Creating a User and Granting Permissions

This section describes how to use IAM to implement fine-grained permissions control for your CSE resources. With IAM, you can:

Create IAM users for employees based on the organizational structure of your enterprise. Each IAM user has their own security credentials for access to CSE resources.
Grant only the permissions required for users to perform a task.
Entrust a Huawei Cloud account or cloud service to perform professional and efficient O&M on your CSE resources.

If your Huawei Cloud account does not require individual IAM users, skip this section.

This section describes the procedure for granting permissions (see Figure 1).

Before assigning permissions to user groups, you should learn about CSE policies and select the policies based on service requirements.

For details about system permissions supported by CSE, see Permissions Management.
For details about the permissions of other services, see System Permissions.

Figure 1 Process of granting CSE permissions

Create a user group and grant permissions to it.
Create a user group on the IAM console, and grant the CSE ReadOnlyAccess policy to the group.
Create a user and add it to the user group.
Create a user on the IAM console and add the user to the group created in 1.
Log in to CSE and verify permissions.
Log in to the CSE console as the created user, and verify that it has the read-only permission for CSE.
- In Service List, choose Cloud Service Engine. On the console, choose ServiceComb > Buy Exclusive Microservice Engine. If a message is displayed indicating insufficient permissions, the ReadOnlyAccess policy has taken effect.
- Choose any other service in Service List. If a message is displayed indicating insufficient permissions to access the service, the ReadOnlyAccess policy has taken effect.