Help Center> Identity and Access Management> User Guide> User Groups and Authorization> Creating a User Group and Assigning Permissions
Updated on 2022-09-15 GMT+08:00

Creating a User Group and Assigning Permissions

As an administrator, you can create user groups, and grant them permissions by attaching policies or roles. Users you add to the user groups inherit permissions of the policies or roles. IAM provides general permissions (such as administrator or read-only permissions) for each cloud service, which you can assign to user groups. Users in the groups can then use cloud services based on the assigned permissions. For details, see Assigning Permissions to an IAM User. For details about the system permissions of all cloud services, see System Permissions.


Before creating a user group, learn about the following:

Creating a User Group

  1. Log in to the IAM console as an administrator.
  2. On the IAM console, choose User Groups from the navigation pane, and click Create User Group in the upper right corner.

    Figure 1 Creating a user group

  3. On the displayed page, enter a user group name.
  4. Click OK.

    You can create a maximum of 20 user groups. To create more user groups, increase the quota by referring to How Do I Increase My Quota?

Assigning Permissions to a User Group

To assign permissions to a user group, do as follows:

  1. In the user group list, click Authorize in the row that contains the newly created user group.

    Figure 2 Going to the user group authorization page

  2. On the Authorize User Group page, select the permissions to be assigned to the user group and click Next.

    If the system-defined policies do not meet your requirements, click Create Policy in the upper right to create custom policies. You can use them to supplement system-defined policies for refined permissions control. For details, see Creating a Custom Policy.
    Figure 3 Selecting permissions

  3. Specify the scope. The system automatically recommends an authorization scope for the permissions you selected. Table 1 describes all the authorization scopes provided by IAM.

    Table 1 Authorization scopes



    All resources

    IAM users can use the resources in all region-specific projects and the global service project in your account as specified by the permissions.

    Enterprise projects

    IAM users can use the resources in the enterprise projects you select, as specified by the permissions. This option is available only when the enterprise project function has been enabled.

    For details about enterprise projects, see What is Enterprise Project Management Service?. To enable the enterprise project function, see Enabling the Enterprise Project Function.

    Region-specific projects

    IAM users can use the resources in the region-specific projects you select, as specified by the permissions.

    If some of the selected permissions belong to global services, the system automatically sets the authorization scope of these permissions to All resources. Selected permissions for project-level services will apply to the region-specific projects you select.

    Global services

    IAM users can use global services as specified by the permissions. Global services are deployed with no physical regions specified. IAM users do not need to specify a region when accessing these services, such as Object Storage Service (OBS) and Content Delivery Network (CDN).

    If some of the selected permissions belong to project-level services, the system automatically sets the authorization scope of these permissions to All resources. Selected permissions for global services will apply to the global services.

  4. Click OK.

Table 2 lists the common permissions. For the complete list of service-specific permissions, see System Permissions.

  • If you add a user to multiple groups, the user will inherit all the permissions that have been assigned to the groups.
Table 2 Common permissions


Policy/Role Name


Authorization Scope

General administration


Full permissions for services supporting policy-based access control.


Resource management

Tenant Administrator

Administrator permissions for all services except IAM.


Viewing resources

Tenant Guest

Read-only permissions for all resources.


IAM user management

Security Administrator

Administrator permissions for IAM.

Global services

Accounting management

BSS Administrator

Administrator permissions for Billing Center, including managing invoices, orders, contracts, and renewals, and viewing bills.


This role depends on the BSS Administrator role to take effect.

Region-specific projects

Computing O&M

ECS FullAccess

Administrator permissions for ECS.

Region-specific projects

CCE FullAccess

Administrator permissions for Cloud Container Engine (CCE).

Region-specific projects

CCI FullAccess

Administrator permissions for Cloud Container Instance (CCI).

Region-specific projects

BMS FullAccess

Administrator permissions for Bare Metal Server (BMS).

Region-specific projects

IMS FullAccess

Administrator permissions for Image Management Service (IMS).

Region-specific projects

AutoScaling FullAccess

Administrator permissions for Auto Scaling (AS).

Region-specific projects

Network O&M

VPC FullAccess

Administrator permissions for Virtual Private Cloud (VPC).

Region-specific projects

ELB FullAccess

Administrator permissions for Elastic Load Balance (ELB).

Region-specific projects

Database O&M

RDS FullAccess

Administrator permissions for Relational Database Service (RDS).

Region-specific projects

DDS FullAccess

Administrator permissions for Document Database Service (DDS).

Region-specific projects

DDM FullAccess

Administrator permissions for Distributed Database Middleware (DDM).

Region-specific projects

Security O&M

Anti-DDoS Administrator

Administrator permissions for Anti-DDoS.

Region-specific projects

CAD Administrator

Administrator permissions for Advanced Anti-DDoS (AAD).

Region-specific projects

WAF Administrator

Administrator permissions for Web Application Firewall (WAF).

Region-specific projects

VSS Administrator

Administrator permissions for Vulnerability Scan Service (VSS).

Region-specific projects

CGS Administrator

Administrator permissions for Container Guard Service (CGS).

Region-specific projects

KMS Administrator

Administrator permissions for Key Management Service (KMS), which has been renamed Data Encryption Workshop (DEW).

Region-specific projects

DBSS System Administrator

Administrator permissions for Database Security Service (DBSS).

Region-specific projects

SES Administrator

Administrator permissions for Security Expert Service (SES).

Region-specific projects

SC Administrator

Administrator permissions for SSL Certificate Manager (SCM).

Region-specific projects