Using IAM Identity Policies to Grant Access to CNAD

Prerequisites

Before granting permissions, learn about the CNAD permissions and select them as required. For details about the system policies supported by CNAD, see Actions Supported by Identity Policy-based Authorization. For more information about the permissions supported by other services, see Actions Supported by Identity Policy-based Authorization.

Process

Figure 1 Process for granting CNAD permissions

1. Creating a User or Creating a User Group

   Log in to the IAM console to create a user or user group.

2. Attach a system identity policy to a user or user group.

   Grant the CNADReadOnlyPolicy system identity policy to the user or user group, or attach the identity policy to the user or user group.

3. Log in and verify the user's permissions.

   In the authorized region, perform the following operations:

   • Choose Service List > Anti-DDoS Service > Advanced Anti-DDoS. Then click Buy AAD on the Instances tab page. If a message appears indicating insufficient permissions, the CNADReadOnlyAccess policy has already taken effect.
   • Choose any other service in the Service List. (Assume that the current policy contains only CNADReadOnlyPolicy.) If a message appears indicating insufficient permissions, the CNADReadOnlyPolicy policy has already taken effect.

Example of a Custom CNAD Identity Policy

You can create custom identity policies to supplement the system-defined identity policies of CNAD. For details about the actions supported by custom identity policies, see Actions Supported by Identity Policy-based Authorization.

You can create custom identity policies in either of the following ways:

• Visual editor: Select cloud services, actions, resources, and request conditions without the need to know policy syntax.
• JSON: Edit JSON policies from scratch or based on an existing policy.

For details, see Creating a Custom Identity Policy and Attaching It to a Principal.

When creating a custom identity policy, use the Resource element to specify the resources the policy applies to and use the Condition element (condition keys) to control when the policy is in effect. For details about the supported resource types and condition keys, see Actions Supported by Identity Policy-based Authorization. The following provides examples of custom identity policies for CNAD.

• Example 1: Granting the permission to query instance information

  {
      "Version": "5.0",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "cnad:package:get"
              ]
          }
      ]
  }

• Example 2: Creating a custom policy containing multiple actions

  A custom identity policy can contain the actions of multiple services. An example is as follows.

  {
      "Version": "5.0",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "cnad:package:get"
              ]
          },
          {
              "Effect": "Allow",
              "Action": [
                  "tms:predefineTags:create"
              ]
          }
      ]
  }