UCS Resource Permissions (IAM Authorization)

Permission Granting Process

This section uses the UCS ReadOnlyAccess policy as an example to describe how to grant permissions to a user. Figure 1 shows the process.

Figure 1 Process for granting UCS permissions to a user

1. Create a user group and grant permissions.

   Create a user group on the IAM console as the administrator, and grant UCS permissions, for example, the UCS ReadOnlyAccess policy to the group.

   

   UCS is a global service deployed in all physical regions. When granting permissions, set the authorization scope to All resources.

2. Create an IAM user and add the user to the user group.

   Create a user on the IAM console and add the user to the group created in 1.

3. Log in and verify the permissions.

   Log in to the console as an IAM user and verify the permissions (assume that the user has only the UCS ReadOnlyAccess policy).

   • Choose UCS from Service List of Huawei Cloud. In the left navigation pane, choose Infrastructure > Fleets. If a message is displayed indicating that you do not have the access permission when you create a fleet or register a cluster, the UCS ReadOnlyAccess permission has taken effect.
   • Choose another service (such as ECS) in Service List of Huawei Cloud. If a message is displayed indicating insufficient permissions, the UCS ReadOnlyAccess policy has taken effect.

System Policies

The preset UCS system policies of IAM include UCS FullAccess, UCS CommonOperations, UCS CIAOperations, and UCS ReadOnlyAccess.

• UCS FullAccess: UCS administrator with full permissions, including creating permission policies and security policies
• UCS CommonOperations: Common UCS user with permissions for creating workloads, distributing traffic, and other operations
• UCS CIAOperations: CIA administrator with full permissions in UCS
• UCS ReadOnlyAccess: Read-only permissions on UCS (except for CIA)

You can check a policy to learn about the actions supported by a system policy. An action is in the format of Service name:Resource type:Operation. The wildcard (*) is allowed, indicating all actions.

The following is an example of the UCS FullAccess policy. This policy contains all permissions on UCS, CCE, and SWR, and operation permissions on some resources of services such as AOM, SMN, and DNS.

{
    "Version": "1.1",
    "Statement": [
        {
            "Action": [
                "ucs:*:*",
                "cce:*:*",
                "swr:*:*",
                "aom:*:get",
                "aom:*:list",
                "smn:*:list",
                "dns:*:get*",
                "dns:*:list*",
                "dns:*:get",
                "dns:*:list",
                "dns:recordset:create",
                "dns:recordset:delete",
                "dns:recordset:update",
                "dns:tag:get",
                "lts:*:get",
                "lts:*:list",
                "apm:*:get",
                "apm:*:list",
                "vpcep:epservices:*",
                "vpcep:connections:*",
                "vpcep:endpoints:*",
                "elb:*:get",
                "elb:*:list",
                "vpc:*:get",
                "vpc:*:list",
                "ief:*:get",
                "ief:*:list",
                "cgs:images:operate",
                "cgs:*:get",
                "cgs:*:list"
            ],
            "Effect": "Allow"
        }
    ]
}

Minimum Permissions Required by UCS

Services on Huawei Cloud are interdependent, and UCS depends on other cloud services to implement some functions, such as image repository and domain name resolution. The preceding four system policies are often used together with roles or policies of other cloud services for refined permission granting. When granting permissions to IAM users, the administrator must comply with the principle of least privilege. Table 1 lists the minimum permissions required by the administrator, operation, and read-only permissions of each UCS function.

• For the first login of your Huawei Cloud account to the UCS console, you need to grant permissions to the account. Then UCS will create an agency named ucs_admin_trust for you in IAM. Do not delete or modify the agency.
• If the user group of an IAM user is not granted any permissions, you cannot access the UCS console. See Table 1.