Creating a User and Granting DNS Permissions

This chapter describes how to use IAM to implement fine-grained permissions control for your DNS resources. With IAM, you can:

Create IAM users for employees based on your enterprise's organizational structure. Each IAM user will have their own security credentials for accessing DNS resources.
Grant only the permissions required for users to perform a specific task.
Entrust another account or cloud service to perform efficient O&M on your DNS resources.

If your account does not need individual IAM users, skip this part.

This section describes the procedure for granting permissions (see Figure 1).

Learn about the permissions.

Figure 1 Process for granting permissions

Create a user group and grant permissions.
Create a user group on the IAM console and attach the DNS Viewer policy to the group, which grants users read-only permissions to DNS resources.
Create an IAM user.
Create a user on the IAM console and add the user to the group created in step 1.
Log inand verify permissions.
Log in to the DNS console by using the created user, and verify that the user only has read permissions for DNS.
- Choose Service List > Domain Name Service. On the DNS console, choose Dashboard > Private Zones. On the displayed page, click Create Private Zone. If the private zone cannot be created, the DNS Viewer policy has already taken effect.
- Choose any other service in Service List. If a message appears indicating that you have insufficient permissions to access the service, the DNS Viewer policy has already taken effect.