures cost optimization subscriptions.