Permissions
If you need to grant your enterprise personnel permission to access your Cloud Eye resources, use Identity and Access Management (IAM). IAM provides identity authentication, fine-grained permissions management, and access control. IAM helps you secure access to your Huawei Cloud resources.
With IAM, you can create IAM users and grant them permissions to access only specific resources. For example, if you want some software developers in your enterprise to be able to use Cloud Eye resources but do not want them to be able to delete other cloud resources or perform any other high-risk operations, you can create IAM users and grant them only the permissions to use Cloud Eye resources.
If your Huawei Cloud account does not require individual IAM users for permissions management, skip this section.
IAM is a free service. You only pay for the resources in your account. For more information about IAM, see What Is IAM?
Cloud Eye Permissions
New IAM users do not have any permissions assigned by default. You need to first add them to one or more groups and then attach policies or roles to these groups. The users then inherit permissions from the groups and can perform specified operations on cloud services based on the permissions they have been assigned.
Cloud Eye is a project-level service deployed and accessed in specific physical regions. Cloud Eye permissions are assigned to users in specific regions (such as CN-Hong Kong) and only take effect in these regions. To make the permissions take effect in all regions, assign the permissions to users in each region. When users access Cloud Eye, they need to switch to a region where they have been authorized to use this service.
You can grant users permissions by using roles and policies.
- Roles: A coarse-grained authorization strategy that defines permissions by job responsibility. Only a limited number of service-level roles are available for authorization. When using roles to grant permissions, you also need to assign other roles on which the permissions depend to take effect. However, roles are not an ideal choice for fine-grained authorization and secure access control.
- Policies: A fine-grained authorization strategy that defines permissions required to perform operations on specific cloud resources under certain conditions. This type of authorization is more flexible and is ideal for least privilege access. For example, you can grant Cloud Eye users only the permissions for managing a certain type of Cloud Eye resources.
A majority of fine-grained policies contain permissions for specific APIs, and permissions are defined using API actions. For the API actions supported by Cloud Eye, see Permissions Policies and Supported Actions.
Table 1 lists all the system-defined permissions for Cloud Eye.
|
Role/Policy Name |
Description |
Type |
Dependencies |
|---|---|---|---|
|
CES FullAccessPolicy |
All permissions for Cloud Eye. Users granted these permissions can perform all operations on Cloud Eye. |
System-defined policies |
Cloud Eye monitoring involves querying resources of other cloud services. This policy contains the resource query permissions of some cloud services. If you encounter permission problems, configure required fine-grained permissions for the services involved. For details, see Supported Cloud Services. Alarm notification: depends on SMN FullAccess. Data dump: depends on OBS OperateAccess. |
|
CES ReadOnlyAccessPolicy |
Read-only permissions for viewing data on Cloud Eye |
System-defined policies |
Cloud Eye monitoring involves querying resources of other cloud services. This policy contains the resource query permissions of some cloud services. If you encounter permission problems, configure required fine-grained permissions of the involved services. For details, see Supported Cloud Services. |
|
CES AgentAccess |
Permissions required for the Cloud Eye Agent to run
NOTE:
To ensure that the Cloud Eye Agent can provide services, you need to configure an agency. For details, see How Do I Configure an Agency? |
System-defined policies |
None |
|
CES Administrator |
Administrator permissions for Cloud Eye |
System-defined roles |
Depends on the Tenant Guest policy. Tenant Guest: global policy, which must be assigned in the global project. |
|
CES FullAccess |
All permissions for Cloud Eye. Users granted these permissions can perform all operations on Cloud Eye.
NOTE:
It is recommended that you use CES FullAccessPolicy because CES FullAccess does not meet the least privilege principle. |
System-defined policies |
Cloud Eye monitoring involves querying resources of other cloud services. This policy contains the resource query permissions of some cloud services. If you encounter permission problems, configure required fine-grained permissions of the involved services. For details, see Supported Cloud Services. Alarm notification: depends on SMN FullAccess. Data dump: depends on OBS OperateAccess. |
|
CES ReadOnlyAccess |
Read-only permissions for viewing data on Cloud Eye
NOTE:
It is recommended that you use CES ReadOnlyAccessPolicy because CES ReadOnlyAccess does not meet the least privilege principle. |
System-defined policies |
Cloud Eye monitoring involves querying resources of other cloud services. This policy contains the resource query permissions of some cloud services. If you encounter permission problems, configure required fine-grained permissions of the involved services. For details, see Supported Cloud Services. |
Table 2 lists common operations supported by the Cloud Eye system-defined permissions.
|
Feature |
Operation |
CES FullAccessPolicy |
CES ReadOnlyAccessPolicy |
CES Administrator (The Tenant Guest policy must be added at the same time.) |
Tenant Guest |
|---|---|---|---|---|---|
|
Monitoring Overview |
Viewing the monitoring overview |
Supported |
Supported |
Supported |
Supported |
|
Viewing monitoring data in a large screen |
Supported |
Supported |
Supported |
Supported |
|
|
Monitoring Panels |
Creating a dashboard |
Supported |
Not supported |
Supported |
Not supported |
|
Viewing monitoring data in a large screen |
Supported |
Supported |
Supported |
Supported |
|
|
Querying a panel |
Supported |
Supported |
Supported |
Supported |
|
|
Deleting a monitoring panel |
Supported |
Not supported |
Supported |
Not supported |
|
|
Adding a graph |
Supported |
Not supported |
Supported |
Not supported |
|
|
Viewing a graph |
Supported |
Supported |
Supported |
Supported |
|
|
Modifying a graph |
Supported |
Not supported |
Supported |
Not supported |
|
|
Deleting a graph |
Supported |
Not supported |
Supported |
Not supported |
|
|
Adjusting the position of a graph |
Supported |
Not supported |
Supported |
Not supported |
|
|
Resource Groups |
Creating a resource group |
Supported |
Not supported |
Supported |
Not supported |
|
Viewing resource groups |
Supported |
Supported |
Supported |
Supported |
|
|
Viewing resource groups (Resource Overview) |
Supported |
Supported |
Supported |
Supported |
|
|
Viewing resource groups (Alarm Rules) |
Supported |
Supported |
Supported |
Supported |
|
|
Modifying a resource group |
Supported |
Not supported |
Supported |
Not supported |
|
|
Deleting a resource group |
Supported |
Not supported |
Supported |
Not supported |
|
|
Alarm Rules |
Creating an alarm rule |
Supported |
Not supported |
Supported |
Not supported |
|
Modifying an alarm rule |
Supported |
Not supported |
Supported |
Not supported |
|
|
Enabling an alarm rule |
Supported |
Not supported |
Supported |
Not supported |
|
|
Disabling an alarm rule |
Supported |
Not supported |
Supported |
Not supported |
|
|
Deleting an alarm rule |
Supported |
Not supported |
Supported |
Not supported |
|
|
Exporting alarm rules |
Supported |
Not supported |
Supported |
Not supported |
|
|
Viewing alarm rules |
Supported |
Supported |
Supported |
Supported |
|
|
Viewing details of an alarm rule |
Supported |
Supported |
Supported |
Supported |
|
|
Viewing a graph |
Supported |
Supported |
Supported |
Supported |
|
|
Alarm Records |
Viewing alarm records |
Supported |
Supported |
Supported |
Supported |
|
Alarm Templates |
Viewing a default alarm template |
Supported |
Supported |
Supported |
Supported |
|
Viewing a custom template |
Supported |
Supported |
Supported |
Supported |
|
|
Creating a custom template |
Supported |
Not supported |
Supported |
Not supported |
|
|
Modifying a custom alarm template |
Supported |
Not supported |
Supported |
Not supported |
|
|
Deleting a custom template |
Supported |
Not supported |
Supported |
Not supported |
|
|
One-Click Monitoring |
Enable one-click monitoring |
Supported |
Not supported |
Supported |
Not supported |
|
Viewing one-click monitoring |
Supported |
Supported |
Supported |
Supported |
|
|
Modifying one-click monitoring |
Supported |
Not supported |
Supported |
Not supported |
|
|
Disabling one-click monitoring |
Supported |
Not supported |
Supported |
Not supported |
|
|
Server Monitoring |
Viewing servers |
Supported |
Supported |
Supported |
Supported |
|
Viewing server monitoring metrics |
Supported |
Supported |
Supported |
Supported |
|
|
Installing the Agent |
Supported (You must have the ECS FullAccess permissions.) |
Not supported |
Supported (You must have the ECS FullAccess permissions.) |
Not supported |
|
|
Restoring the Agent configurations |
√ (You must have the Security Administrator and ECS FullAccess permissions.) |
Not supported |
√ (You must have the Security Administrator and ECS FullAccess permissions.) |
Not supported |
|
|
Uninstalling the Agent |
Supported (You must have the ECS FullAccess permissions.) |
Not supported |
Supported (You must have the ECS FullAccess permissions.) |
Not supported |
|
|
Configuring process monitoring |
Supported |
Not supported |
Supported |
Not supported |
|
|
Configuring monitoring for a process |
Supported |
Not supported |
Supported |
Not supported |
|
|
Cloud Service Monitoring |
Viewing the cloud service list |
Supported (See Supported Cloud Services.) |
Supported (See Supported Cloud Services.) |
Supported |
Supported |
|
Querying metrics of a cloud service |
Supported |
Supported |
Supported |
Supported |
|
|
Custom Monitoring |
Adding custom monitoring data |
Supported |
Not supported |
Supported |
Not supported |
|
Viewing the custom monitoring list |
Supported |
Supported |
Supported |
Supported |
|
|
Viewing custom monitoring data |
Supported |
Supported |
Supported |
Supported |
|
|
Event Monitoring |
Adding a custom event |
Supported |
Not supported |
Supported |
Not supported |
|
Viewing events |
Supported |
Supported |
Supported |
Supported |
|
|
Viewing details of an event |
Supported |
Supported |
Supported |
Supported |
|
|
Data Dumping to DMS Kafka |
Creating a dump task |
Supported |
Not supported |
Supported |
Not supported |
|
Querying data dump tasks |
Supported |
Supported |
Supported |
Supported |
|
|
Querying a data dump task |
Supported |
Supported |
Supported |
Supported |
|
|
Modifying a data dump task |
Supported |
Not supported |
Supported |
Not supported |
|
|
Starting a data dump task |
Supported |
Not supported |
Supported |
Not supported |
|
|
Stopping a data dump task |
Supported |
Not supported |
Supported |
Not supported |
|
|
Deleting a data dump task |
Supported |
Not supported |
Supported |
Not supported |
|
|
Others |
Configuring data dump |
Supported (You must have the OBS Bucket Viewer permissions.) |
Not supported |
Supported (You must have the Tenant Administrator permission.) |
Not supported |
|
Exporting monitoring data |
Supported |
Not supported |
Supported |
Not supported |
|
|
Sending an alarm notification |
Supported |
Not supported |
Supported |
Not supported |
Roles or Policies Required for Operations on the Cloud Eye Console
To grant an IAM user the permissions to view or use resources of other cloud services on the Cloud Eye console, you must first grant the CES Administrator, CES FullAccessPolicy, or CES ReadOnlyAccessPolicy policy to the user group that the user belongs to and then grant the dependency roles or policies listed in Table 3 to the user. These dependency policies will allow the IAM user to access resources of other cloud services.
|
Function |
Dependent Services |
Roles or Policies Required |
|---|---|---|
|
Cloud service monitoring |
|
IAM users with the CES Administrator, CES FullAccessPolicy, or CES ReadOnlyAccessPolicy permission can view information about cloud service monitoring. |
Helpful Links
- IAM Service Overview
- For details about how to create a user group and user and grant the CES Administrator permissions, see Creating a User and Granting Permissions.
- For the actions supported by fine-grained policies, see Permissions Policies and Supported Actions in Cloud Eye API Reference.
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot
