Granting Permissions by Cloud Service

Constraints

This feature is available only in the new IAM version.

Prerequisites

You have created a user group and an IAM user

Creating Custom Identity Policies

1. Use the Huawei Cloud account to log in to the IAM console as an administrator.
2. On the IAM console, click Go to New Console in the upper right corner.
3. In the navigation pane on the left, choose Identity Policies.
4. On the Identity Policies page, click Create Identity Policy in the upper right corner.
5. On the Create Identity Policy page, enter a policy name, set Policy View to Visual editor, and configure the policy content.
   • To configure permissions except ces:widgets:put, perform the following steps:
     1. Select Allow for Policy Content.
     2. Select the operations that support cloud service–based authorization. For details, see Actions That Support Authorization by Cloud Service. You can select all operations except ces:widgets:put.
     3. Click All resources. All resources is selected by default.
     4. Click (Optional) Add request condition.
     5. Click Add Request Condition. In the displayed dialog box, set parameters and click OK. Table 1 uses OBS, ECS, and EVS as an example to describe how to configure parameters. To authorize other cloud services, change the parameter value.

        Table 1 Configuring a request condition

        Parameter	Description	Example Value
        Condition Key	A key in the Condition element of a statement.	ces:namespace
        Qualifier	The value can be Default, For any value in the request, or For all values in the request.	For any value in the request
        Operator	Used together with a condition key and condition value to form a complete condition statement.	StringEquals
        Value	Used together with a condition key and an operator that requires a keyword, to form a complete condition statement. The condition value is the namespace of the cloud service to be authorized. To configure multiple cloud services, click Add and enter the namespace of each cloud service. CAUTION: Some monitoring data of ECS and BMS depends on the Agent. To authorize ECS, you need to configure SYS.ECS and AGT.ECS. For BMS, configure SYS.ECS and SERVICE.BMS.	SYS.OBS SYS.ECS AGT.ECS SYS.EVS

        Figure 1 Configuring the policy content for permission 1
        
   • If you also need to configure the ces:widgets:put operation permission, click Add Permissions under Policy Content and perform the following steps:
     1. Select Allow for Policy Content.
     2. Search for ces:widgets:put and select it.
     3. Click All resources. All resources is selected by default.
     4. Click (Optional) Add request condition.
     5. Click Add Request Condition. In the displayed dialog box, set parameters as described in Table 1 and select If exists next to Operator.
     6. Click OK.
        Figure 2 Configuring the policy content for permission 2
        

6. On the Create Identity Policy page, click OK in the lower right corner.

Authorizing a User Group or User

After creating an identity policy, you can authorize a user or user group. To authorize all users in a user group, you need to authorize the user group. To authorize a single user in a user group, you need to authorize the IAM user. Once authorized, you can log in to the Cloud Eye console and check that only authorized cloud services can be operated. For more on authorizing operations by cloud service, see Actions That Support Authorization by Cloud Service.

Actions That Support Authorization by Cloud Service

Table 2 lists the actions that support authorization by cloud service and their application scenarios. You can select an action as needed.