Permissions

If you need to assign different permissions to employees in your enterprise to access your MgC resources, Identity and Access Management (IAM) is a good choice for fine-grained permissions management. IAM provides identity authentication, permissions management, and access control, helping you secure access to your Huawei Cloud resources. If your Huawei Cloud account does not require IAM for permissions management, you can skip this section.

IAM is a free service. You only pay for the resources in your account.

With IAM, you can control access to specific Huawei Cloud resources. For example, if you want some software developers in your enterprise to use MgC resources but do not want them to delete MgC resources or perform any other high-risk operations, you can grant the permission to use MgC resources but not the permission to delete them.

IAM supports role/policy-based authorization and identity policy-based authorization.

The following table describes the differences between these two authorization models.

**Table 1** Differences between role/policy-based and identity policy-based authorization
Authorization Model	Core Relationship	Permissions	Authorization Method	Scenario
Role/Policy	User-permission-authorization scope	System-defined roles System-defined policies Custom policies	Assigning roles or policies to principals	To authorize a user, you need to add it to a user group first and then specify the scope of authorization. It is hard to provide fine-grained permissions control using authorization by user groups and a limited number of condition keys. This method is suitable for small- and medium-sized enterprises.
Identity policy	User-policy	System-defined policies Custom identity policies	Assigning identity policies to principals Attaching identity policies to principals	You can authorize a user by attaching an identity policy to it. User-specific authorization and a variety of key conditions allow for more fine-grained permissions control. However, this model can be hard to set up. It requires a certain amount of expertise and is suitable for medium- and large-sized enterprises.

Assume that you want to grant IAM users the permissions needed to create ECSs in CN North-Beijing4 and OBS buckets in CN South-Guangzhou. With role/policy-based authorization, the administrator needs to create two custom policies and attach both to the IAM users. With identity policy-based authorization, the administrator only needs to create one custom policy, configure the condition key g:RequestedRegion for the policy, and attach the policy to the users or grant the users the access permissions to the specified regions. Identity policy-based authorization is more flexible than role/policy-based authorization.

Policies and actions in the two authorization models are not interoperable. You are advised to use the identity policy-based authorization model. For details about system-defined permissions in the two authorization models, see Role/Policy-based Authorization and Identity Policy-based Authorization.

Role/Policy-based Authorization

MgC supports authorization with roles and policies. New IAM users do not have any permissions assigned by default. You need to first add them to one or more groups and then attach policies or roles to these groups. The users then inherit permissions from the groups and can perform specified operations on cloud services based on their permissions.

Table 2 lists all the system-defined permissions for MgC. System-defined policies in role/policy-based authorization are not interoperable with those in identity policy-based authorization.

**Table 2** System-defined policies supported by MgC
Role/Policy Name	Description	Type
MgC FullAccess	Administrator permissions for MgC. Users with these permissions can perform all operations on MgC.	System-defined policies
MgC ReadOnlyAccess	Read-only permissions for MgC. Users with these permissions can only view MgC resources.	System-defined policies
MgC DiscoveryAccess	Permissions for resource discovery with MgC. Users with these permissions can use the resource discovery function of MgC and view MgC resources.	System-defined policies
MgC AssessAccess	Permissions for application assessment with MgC. Users with these permissions can use the resource discovery and application assessment functions of MgC and view MgC resources.	System-defined policies
MgC MigrateAccess	Permissions for application migration with MgC. Users with these permissions can use the resource discovery, application assessment, and application migration functions of MgC and view MgC resources.	System-defined policies
MgC AppDiscoveryAccess	Permissions for resource discovery with MgC. Users with these permissions can use the resource discovery and collection functions of MgC and view MgC resources.	System-defined policies
MgC MrrAccess	Permissions for service verification with MgC. Users with these permissions can use the service verification function of MgC and view MgC resources.	System-defined policies
MgC AZ MigrateAccess	Permissions for cross-AZ migration with MgC	System-defined policies

Table 3 lists the common operations and permissions supported by system-defined policies for MgC.

**Table 3** Common operations supported by each MgC system-defined policy
Operation	MgC FullAccess	MgC ReadOnlyAccess	MgC DiscoveryAccess	MgC AssessAccesss	MgC MigrateAccess	MgC AppDiscoveryAccess
Performing operations on MgC resources	√	x	x	x	x	x
Viewing MgC resources	√	√	√	√	√	√
Discovering resources using MgC	√	x	√	√	√	√
Designing migration plans on MgC	√	x	x	√	√	x
Performing operations on migration workflows	√	x	x	x	√	x
Collecting resource details using MgC	√	x	x	x	x	√

Identity Policy-based Authorization

MgC supports authorization with identity policies. Table 4 lists all the system-defined identity policies for MgC. System-defined identity policies and system-defined policies in the two authorization models are not interoperable.

**Table 4** MgC system-defined identity policies
Identity Policy Name	Description	Type
MGCFullAccessPolicy	Full permissions for MgC	System-defined identity policies
MGCReadOnlyPolicy	Read-only permissions for MgC	System-defined identity policies
MGCCollectionAccessPolicy	Permissions for resource discovery and collection with MgC	System-defined identity policies
MGCAssessmentAccessPolicy	Permissions for resource assessment with MgC	System-defined identity policies
MGCManagementAccessPolicy	Permissions for managing migration settings on MgC	System-defined identity policies
MGCWorkflowAccessPolicy	Permissions for using MgC migration workflows	System-defined identity policies
MGCMigrationPlanAccessPolicy	Permissions for designing migration plans with MgC	System-defined identity policies
MGCBigdataAccessPolicy	Permissions for migrating and verifying big data with MgC	System-defined identity policies

Table 5 lists the common operations supported by system-defined identity policies for MgC.

**Table 5** Common operations supported by each MgC system-defined policy
Operation	MGCFullAccessPolicy	MGCReadOnlyPolicy	MGCCollectionAccessPolicy	MGCAssessmentAccessPolicy	MGCMigrationPlanAccessPolicy	MGCWorkflowAccessPolicy	MGCBigdataAccessPolicy	MGCManagementAccessPolicy
Performing operations on MgC resources	√	x	x	x	x	x	x	x
Viewing MgC resources	√	x	x	x	x	x	x	x
Managing global settings on MgC	√	x	x	x	x	x	x	√
Discovering resources and collecting their details using MgC	√	x	√	x	x	x	x	x
Designing migration plans on MgC	√	x	x	x	√	x	x	x
Performing operations on migration workflows	√	x	x	x	x	√	x	x
Assessing resources using MgC	√	x	x	√	x	x	x	x
Using big data-related features of MgC	√	x	x	x	x	x	√	x