Identity Policy-based Authorization

Prerequisites

You have learned about system-defined permissions in Identity Policy-based Authorization for CCI. For the permissions for other services, see System-defined Permissions.

Process Flow

Figure 1 Process of granting CCI permissions

1. Log in to the IAM console and create an IAM user or create a user group.
2. Attach a system-defined policy (the CCIReadOnlyPolicy system-defined identity policy used as an example) to the user or user group.
3. Log in as the IAM user and verify permissions.

   In the authorized region, perform the following operations:

   • Choose Service List > Cloud Container Instance 2.0. On the CCI 2.0 console, click Create Pod in the upper right corner. If the pod cannot be created, the CCIReadOnlyPolicy policy has taken effect.
   • Switch to the console of any other service. If a message indicates that you do not have the required permissions for accessing the service, the CCIReadOnlyPolicy policy takes effect.
4. (Optional) Create custom policies to supplement the system-defined identity policies of CCI. For the actions supported by custom policies, see Actions Supported by Identity Policy-based Authorization.

   To create a custom policy, choose either visual editor or JSON.

   • Visual editor: Select cloud services, actions, resources, and request conditions. This does not require knowledge of policy syntax.
   • JSON: Create a policy in the JSON format from scratch or based on an existing policy.

   For details, see Creating a Custom Policy and Attaching It to a Principal.

   The following are examples of common CCI custom policies.

Example Custom Policies

You can create custom identity policies to supplement the system-defined identity policies of CCI. For details about the actions supported by custom identity policies, see Actions Supported by Identity Policy-based Authorization.

To create a custom identity policy, choose either visual editor or JSON.

• Visual editor: Select cloud services, actions, resources, and request conditions. This does not require knowledge of policy syntax.
• JSON: Create a policy in the JSON format from scratch or based on an existing policy.

For details, see Creating a Custom Policy and Attaching It to a Principal.

The following are examples of common CCI custom policies:

• Example 1: Grant the permission to create and delete pods.

  {
          "Version": "5.0",
          "Statement": [
              {
                  "Effect": "Allow",
                  "Action": [
                      "cci:pod:create",
                      "cci:pod:delete"
                  ]
              }
          ]
   }

• Example 2: Create a custom policy for multiple actions.

  A custom identity policy can contain multiple actions of one service or the actions of multiple services. The following is an example policy containing actions of multiple services:

  {
          "Version": "5.0",
          "Statement": [
              {
                  "Effect": "Allow",
                  "Action": [
                      "cci:pod:create",
                      "cci:pod:delete"
                  ]
              },
              {
                  "Effect": "Deny",
                  "Action": [
                      "cci:pod:delete"
                  ]
              },
              {
                  "Effect": "Allow",
                  "Action": [
                      "cci:pod:list",
                      "vpc:*:*"
                  ]
              }
          ]
  }