Using IAM Roles or Policies to Grant Access to EdgeSec

Prerequisites

Before granting permissions to user groups, learn about system-defined permissions in role/policy-based authorization for EdgeSec. To grant permissions for other services, learn about all system-defined permissions supported by IAM.

Process

Figure 1 Process of granting EdgeSec permissions

1. Creating a User Group and Assigning Permissions

   Create a user group on the IAM console and assign the EdgeSec_ReadOnly permissions to the group.

2. Creating an IAM User

   On the IAM console, create an IAM user and add it to the user group created in 1.

3. Log in and verify permissions.

   Log in to the EdgeSec console by using the created user, and verify that the user only has permissions of EdgeSec.

   • In the Service List area, choose Content Delivery Network > Security. On the displayed page, choose Subscribe. If the purchase fails (assuming that only the EdgeSec_ReadOnly permission is available), the EdgeSec_ReadOnly policy has already taken effect.
   • Choose any other service from Service List. If a message appears indicating that you do not have permissions to access the service, the EdgeSec_FullAccess policy has already taken effect.

Example Custom Policies for EdgeSec

Custom policies can be created to supplement the system-defined policies of EdgeSec. Add actions in custom policies as needed. For details about supported actions, see Actions Supported by Policy-based Authorization.

To create a custom policy, choose either visual editor or JSON.

• Visual editor: Select cloud services, actions, resources, and request conditions. This does not require knowledge of policy syntax.
• JSON: Create a JSON policy or edit an existing one.

For details, see Creating a Custom Policy. The following lists examples of common EdgeSec custom policies.

• Example 1: Allowing users to query the protected domain list

  {
      "Version": "1.1",
      "Statement": [
          {
              "Action": [
                  "edgesec:wafDomain:list"
              ],
              "Effect": "Allow"
          }
      ]
  }

• Example 2: Denying the permission to add a protected domain name

  A deny policy must be used together with other policies. If the policies assigned to a user contain both "Allow" and "Deny", the "Deny" permissions take precedence over the "Allow" permissions.

  If you grant the EdgeSec_FullAccess system policy to a user but do not want the user to have the permission (edgesec:wafDomain:create) to add a protected domain name, you can create a custom policy with the same action and set Effect to Deny, and assign both the EdgeSec_FullAccess policy and deny policy to the user. According to the deny principle, the user can perform all operations except adding a protected domain name on EdgeSec. Example:

  {
      "Version": "1.1",
      "Statement": [
          {
              "Action": [
                  "edgesec:wafDomain:create"
              ],
              "Effect": "Deny"
          }
      ]
  }

• Example 3: Defining permissions for multiple services in a policy

  A custom policy can contain the actions of multiple services that are of the global or project-level type. The following is an example policy containing actions of multiple services:

  {
          "Version": "1.1",
          "Statement": [
                  {
                          "Effect": "Allow",
                          "Action": [
                                  "edgesec:wafDomain:delete",
                                  "edgesec:wafDomain:get"
                          ]
                  },
                 {
                          "Effect": "Allow",
                          "Action": [
                                  "cdn:configuration:createDomains",
                                  "cdn:configuration:disableDomains"
                          ]
                  }
          ]
  }