Using IAM to Grant Access to MgC

This section describes how to use Identity and Access Management (IAM) for fine-grained permissions control on your MgC resources. With IAM, you can:

Create IAM users for employees based on the organizational structure of your enterprise. Each IAM user has their own security credentials for accessing MgC resources.
Grant users only the permissions required to perform a given task based on their job responsibilities.
Entrust a Huawei Cloud account or cloud service to perform professional and efficient O&M on your MgC resources.

If your Huawei Cloud account does not need individual IAM users, then you may skip over this section.

This section describes the procedure for granting permissions (see Process Flow).

Prerequisites

Before assigning permissions to user groups, you should learn about system-defined policies supported by MgC and select the policies based on service requirements.

For details about the system-defined policies supported by MgC and the comparison between them, see System-defined Policies. For the system-defined policies of other services, see System-defined Permissions.

Process Flow

Figure 1 Process for granting MgC permissions

Create a user group and assign permissions to it.

System-defined policy: Create a user group on the IAM console, and assign the MgC system-defined policies to the user group based on the Description of MgC System-defined Policies and actual permissions requirements. Select All Resources for Scope.

**Table 1** MgC system-defined policies
Policy Name	Description	Policy Type	Policy Content
MgC FullAccess	Administrator permissions for MgC. Users with these permissions can perform all operations on MgC.	System-defined policies	MgC FullAccess Policy Content
MgC ReadOnlyAccess	Read-only permissions for MgC. Users with these permissions can only view MgC resources.	System-defined policies	MgC ReadOnlyAccess Policy Content
MgC DiscoveryAccess	Permissions for resource discovery with MgC. Users with these permissions can use the resource discovery function of MgC and view MgC resources.	System-defined policies	MgC DiscoveryAccess Policy Content
MgC AssessAccess	Permissions for application assessment with MgC. Users with these permissions can use the resource discovery and application assessment functions of MgC and view MgC resources.	System-defined policies	MgC AssessAccess Policy Content
MgC MigrateAccess	Permissions for application migration with MgC. Users with these permissions can use the resource discovery, assessment, and migration functions of MgC and view MgC resources.	System-defined policies	MgC MigrateAccess Policy Content
MgC AppDiscoveryAccess	Permissions for resource discovery with MgC. Users with these permissions can use the resource discovery and collection functions of MgC and view MgC resources.	System-defined policies	MgC AppDiscoveryAccess Policy Content
MgC MrrAccess	Permissions for service verification with MgC. Users with these permissions can use the service verification function of MgC and view MgC resources.	System-defined policies	MgC MrrAccess Policy Content
MgC AZ MigrateAccess	Permissions for cross-AZ migration with MgC	System-defined policies	MgC AZ MigrateAccess Policy Content

Custom policy: If an IAM user only needs specific MgC permissions, create custom policies. For details, see MgC Custom Policies.

Create an IAM user and add it to the user group.
Create a user on the IAM console and add the user to the group created in 1.
When the IAM user accesses certain MgC functions for the first time, the IAM user needs to complete authorization through agencies in either of the following ways:
- (Recommended) Ask the administrator to log in to the MgC console, access the corresponding functions, and complete the authorization.
- Ask the administrator to grant the corresponding system-defined MgC permissions and the iam:agencies:createAgency, iam:permissions:grantRoleToAgency, iam:roles:createRole, and iam:roles:updateRole permissions on the IAM console.
Sign in as the IAM user and verify permissions.
In the authorized region, perform the following operations:
- Choose Service List > Migration Center. On the MgC console, perform operations based on the granted permissions. If you can, the granted permissions have taken effect.
- Choose a service other than MgC in the Service List. If a message appears indicating that you have insufficient permissions to access the service, the permissions have taken effect.

MgC FullAccess Policy Content

{
    "Version": "1.1",
    "Statement": [
        {
            "Action": [
                "mgc:*:*",
                "iam:agencies:listAgencies",
                "iam:roles:listRoles",
                "iam:quotas:listQuotas",
                "iam:permissions:listRolesForAgency"
            ],
            "Effect": "Allow"
        }
    ]
}

MgC ReadOnlyAccess Policy Content

{
    "Version": "1.1",
    "Statement": [
        {
            "Action": [
                "mgc:*:query*",
                "iam:agencies:listAgencies",
                "iam:roles:listRoles",
                "iam:quotas:listQuotas",
                "iam:permissions:listRolesForAgency"
            ],
            "Effect": "Allow"
        }
    ]
}

MgC DiscoveryAccess Policy Content

{
    "Version": "1.1",
    "Statement": [
        {
            "Action": [
                "mgc:*:query*",
                "mgc:*:discovery",
                "iam:agencies:listAgencies",
                "iam:roles:listRoles",
                "iam:quotas:listQuotas",
                "iam:permissions:listRolesForAgency"
            ],
            "Effect": "Allow"
        }
    ]
}

MgC AssessAccess Policy Content

{
    "Version": "1.1",
    "Statement": [
        {
            "Action": [
                "mgc:*:query*",
                "mgc:*:discovery",
                "mgc:*:assess",
                "iam:agencies:listAgencies",
                "iam:roles:listRoles",
                "iam:quotas:listQuotas",
                "iam:permissions:listRolesForAgency"
            ],
            "Effect": "Allow"
        }
    ]
}

MgC MigrateAccess Policy Content

{
    "Version": "1.1",
    "Statement": [
        {
            "Action": [
                "mgc:*:query*",
                "mgc:*:discovery",
                "mgc:*:assess",
                "mgc:*:migrate",
                "iam:agencies:listAgencies",
                "iam:roles:listRoles",
                "iam:quotas:listQuotas",
                "iam:permissions:listRolesForAgency"
            ],
            "Effect": "Allow"
        }
    ]
}

MgC AppDiscoveryAccess Policy Content

{
    "Version": "1.1",
    "Statement": [
        {
            "Action": [
                "mgc:*:query*",
                "mgc:*:discovery",
                "mgc:*:appdiscovery",
                "iam:agencies:listAgencies",
                "iam:roles:listRoles",
                "iam:quotas:listQuotas",
                "iam:permissions:listRolesForAgency"
            ],
            "Effect": "Allow"
        }
    ]
}

MgC MrrAccess Policy Content

{
    "Version": "1.1",
    "Statement": [
        {
            "Action": [
                "mgc:*:query*",
                "mgc:mrr:query",
                "mgc:mrr:update",
                "mgc:mrr:export",
                "mgc:mrr:import",
                "mgc:mrr:upgrade",
                "mgc:mrr:delete",
                "mgc:mrr:check",
                "iam:agencies:listAgencies",
                "iam:roles:listRoles",
                "iam:quotas:listQuotas",
                "iam:permissions:listRolesForAgency"
            ],
            "Effect": "Allow"
        }
    ]
}

MgC AZ MigrateAccess Policy Content

{
    "Version": "1.1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:cloudServers:createServers",
                "ecs:servers:create",
                "ecs:servers:stop",
                "ecs:servers:start",
                "ecs:availabilityZones:list",
                "ecs:*:get*",
                "ecs:*:list*",
                "evs:*:get*",
                "evs:*:list*",
                "vpc:*:get",
                "vpc:*:list",
                "vpc:securityGroups:*",
                "vpc:securityGroupRules:*",
                "vpc:floatingIps:*",
                "vpc:publicIps:*",
                "ims:images:create",
                "ims:images:delete",
                "ims:images:get",
                "ims:images:list",
                "ims:images:update",
                "ims:images:upload",
                "ims:wholeImages:create",
                "ims:*:list*",
                "ims:*:get*",
                "cbr:*:get*",
                "cbr:*:list*",
                "cbr:vaults:update",
                "cbr:vaults:delete",
                "cbr:vaults:create",
                "cbr:vaults:addResources",
                "cbr:vaults:backup",
                "cbr:backups:delete"
            ]
        }
    ]
}

Parent Topic: Permissions Management

Previous topic: Permissions Management

Next topic: MgC Custom Policies