Using IAM Identity Policies to Grant Access to DMS for Kafka

Prerequisites

Before granting permissions, learn about system-defined permissions in identity policy-based authorization for DMS for Kafka. To grant permissions for other services, learn about all system-defined permissions supported by IAM.

DMS for Kafka permissions policies are based on DMS. Therefore, when assigning permissions for users or user groups, select DMS permissions policies.

Process Flow

Figure 1 Process of granting DMS for Kafka permissions

1. On the IAM console, create an IAM user or create a user group.

2. Attach a system-defined identity policy (DMSReadOnlyAccessPolicy as an example) to the user or user group.

3. Log in as the IAM user and verify permissions.

   In the authorized region, perform the following operations:

   • Choose Service List > Distributed Message Service (for Kafka). Then click Buy Instance on the console of DMS for Kafka. If a message appears indicating that you have insufficient permissions to perform the operation, the DMSReadOnlyAccessPolicy policy is in effect.
   • Choose Service List > Elastic Volume Service. If a message appears indicating that you have insufficient permissions to access the service, the DMSReadOnlyAccessPolicy policy is in effect.
   • Choose Service List > Distributed Message Service (for Kafka). If the Kafka instance list can be displayed, the DMSReadOnlyAccess policy is in effect.

Example Custom Identity Policies

You can create custom identity policies to supplement the system-defined identity policies of DMS for Kafka. For details about actions supported in custom identity policies, see Actions Supported by Identity Policy-based Authorization.

To create a custom identity policy, choose either visual editor or JSON.

• Visual editor: Select cloud services, actions, resources, and request conditions. This does not require knowledge of policy syntax.
• JSON: Create a JSON policy or edit an existing one.

For details, see Creating a Custom Identity Policy and Attaching It to a Principal.

When creating a custom identity policy, use the Resource element to specify the resources the policy applies to and use the Condition element (service-specific condition keys) to control when the policy is in effect. For details about the supported resource types and condition keys, see Actions Supported by Identity Policy-based Authorization. The following lists examples of common DMS for Kafka custom identity policies.

• Example 1: Grant permission to delete and restart instances.

  {
      "Version": "5.0",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "dms:instance:modifyStatus",
                  "dms:instance:delete"
              ]
          }
      ]
  }

• Example 2: Create a custom policy containing multiple actions.

  A custom policy can contain the actions of one or multiple services.

  Example policy containing multiple actions:

  {
      "Version": "5.0",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "dms:instance:create",
                  "dms:instance:delete"
              ]
          },
          {
              "Effect": "Allow",
              "Action": [
                  "vpc:vpcs:list",
                  "vpc:subnets:list",
                  "vpc:securityGroups:list"
              ]
          }
      ]
  }