Permission Overview

HUAWEI ID, IAM User, and Federated User

• HUAWEI ID: Registered when you use Huawei Cloud services for the first time. The account has full access permissions for your Huawei Cloud resources and makes payments for the use of these resources. Your account receives and pays all bills generated by your IAM users' use of resources.
• IAM user: created by your account. Each IAM user has their own identity credentials (password and access keys) and uses cloud resources based on assigned permissions. IAM users cannot make payments themselves (they do not have bills). You can use your registered account to pay for the resources they use.
• Federated users: registered with a third-party system that has established a trust relationship with Huawei Cloud. Users can log in to Huawei Cloud using third-party system accounts, like logging in to a gaming platform using their social networking service (SNS) accounts.

A HUAWEI ID and its IAM users have a parent-child relationship. The HUAWEI ID owns the resources and has full permissions for these resources. IAM users have only the resource usage permissions granted by that HUAWEI ID. IAM users enable fine-grained permission control when multiple users collaborate on the same account.

Figure 1 HUAWEI ID and IAM users

Fine-grained IAM Permissions

When you use an IAM user account or federated user account to perform billing-related operations on the console, the account must have been added as an enterprise administrator and have been assigned the required fine-grained IAM permissions. For details, see Table 1 and Table 2.

As there are two editions of the IAM console and the permissions are different, configure the permissions based on your actual IAM edition. You can configure the permissions to enable or disable the pay-per-use billing mode only on the IAM console (current edition) instead of the IAM console (new edition).

For details about how to grant permissions to IAM users on the IAM console, see Creating a User Group and Assigning Permissions or Creating a User Group and Assigning Permissions (New Edition). For details about how to grant permissions to federated users, see Creating a User Group and Assigning Permissions.

After the permissions of a user group to which a federated user belongs are modified, the enterprise IdP must be restarted to make the modifications take effect.

Assigning Package Change Permissions to IAM Users

This part provides an example of using a HUAWEI ID to assign the required fine-grained permissions to an IAM user on the IAM console, enabling the IAM user to change the package.

1. Log in to the IAM console using a HUAWEI ID.
2. Create a custom policy and configure the policy required for changing a package.
   1. In the navigation tree on the left, choose Permissions > Policies/Roles. The Policies/Roles page is displayed.
   2. Click Create Custom Policy in the upper right corner.
   3. Set the custom policy by referring to Table 3.

      Table 3 Custom policy parameters

      Parameter	Description
      Policy Name	Enter a policy name. Only letters, digits, spaces, and the following special characters are allowed: -_.,
      Policy View	Select JSON.
      Policy Content	Copy and paste the following content: { "Version": "1.1", "Statement": [ { "Effect": "Allow", "Action": [ "devcloud:monthlyPackage:changeSpecification", "devcloud:monthlyPackage:listResourceDetail" ] }, { "Effect": "Allow", "Action": [ "bss:order:pay", "bss:order:view" ] } ] }
      Description	Optional. Enter a brief description for the policy.

      Figure 2 Creating a custom policy
      
   4. Click OK. The custom policy is created.

      On the Policies/Roles page, view the new policy.

3. Add the IAM user to a user group. If the user has been added to a user group, skip this step and go to 4.
   1. In the navigation tree on the left, choose User Groups.
   2. Click Create User Group in the upper right corner.
   3. Set the user group name, and click OK.

      The user group name consists of letters, digits, spaces, hyphens (-), and underscores (_).

   4. On the User Groups page, locate the new user group, and click Manage User in the Operation column.
   5. Select the target IAM user, and click OK.

4. Assign the permissions of the custom policy to the user group.
   1. On the User Groups page, locate the target user group, and click Authorize in the Operation column.
   2. In the search box, enter the custom policy name configured in 2. Locate and select the policy. Click Next.
      Figure 3 Selecting the created custom policy
      
   3. Click OK. An information dialog box is displayed.
   4. Click OK. A message is displayed, indicating that the authorization is successful. Click Finish.

5. Log in to the CodeArts Agent console using the IAM user account, and change the CodeArts Agent package.