Permissions Management of CBH Instances

CBH Instance Permissions

By default, new IAM users do not have any permissions assigned. You can add a user to one or more groups to allow them to inherit the permissions from the groups to which they are added.

CBH is a project-level service deployed and accessed in specific physical regions. To assign CBH permissions to a user group, specify the scope as region-specific projects and select projects for the permissions to take effect. If All projects is selected, the permissions will take effect for the user group in all region-specific projects. When accessing a CBH instance, switch to a region where they have been authorized to use the CBH instance.

You can grant users permissions by using roles and policies.

• Roles: A type of coarse-grained authorization mechanism that defines permissions related to users responsibilities. Only a limited number of service-level roles for authorization are available. Some roles depend other roles to take effect. When you assign such roles to users, remember to assign the roles they depend on. Roles are not ideal for fine-grained authorization and secure access control.
• Policies: A fine-grained authorization mechanism that defines permissions required to perform operations on specific cloud resources under certain conditions. This mechanism allows for more flexible policy-based authorization and meets secure access control requirements. For example, you can grant CBH users only the permissions for managing a certain type of resources. For details about the actions supported by CBH, see Permissions and Supported Actions.

Table 1 lists some system-defined roles and policies supported by CBH instances.

To use all CBH functions on the CBH console, you need to have the CBH FullAccess role assigned at the enterprise project level and the CBH ReadOnlyAccess role assigned at the IAM project level.

Table 2 lists the common operations for each system-defined policy or role of CBH instances. Select the policies or roles as required.

Role/Policy Dependencies of the CBH Console

CBH FullAccess Policy Content

{
    "Version": "1.1",
    "Statement": [
        {
                    "Effect": "Allow",
                    "Action": [
                        "cbh:*:*",
                        "vpc:subnets:get",
                        "vpc:publicIps:list",
                        "vpc:vpcs:list",
                        "vpc:securityGroups:get",
                        "vpc:firewallGroups:get",
                        "vpc:firewallPolicies:get",
                        "vpc:firewallRules:get",
                        "vpc:ports:get",
                        "vpc:publicips:update",
                        "vpc:securityGroups:create",
                        "vpc:firewallRules:create",
                        "vpc:firewallPolicies:addRule"
                        "ecs:cloudServerFlavors:get",
                        "evs:types:get"
            ]
        }
    ]
}

CBH ReadOnlyAccess Policy Content

{
    "Version": "1.1",
    "Statement": [
        {
                    "Effect": "Allow",
                    "Action": [
                        "cbh:*:list*",
                        "vpc:publicIps:list",
                        "vpc:vpcs:list",
                        "vpc:securityGroups:get",  
                        "vpc:subnets:get"
            ]
        }
    ]
}

Manually Adding Permissions for CBH FullAccess

When using a bastion host, you need to manually add permissions to create cloud asset agencies and bind or unbind EIPs.

Manually Adding Permissions for CBH ReadOnlyAccess

When using a bastion host instance, you need to manually add the permission to view the instance details.

Related Topics

• IAM Service Overview
• Creating a User Group and Granting CBH Instance Permissions to the Group.
• Creating Custom Policies for CBH Instances
• CBH Instance Permissions and Supported Actions