Permissions Policies and Supported Actions

This chapter describes fine-grained permissions management for your DCS. If your account does not need individual IAM users, you can skip the configurations described in this chapter.

By default, new IAM users do not have any permissions assigned. You need to add a user to one or more groups, and assign policies or roles to these groups. The user then inherits permissions from the groups it is a member of. This process is called authorization. After authorization, the user can perform specified operations on cloud services based on the permissions.

You can grant users permissions by using roles and policies. Roles are a type of coarse-grained authorization mechanism that defines permissions related to user responsibilities. Policies define API-based permissions for operations on specific resources under certain conditions, allowing for more fine-grained, secure access control of cloud resources.

You can use policies to allow or deny access to specific APIs.

An account has all of the permissions required to call all APIs, but IAM users must have the required permissions specifically assigned. The permissions required for calling an API are determined by the actions supported by the API. Only users who have been granted permissions allowing the actions can call the API successfully. For example, if an IAM user wants to query ECSs using an API, the user must have been granted permissions that allow the dcs:servers:list action.

Supported Actions

DCS provides system-defined policies, which can be directly used in IAM. You can also create custom policies to supplement system-defined policies for more refined access control. Actions supported by policies are specific to APIs. Common concepts related to policies include:

Permissions: Allow or deny certain operations.
APIs: REST APIs that can be called in a custom policy.
Actions: Added to a custom policy to control permissions for specific operations.
Dependent actions: When assigning permissions for an action, you also need to assign permissions for the dependent actions.
IAM and enterprise projects: Type of projects for which an action will take effect. Policies that contain actions supporting both IAM and enterprise projects can be assigned to user groups and take effect in both IAM and Enterprise Management. Policies that only contain actions supporting IAM projects can be assigned to user groups and only take effect for IAM. Such policies will not take effect if they are assigned to user groups in Enterprise Project. Administrators can check whether an action supports IAM projects or enterprise projects in the action list. The check mark (√) indicates that the action supports the project and the cross symbol (×) indicates that the action does not support the project.

Table 1 lists the API actions supported by DCS.

**Table 1** DCS actions
Permissions	Action	API	IAM Project	Enterprise Project
Creating DCS Instances	dcs:instance:create	POST /v1.0/{project_id}/instances	√	√
Querying Details About a Specified Instance	dcs:instance:get	GET /v1.0/{project_id}/instances/{instance_id}	√	√
Modifying Instance Information	dcs:instance:modify	PUT /v1.0/{project_id}/instances/{instance_id}	√	√
Deleting DCS Instances	dcs:instance:delete	DELETE /v1.0/{project_id}/instances/{instance_id}	√	√
Scaling Up DCS Instances	dcs:instance:scale	POST /v1.0/{project_id}/instances/{instance_id}/extend	√	√
Querying DCS Instances	dcs:instance:list	GET /v1.0/{project_id}/instances	√	√
Querying Instance Configurations	dcs:instance:getConfiguration	GET /v1.0/{project_id}/instances/{instance_id}/configs	√	√
Modifying Instance Configurations	dcs:instance:modifyConfigureation	PUT /v1.0/{project_id}/instances/{instance_id}/configs	√	√
Restarting DCS Instances or Clearing DCS Instance Data	dcs:instance:modifyStatus	PUT /v1.0/{project_id}/instances/status	√	√
Modifying Instance Passwords	dcs:instance:modifyAuthInfo	PUT /v1.0/{project_id}/instances/{instance_id}/password	√	√
Backing Up Instance Data	dcs:instance:backupData	POST /v1.0/{project_id}/instances/{instance_id}/backups	√	√
Restoring Instance Data	dcs:instance:restoreData	POST /v1.0/{project_id}/instances/{instance_id}/restores	√	√
Querying Instance Backup Tasks	dcs:instance:getDataBackupLog	GET /v1.0/{project_id}/instances/{instance_id}/backups	√	√
Querying Instance Restoration Tasks	dcs:instance:getDataRestoreLog	GET /v1.0/{project_id}/instances/{instance_id}/restores	√	√
Deleting Backup Files	dcs:instance:deleteDataBackupFile	DELETE /v1.0/{project_id}/instances/{instance_id}/backups/{backup_id}	√	√
Querying Background Tasks	dcs:instance:getBackgroundTask	GET /v1.0/{project_id}/instances/{instance_id}/tasks	√	√
Deleting Background Tasks	dcs:instance:deleteBackgroundTask	DELETE /v1.0/{project_id}/instances/{instance_id}/tasks/{task_id}	√	√
Resetting Instance Passwords	dcs:instance:resetAuthInfo	API not supported.	√	√
Downloading Backup Files	dcs:instance:downloadBackupData	API not supported.	√	√
Migrating Instance Data	dcs:instance:migrateData	API not supported.	√	√
Web CLI	dcs:instance:webcli	API not supported.	√	√