Creating a User and Granting Permissions

This chapter describes how to use IAM to implement fine-grained permissions control for your DLF resources. With IAM, you can:

Create IAM users for employees based on the organizational structure of your enterprise. Each IAM user has their own security credentials, providing access to DLF resources.
Grant only the permissions required for users to perform a task.
Entrust a HUAWEI CLOUD account or cloud service to perform efficient O&M on your DLF resources.

If your HUAWEI CLOUD account does not require individual IAM users, skip this section.

This section describes the procedure for granting permissions. Figure 1 shows the procedure.

Prerequisites

Learn about the permissions supported by DLF and choose policies or roles according to your requirements. For details about the permissions supported by DLF, see Permissions Management. For the system-defined policies of other services, see System Permissions.

Process Flow

Figure 1 Process for granting DLF permissions

Create a user group and assign permissions to it.
Create a user group on the IAM console and assign the DLF OperationAndMaintenanceAccess policy to the group.
Create an IAM user.
Create a user on the IAM console and add the user to the group created in 1.
Log in and verify permissions.
Log in to the DLF console as the created user, and verify that it has management permissions for DLF.
1. Choose Service List > Data Lake Factory. Then click Buy DLF on the DLF console. If no message appears indicating insufficient permissions to perform the operation, the "DLF OperationAndMaintenanceAccess" policy has already taken effect.
2. Choose any other service in the Service List. If a message appears indicating insufficient permissions to access the service, the DLF OperationAndMaintenanceAccess policy has already taken effect.