- What's New
- Function Overview
- Product Bulletin
-
Service Overview
- Infographics
- What Is DMS for RabbitMQ?
- Product Advantages
- Application Scenarios
- Specifications
- Comparing RabbitMQ, Kafka, and RocketMQ
- Comparing RabbitMQ AMQP-0-9-1 with Open-Source RabbitMQ
- Comparing RabbitMQ Versions
- Related Services
- Security
- Notes and Constraints
- Basic Concepts
- Exchanges
- Permissions Management
- Billing
- Getting Started
-
User Guide
- Process of Using RabbitMQ
- Permissions Management
- Buying a RabbitMQ Instance
- Configuring Virtual Hosts
- Accessing a RabbitMQ Instance
- Managing Messages
- Advanced Features
-
Managing Instances
- Viewing and Modifying Basic Information of a RabbitMQ Instance
- Viewing RabbitMQ Client Connection Addresses
- Managing RabbitMQ Instance Tags
- Configuring RabbitMQ Recycling Policies
- Resetting the RabbitMQ Instance Password
- Enabling RabbitMQ Plug-ins
- Exporting the RabbitMQ Instance List
- Deleting a RabbitMQ Instance
- Logging In to RabbitMQ Management UI
- Modifying RabbitMQ Instance Specifications
- Migrating RabbitMQ Services
- Testing Instance Performance
- Applying for Increasing RabbitMQ Quotas
- Viewing Metrics and Configuring Alarms
- Viewing RabbitMQ Audit Logs
-
Best Practices
- RabbitMQ Best Practices
- Automatic Recovery of a RabbitMQ Client from Network Exceptions
- Automatic Consumer Reconnection After a RabbitMQ Node Restart
- Improving RabbitMQ Performance
- Configuring Queue Load Balancing
- Deduplicating Messages Through Message Idempotence
- Suggestions on Using DMS for RabbitMQ Securely
- Developer Guide
-
API Reference
- Before You Start
- API Overview
- Calling APIs
- Getting Started
- APIs V2 (Recommended)
- Permissions and Supported Actions
- Out-of-Date APIs
- Appendix
- Change History
- SDK Reference
-
FAQs
-
Instances
- What RabbitMQ Version Does DMS for RabbitMQ Use?
- What SSL Version Does DMS for RabbitMQ Use?
- Why Can't I View the Subnet and Security Group Information During Instance Creation?
- How Are Requests Evenly Distributed to Each VM of a Cluster RabbitMQ Instance?
- Do Queues Inside a Cluster RabbitMQ Instance Have Any Redundancy Backup?
- Does DMS for RabbitMQ Support Data Persistence? How Do I Perform Scheduled Data Backups?
- How Do I Obtain the Certificate After SSL Has Been Enabled?
- Can I Change the SSL Setting of a RabbitMQ Instance?
- Can RabbitMQ Instances Be Scaled Up?
- Does RabbitMQ Support Two-Way Authentication?
- Does DMS for RabbitMQ Support CPU and Memory Upgrades?
- How Do I Disable the RabbitMQ Management UI?
- Can I Change the AZ for an Instance?
- How Do I Obtain the Region ID?
- Why Can't I Select Two AZs?
- How to Change Single-node RabbitMQ Instances to Cluster Ones?
- Can I Change the VPC and Subnet After a RabbitMQ Instance Is Created?
-
Connections
- How Do I Configure a Security Group?
- Why Does a Client Fail to Connect to a RabbitMQ Instance?
- Does DMS for RabbitMQ Support Public Access?
- Does DMS for RabbitMQ Support Cross-Region Deployment?
- Do RabbitMQ Instances Support Cross-VPC Access?
- Do RabbitMQ Instances Support Cross-Subnet Access?
- What Should I Do If I Fail to Access a RabbitMQ Instance with SSL Encryption?
- Can I Access a RabbitMQ Instance Using DNAT?
- Why Can't I Open the Management Web UI?
- Can a Client Connect to Multiple Virtual Hosts of a RabbitMQ Instance?
- Why Does a RabbitMQ Cluster Have Only One Connection Address?
- Do RabbitMQ Instances Support the Ping Command?
- Messages
- Monitoring & Alarm
-
Instances
- Videos
-
More Documents
-
User Guide (ME-Abu Dhabi Region)
- Service Overview
- Getting Started
- Process of Using RabbitMQ
- Permissions Management
- Buying a RabbitMQ Instance
- Configuring Virtual Hosts
- Accessing a RabbitMQ Instance
- Managing Messages
- Advanced Features
-
Managing Instances
- Viewing and Modifying Basic Information of a RabbitMQ Instance
- Viewing RabbitMQ Client Connection Addresses
- Managing RabbitMQ Instance Tags
- Resetting the RabbitMQ Instance Password
- Enabling RabbitMQ Plug-ins
- Using the rabbitmq_tracing Plug-in
- Exporting the RabbitMQ Instance List
- Deleting a RabbitMQ Instance
- Logging In to RabbitMQ Management UI
- Modifying RabbitMQ Instance Specifications
- Migrating RabbitMQ Services
- Applying for Increasing RabbitMQ Quotas
- Viewing Metrics and Configuring Alarms
- Viewing RabbitMQ Audit Logs
-
FAQs
-
Instances
- What RabbitMQ Version Does DMS for RabbitMQ Use?
- What SSL Version Does DMS for RabbitMQ Use?
- Why Can't I View the Subnet and Security Group Information During Instance Creation?
- How Are Requests Evenly Distributed to Each VM of a Cluster RabbitMQ Instance?
- Do Queues Inside a Cluster RabbitMQ Instance Have Any Redundancy Backup?
- Does DMS for RabbitMQ Support Data Persistence? How Do I Perform Scheduled Data Backups?
- How Do I Obtain the Certificate After SSL Has Been Enabled?
- Can I Change the SSL Setting of a RabbitMQ Instance?
- Can RabbitMQ Instances Be Scaled Up?
- Does RabbitMQ Support Two-Way Authentication?
- Does DMS for RabbitMQ Support CPU and Memory Upgrades?
- How Do I Disable the RabbitMQ Management UI?
- Can I Change the AZ for an Instance?
- How Do I Obtain the Region ID?
- Why Can't I Select Two AZs?
- How to Change Single-node RabbitMQ Instances to Cluster Ones?
- Can I Change the VPC and Subnet After a RabbitMQ Instance Is Created?
-
Connections
- How Do I Configure a Security Group?
- Why Does a Client Fail to Connect to a RabbitMQ Instance?
- Does DMS for RabbitMQ Support Public Access?
- Does DMS for RabbitMQ Support Cross-Region Deployment?
- Do RabbitMQ Instances Support Cross-VPC Access?
- Do RabbitMQ Instances Support Cross-Subnet Access?
- What Should I Do If I Fail to Access a RabbitMQ Instance with SSL Encryption?
- Can I Access a RabbitMQ Instance Using DNAT?
- Why Can't I Open the Management Web UI?
- Can a Client Connect to Multiple Virtual Hosts of a RabbitMQ Instance?
- Why Does a RabbitMQ Cluster Have Only One Connection Address?
- Messages
- Monitoring & Alarm
-
Instances
- Change History
- API Reference (ME-Abu Dhabi Region)
-
User Guide (Kuala Lumpur Region)
- Service Overview
- Permissions Management
- Preparing the Environment
- Buying an Instance
- Accessing a RabbitMQ Instance
- Operating RabbitMQ Instances
- Quotas
- Monitoring
- Auditing
-
FAQs
-
Instances
- What RabbitMQ Version Does DMS for RabbitMQ Use?
- What SSL Version Does DMS for RabbitMQ Use?
- Why Can't I View the Subnet and Security Group Information During Instance Creation?
- What If One RabbitMQ VM Fails to Be Restarted When a Cluster RabbitMQ Instance Is Being Restarted?
- How Are Requests Evenly Distributed to Each VM of a Cluster RabbitMQ Instance?
- Do Queues Inside a Cluster RabbitMQ Instance Have Any Redundancy Backup?
- Does DMS for RabbitMQ Support Data Persistence? How Do I Perform Scheduled Data Backups?
- How Do I Obtain the Certificate After SSL Has Been Enabled?
- Can I Change the SSL Setting of a RabbitMQ Instance?
- Can RabbitMQ Instances Be Scaled Up?
- Does DMS for RabbitMQ Support MQTT?
- How Do I Clear Queue Data?
- Does DMS for RabbitMQ Support CPU and Memory Upgrades?
- How Do I Disable the RabbitMQ Management UI?
- Can I Change the AZ for an Instance?
-
Connections
- How Do I Configure a Security Group?
- Why Does a Client Fail to Connect to a RabbitMQ Instance?
- Does DMS for RabbitMQ Support Public Access?
- Does DMS for RabbitMQ Support Cross-Region Deployment?
- Does DMS for RabbitMQ Support Cross-VPC Access?
- Does DMS for RabbitMQ Support Cross-Subnet Access?
- What Should I Do If I Fail to Access a RabbitMQ Instance with SSL Encryption?
- Can I Access a RabbitMQ Instance Using DNAT?
- Why Can't I Open the Management Web UI?
- Can a Client Connect to Multiple Virtual Hosts of a RabbitMQ Instance?
- Why Does a RabbitMQ Cluster Have Only One Connection Address?
- Plug-ins
- Messages
- Monitoring & Alarm
-
Instances
- Change History
- API Reference (Kuala Lumpur Region)
-
User Guide (ME-Abu Dhabi Region)
- General Reference
Copied.
Creating an IAM User and Granting DMS for RabbitMQ Permissions
Use Identity and Access Management (IAM) to implement fine-grained permissions control over your Distributed Message Service (DMS) for RabbitMQ resources. With IAM, you can:
- Create IAM users for personnel based on your enterprise's organizational structure. Each IAM user has their own identity credentials for accessing DMS for RabbitMQ resources.
- Grant users only the permissions required to perform a given task based on their job responsibilities.
- Entrust a HUAWEI ID or a cloud service to perform efficient O&M on your DMS for RabbitMQ resources.
If your HUAWEI ID meets your permissions requirements, you can skip this section.
This section describes the procedure for granting user permissions. Figure 1 shows the process flow.
Prerequisites
Learn about the permissions (see System-defined roles and policies supported by DMS for RabbitMQ) supported by DMS for RabbitMQ and choose policies according to your requirements. For the system policies of other services, see System Permissions.
Process Flow
- For the following example, create a user group on the IAM console,
and assign the DMS ReadOnlyAccess policy to the group.
- Log in as the IAM user and verify permissions.
In the authorized region, perform the following operations:
- Choose Service List > Distributed Message Service (for RabbitMQ). Then click Buy Instance on the console of DMS for RabbitMQ. If a message appears indicating that you have insufficient permissions to perform the operation, the DMS ReadOnlyAccess policy is in effect.
- Choose Service List > Elastic Volume Service. If a message appears indicating that you have insufficient permissions to access the service, the DMS ReadOnlyAccess policy is in effect.
- Choose Service List > Distributed Message Service (for RabbitMQ). The RabbitMQ console is displayed. If a list of RabbitMQ instances are displayed, the DMS ReadOnlyAccess policy is in effect.
Example Custom Policies
You can create custom policies to supplement the system-defined policies of DMS for RabbitMQ. For details about actions supported in custom policies, see Permissions and Supported Actions.
To create a custom policy, choose either visual editor or JSON.
- Visual editor: Select cloud services, actions, resources, and request conditions. This does not require knowledge of policy syntax.
- JSON: Create a JSON policy or edit an existing one.
For details, see Creating a Custom Policy. The following lists examples of common DMS for RabbitMQ custom policies.
DMS for RabbitMQ permissions policies are based on DMS. Therefore, when assigning permissions, select DMS permissions policies.
- Example 1: Grant permission to create and delete instances.
{ "Version": "1.1", "Statement": [ { "Effect": "Allow", "Action": [ "dms:instance:create", "dms:instance:delete" ] } ] }
- Example 2: Grant permission to deny instance deletion.
A policy with only "Deny" permissions must be used together with other policies. If the permissions granted to an IAM user contain both "Allow" and "Deny", the "Deny" permissions take precedence over the "Allow" permissions.
Assume that you want to grant the permissions of the DMS FullAccess policy to a user but want to prevent them from deleting instances. You can create a custom policy for denying instance deletion, and attach this policy together with the DMS FullAccess policy to the user. As an explicit deny in any policy overrides any allows, the user can perform all operations on DMS for RabbitMQ excepting deleting instances.
Example policy denying instance deletion:
{ "Version": "1.1", "Statement": [ { "Effect": "Deny", "Action": [ "dms:instance:delete" ] } ] }
DMS for RabbitMQ Resources
A resource is an object that exists within a service. DMS for RabbitMQ resources include rabbitmq. To select these resources, specify their paths.
Resource |
Resource Name |
Path |
---|---|---|
rabbitmq |
Instance |
[Format] DMS:*:*: rabbitmq: instance ID [Note] For instance resources, IAM automatically generates the prefix (DMS:*:*:rabbitmq:) of the resource path. For the path of a specific instance, add the instance ID to the end. You can also use an asterisk * to indicate any instance. For example: DMS:*:*:rabbitmq:* indicates any RabbitMQ instance. |
DMS for RabbitMQ Request Conditions
Request conditions are useful in determining when a custom policy is in effect. A request condition consists of condition keys and operators. Condition keys are either global or service-level and are used in the Condition element of a policy statement. Global condition keys (starting with g:) are available for operations of all services, while service-specific condition keys (starting with a service name such as dms:) are available only for operations of specific services. An operator must be used together with a condition key to form a complete condition statement.
DMS for RabbitMQ has a group of predefined condition keys that can be used in IAM. For example, to define an "Allow" permission, use the condition key dms:ssl to filter instances by SSL configurations. The following table lists the DMS for RabbitMQ predefined condition keys.
Condition Key |
Operator |
Description |
---|---|---|
dms:publicIP |
Bool Null |
Whether public access is enabled |
dms:ssl |
Bool Null |
Whether SSL is enabled |
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot