Using IAM Identity Policies to Grant Access to Workspace

Prerequisites

Before granting permissions to user groups, learn about the permissions supported by Workspace and choose permissions as required. For details about the system permissions supported by Workspace, see Identity Policies. To grant permissions for other services, you need to learn about all system permissions supported by IAM.

Example Process

Figure 1 Process of assigning Workspace permissions to a user

1. Create a user or create a user group.

   Create a user or user group on the IAM console.

2. Attach a system-defined policy to the user or user group.

   Attach the system-defined identity policy WorkspaceReadOnlyPolicy to the user or user group.

3. Log in as the created user.

   Log in to the console as an authorized user and verify the permissions.

   • Select Workspace in Service List. On the Workspace console, click Buy Desktop in the upper right corner. If the operation fails (assume that the permission contains only the WorkspaceReadOnlyPolicy policy), the WorkspaceReadOnlyPolicy policy has already taken effect.
   • Select any service other than Workspace in Service List. If a message is displayed indicating insufficient permissions for performing the operation (assume that the permission contains only the WorkspaceReadOnlyPolicy policy), the WorkspaceReadOnlyPolicy policy has already taken effect.

Example Custom Policies

Custom identity policies can be created to supplement the system-defined identity policies of Workspace. For details about the actions supported by custom identity policies, see Actions Supported by Identity Policy-based Authorization.

To create a custom policy, choose either visual editor or JSON.

• Visual editor: Select cloud services, actions, resources, and request conditions. This does not require knowledge of policy syntax.
• JSON: Create a JSON policy or edit an existing one.

For details, see Creating a Custom Identity Policy and Attaching It to a Principal.

When creating a custom identity policy, use the Resource element to specify the resources the identity policy applies to and use the Condition element (service-specific condition keys) to control when the identity policy is in effect. The following lists examples of common Workspace custom identity policies.

• Example 1: Assign users the permission to create and delete a cloud desktop.

  {
    "Version": "5.0",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "workspace:desktops:create",
          "workspace:desktops:delete"
        ]
      }
    ]
  }

• Example 2: Create a custom identity policy containing multiple actions.
  A custom policy can contain the actions of multiple services that are all of the global or project-level type. Example of a policy containing multiple actions:

  {
    "Version": "5.0",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "ecs:cloudServers:createServerGroup"
        ]
      },
      {
        "Effect": "Allow",
        "Action": [
          "workspace:desktopPools:create",
          "workspace:desktops:create",
          "workspace:desktops:tag",
          "workspace:desktops:createSnapshots"
        ]
      }
    ]
  }