IAM Policies

Updated on 2024-03-04 GMT+08:00

View PDF

You can create IAM users under a registered cloud service account, and then use IAM policies to control users' access permissions to cloud resources.

IAM policies define the actions that can be performed on your cloud resources. In other words, IAM policies specify what actions are allowed or denied.

IAM policies with OBS permissions take effect on all OBS buckets and objects. To grant an IAM user the permission to operate OBS resources, you need to assign one or more OBS permission sets to the user group to which the user belongs.

For details about OBS permissions controlled by IAM policies, see Permissions Management.

IAM policies Application Scenarios

IAM policies are used to authorize IAM users under an account.

Controlling permissions to cloud resources as a whole under an account
Controlling permissions to all OBS buckets and objects under an account

Policy Structure and Syntax

A policy consists of a version and statements. Each policy can have multiple statements.

Figure 1 Policy structure
Click to enlarge

**Table 1** Policy syntax parameters
Parameter	Description
Version	The version number of a policy. 1.0: RBAC policies. An RBAC policy consists of permissions for an entire service. Users in a group with such a policy assigned are granted all of the permissions required for that service.
Statement	Permissions defined by a policy, including Effect and Action. Effect The valid values for Effect are Allow and Deny. System policies contain only Allow statements. Action Permissions of specific operations on resources. A policy can contain one or more permissions. The wildcard (*) is allowed to indicate all of the services, resource types, or operations depending on its location in the action.

Authentication of IAM policies

The authentication of IAM policies starts from the Deny statements. The following figure shows the authentication logic for resource access.

Figure 2 Authentication logic

NOTE:

The actions in each policy are in the OR relationship.

A user accesses the system and makes an operation request.
The system evaluates all the permission policies assigned to the user.
In these policies, the system looks for explicit deny permissions. If the system finds an explicit deny that applies, it returns a decision of Deny, and the authentication ends.
If no explicit deny is found, the system looks for allow permissions that would apply to the request. If the system finds an explicit allow permission that applies, it returns a decision of Allow, and the authentication ends.
If no explicit allow permission is found, IAM returns a decision of Deny, and the authentication ends.

Parent topic: Permission Control Mechanisms

Previous topic: Permission Control Mechanisms

Next topic: Bucket Policies and Object Policies

Feedback

Was this page helpful?

Helpful Not helpful

Provide feedback

Thank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.

The system is busy. Please try again later.

Which of the following issues have you encountered?

Content is inconsistent with the product UI

Unclear descriptions

Lack of examples or code

Incorrect steps

Can't find what I need

Lack of best practices

Feedback (optional)

0/500

Select at least one type of issue, and enter your comments or suggestions.

Enter a maximum of 500 characters.

Submit Cancel

For any further questions, feel free to contact us through the chatbot.

Chatbot