Creating a User and Granting Permissions

This section describes IAM's fine-grained permissions management for your HSS resources. With IAM, you can:

Create IAM users for employees based on the organizational structure of your enterprise. Each IAM user has their own security credentials, providing access to HSS resources.
Grant only the permissions required for users to perform a specific task.
Entrust a Huawei cloud account or cloud service to perform professional and efficient O&M on your HSS resources.

If your Huawei Cloud account does not require individual IAM users, skip this chapter.

This section describes the procedure for granting permissions (see Figure 1).

Prerequisite

Before authorizing permissions to a user group, you need to know which HSS permissions can be added to the user group. Table 1 describes the policy details.

**Table 1** System-defined permissions supported by HSS
Role/Policy Name	Description	Type	Dependency
HSS Administrator	HSS administrator, who has all permissions of HSS	System-defined role	It depends on the Tenant Guest role. Tenant Guest: A global role, which must be assigned in the global project. To purchase HSS protection quotas, you must have the ECS ReadOnlyAccess, BSS Administrator, and TMS ReadOnlyAccess roles. ECS ReadOnlyAccess: read-only access permission for the ECS. This is a system policy. BSS Administrator: a system role, which is the administrator of the billing center (BSS) and has all permissions for the service. TMS ReadOnlyAccess: a system-defined policy that grants read-only access to TMS.
HSS FullAccess	All HSS permissions	System-defined policy	To purchase HSS protection quotas, you must have the BSS Administrator role. BSS Administrator: a system role, which is the administrator of the billing center (BSS) and has all permissions for the service. SMN ReadOnlyAccess: a system-defined policy that grants read-only access to SMN.
HSS ReadOnlyAccess	Read-only permission for HSS	System-defined policy	SMN ReadOnlyAccess: a system-defined policy that grants read-only access to SMN.

Authorization Process

Figure 1 Process for granting permissions

The following procedure describes how to grant only the HSS Administrator permission to users, so that the users can only access and manage HSS and cannot access other cloud services.

Create a user group and assign permissions. On the IAM console, grant the HSS Administrator permission.
Create a user and add it to the group. On the IAM console, add the user to the group created in 1.
Log in and verify permissions.
Log in to the management console as the new user, switch to a region where the user has been granted permissions, and verify that the user only has the HSS Administrator permission.
1. In the service list, choose HSS. The Dashboard page is displayed.
2. Choose a service other than HSS from the service list. A message is displayed indicating that the user does not have the permission.
The HSS Administrator permission has taken effect.