Creating a User and Granting Permissions

You can use IAM to implement refined permission control for DBSS resources. To be specific, you can:

Create IAM users for employees based on the organizational structure of your enterprise. Each IAM user has their own security credentials, providing access to DBSS resources.
Grant only the permissions required for users to perform a task.
Entrust your Huawei Cloud account or cloud service to perform professional and efficient O&M on your DBSS resources.

If your Huawei Cloud account does not require individual IAM users, skip this chapter.

This section describes the procedure for granting permissions (see Figure 1).

Prerequisites

Before authorizing permissions to a user group, you need to know which DBSS permissions can be added to the user group. Table 1 describes the policy details. For details about system permissions supported by DBSS, see DBSS Permissions.

**Table 1** System permissions
Role/Policy Name	Description	Type	Dependency
DBSS Audit Administrator	DBSS audit administrator, who has the permissions to check DBSS security logs.	System-defined role	None
DBSS FullAccess	Full permissions for DBSS	System-defined policy
DBSS ReadOnlyAccess	Read-only permissions for DBSS. Users granted these permissions can only view this service and cannot configure resources in it.	System-defined policy

Process Flow

Figure 1 Process for granting permissions

Create a user group and assign permissions.
Create a user group on the IAM console and grant the user group the DBSS Security Administrator permission for DBSS.
Create a user and add it to a user group.
Create a user on the IAM console and add the user to the group created in 1.
Log in and verify permissions.
Log in to the DBSS console by using the created user, and verify that the user only has read permissions for DBSS.

Example verification method: Try starting or stopping an instance. If a message indicating Insufficient permissions are displayed, the DBSS Security Administrator role has taken effect.