Introduction

This section describes fine-grained permissions management for your DDM instance. If your account does not need individual IAM users, skip over this section.

By default, new IAM users do not have any permissions granted. You need to add a user to one or more groups, and assign policies or roles to these groups. The user then inherits permissions from the groups it is a member of. This process is called authorization. After authorization, the user can perform specified operations on the service based on the permissions.

You can grant users permissions based on roles and policies. Roles: A coarse-grained authorization mechanism provided by IAM to define permissions based on users' job responsibilities. Policies define API-based permissions for operations on specific resources under certain conditions, allowing for more fine-grained, secure access control of cloud resources.

If you want to allow or deny the access to an API, fine-grained authorization is a good choice.

An account has all of the permissions required to call all APIs. If you want to send an API request using an IAM user of the account, ensure that the IAM user has the required permissions specifically assigned. The permissions required for calling an API are determined by the actions supported by the API. Only users who have been granted permissions allowing the actions can call the API successfully. For example, if an IAM user queries ECSs using an API, the user must have been granted permissions that allow the ecs:servers:list action.