Using IAM Identity Policies to Grant Access to CFW

System-defined permissions in identity policy-based authorization provided by Identity and Access Management (IAM) let you control access to CFW. With IAM, you can:

Create IAM users or user groups for personnel based on your enterprise's organizational structure. Each IAM user has their own identity credentials to access CFW resources.
Grant only the permissions required for users to perform a specific task.
Entrust a Huawei Cloud account or a cloud service to perform professional and efficient O&M on your CFW resources.

If your Huawei Cloud account does not require individual IAM users, skip this section.

Figure 1 shows the process flow of identity policy-based authorization.

Prerequisites

Before granting permissions, learn about system-defined permissions in identity policy-based authorization for CFW. For details about all the permissions supported by IAM, see Permissions.

Authorization Process

Figure 1 Process for granting CFW permissions
Click to enlarge

On the IAM console, create an IAM user or create a user group.
Create a user or user group on the IAM console.
Attach a system-defined policy to the user or user group.
Authorize or attach the CFWReadOnlyAccessPolicy system-defined policy to a user or user group.
Log in as the IAM user and verify permissions.
In the authorized region, perform the following operations:
- Choose Cloud Firewall in the service list. Click Buy CFW on the CFW console. If you cannot buy CFW (assuming that only CFWReadOnlyAccessPolicy is granted), CFWReadOnlyAccessPolicy has already taken effect.
- Choose any other service in the service list. If a message appears indicating that you have insufficient permissions to access the service (assuming that only the CFWReadOnlyAccessPolicy permission is granted), CFWReadOnlyAccessPolicy has already taken effect.

CFW Example Custom Identity Policies

You can create custom identity policies to supplement the system-defined identity policies of CFW. For details about actions supported in custom identity policies, see Actions Supported by Identity Policy-based Authorization.

To create a custom identity policy, choose either visual editor or JSON.

Visual editor: Select cloud services, actions, resources, and request conditions. This does not require knowledge of policy syntax.
JSON: Create a JSON policy or edit an existing one.

For details, see Creating a Custom Identity Policy and Attaching It to a Principal.

When creating a custom identity policy, use the Resource element to specify the resources the policy applies to and use the Condition element (condition keys) to control when the policy is in effect. For details about the resources and conditions supported by CFW, see Supported Actions in Identity Policy-based Authorization. The following are examples of custom identity policies.

Example 1: Allow a user to view the firewall list only.

       
            {    "Version": "5.0",    "Statement": [        {            "Effect": "Allow",            "Action": [                "cfw:instance:listInstance"            ]        }    ]}

Example 2: Create a custom policy containing multiple actions.

A custom policy can contain the actions of multiple services. The following example grants some CFW, NAT, and ECS permissions:

       
            {    "Version": "5.0",    "Statement": [        {            "Effect": "Allow",            "Action": [                "cfw:eip:count",                "cfw:eip:list"            ]        },        {            "Effect": "Allow",            "Action": [                "nat:natGateways:list"            ]        },        {            "Effect": "Allow",            "Action": [                "ecs:cloudServers:listServersDetails"            ]        }    ]}