Help Center/ CodeArts Agent/ User Guide (Console)/ Permissions
Updated on 2026-07-29 GMT+08:00
View PDF
Share

Permissions

You can use a HUAWEI ID, IAM user account, or federated user account to log in to the CodeArts Agent console. The operation permissions vary depending on the account you used to log in, the role of the account on the console, and the IAM permissions assigned to the account. For details, see Table 1.

Table 1 Permissions

Login Account

User Identity

Role

IAM Permissions

Allowed Functions

HUAWEI ID

-

Enterprise administrator

Tenant Administrator, Security Administrator

All functions

IAM user account

Account root user

Enterprise administrator

Tenant Administrator, Security Administrator

All functions

IAM user who has the Tenant Administrator permissions

Enterprise administrator

Tenant Administrator

All functions except for the 30-day login-free function

IAM user with no permission

None

None
  • If a CodeArts Agent package is not purchased, no functions are available.
  • If a CodeArts Agent package is purchased, access to the CodeArts Agent console is not allowed, and AI functions are not available on the CodeArts Agent client.

Federated user account

SSO user (in the IAM user group with the Tenant Administrator permissions)

Enterprise administrator

Tenant Administrator

All functions except for the 30-day login-free function

virtual user SSO (in the IAM user group without any permissions)

None

None
  • If a CodeArts Agent package is not purchased, no functions are available.
  • If a CodeArts Agent package is purchased, access to the CodeArts Agent console is not allowed, and AI functions are not available on the CodeArts Agent client.

IAM user SSO

Same as that of the associated IAM user.

Same as that of the associated IAM user.

Same as those of the associated IAM user.
  • CodeArts Agent has the following roles: tenant space owner, enterprise administrator, team administrator, and member. For details, see Members.
  • By default, a HUAWEI ID account and its root user act as the enterprise administrator of CodeArts Agent and have the Tenant Administrator and Security Administrator permissions of IAM.
  • By default, an IAM user with the Tenant Administrator permission acts as the enterprise administrator of CodeArts Agent.
  • Federated enterprise users are classified into virtual user SSO and IAM user SSO based on the identity provider type. For details, see Application Scenarios of Virtual User SSO and IAM User SSO. The virtual user SSO permissions are determined by the mapping between the enterprise federated user and IAM user group in the identity conversion rule. The IAM user SSO permissions are determined by the actual permissions of the IAM user mapped to the enterprise federated user.

HUAWEI ID, IAM User, and Federated User

  • HUAWEI ID: Registered when you use Huawei Cloud services for the first time. The account has full access permissions for your Huawei Cloud resources and makes payments for the use of these resources. Your account receives and pays all bills generated by your IAM users' use of resources.
  • IAM user: created by your account. Each IAM user has their own identity credentials (password and access keys) and uses cloud resources based on assigned permissions. IAM users cannot make payments themselves (they do not have bills). You can use your registered account to pay for the resources they use.
  • Federated users: registered with a third-party system that has established a trust relationship with Huawei Cloud. Users can log in to Huawei Cloud using third-party system accounts, like logging in to a gaming platform using their social networking service (SNS) accounts.

A HUAWEI ID and its IAM users have a parent-child relationship. The HUAWEI ID owns the resources and has full permissions for these resources. IAM users have only the resource usage permissions granted by that HUAWEI ID. IAM users enable fine-grained permission control when multiple users collaborate on the same account.

Figure 1 HUAWEI ID and IAM users

Fine-grained IAM permissions

Some operations on the CodeArts Agent console require the enterprise administrator role and corresponding IAM permissions. For details, see Table 2 and Table 3.

As there are two editions of the IAM console and the permissions are different, configure the permissions based on your actual IAM edition. You can configure the permissions to enable or disable the pay-per-use billing mode only on the IAM console instead of the IAM console (new edition).

For details about how to grant permissions to IAM users on the IAM console, see Creating a User Group and Assigning Permissions or Creating a User Group and Assigning Permissions (New Edition). For details about how to grant permissions to federated users, see Creating a User Group and Assigning Permissions.

After the permissions of a user group to which a federated user belongs are modified, the enterprise IdP must be restarted to make the modifications take effect.

Table 2 IAM permissions required for operations

Operation

Fine-Grained Permissions

Purchasing a package
  • devcloud:monthlyPackage:listResourceDetail
  • devcloud:monthlyPackage:subscribe
  • bss:order:pay
  • bss:order:view

Modifying a package
  • devcloud:monthlyPackage:listResourceDetail
  • devcloud:monthlyPackage:changeSpecification
  • bss:order:pay
  • bss:order:view

Enabling or disabling the pay-per-use billing
  • devcloud:monthlyPackage:listResourceDetail
  • modelarts:apikey:create
  • modelarts:apikey:delete

Renewal
  • devcloud:monthlyPackage:listResourceDetail
  • bss:renewal:update
  • bss:order:pay
  • bss:order:view

Modifying auto-renewal settings
  • devcloud:monthlyPackage:listResourceDetail
  • bss:renewal:update
  • bss:renewal:view

Unsubscribing from a package
  • devcloud:monthlyPackage:listResourceDetail
  • bss:subscription:resourceUnsubscribe
  • bss:order:view

Creating a custom model

Tenant Administrator

Setting the monthly token quota for a built-in model

devcloud:monthlyPackage:listResourceDetail
Table 3 IAM permissions required for operations (new IAM edition)

Operation

Fine-Grained Permissions

Purchasing a package
  • codearts:monthlyPackage:listResourceDetail
  • codearts:monthlyPackage:subscribe
  • billing:order:pay
  • billing:order:view

Modifying a package
  • codearts:monthlyPackage:listResourceDetail
  • codearts:monthlyPackage:changeSpecification
  • billing:order:pay
  • billing:order:view

Renewal
  • codearts:monthlyPackage:listResourceDetail
  • billing:subscription:renew
  • billing:order:pay
  • billing:order:view

Modifying auto-renewal settings
  • codearts:monthlyPackage:listResourceDetail
  • billing:subscription:renew
  • billing:subscription:view

Unsubscribing from a package
  • codearts:monthlyPackage:listResourceDetail
  • billing:subscription:resourceUnsubscribe
  • billing:order:view

Creating a custom model

Tenant Administrator

Setting the monthly token quota for a built-in model

codearts:monthlyPackage:listResourceDetail

Example: Assigning Fine-grained Permissions to an IAM User

The following describes how to use a HUAWEI ID to assign the permissions to an IAM user on the IAM console, enabling the user to change the package and create a custom model.

  1. Log in to the IAM console using a HUAWEI ID.
  2. Create a custom policy and configure the policy required for changing a package.

    1. In the navigation tree on the left, choose Permissions > Policies/Roles. The Policies/Roles page is displayed.
    2. Click Create Custom Policy in the upper right corner.
    3. Set the custom policy by referring to Table 4.
      Table 4 Custom policy parameters

      Parameter

      Description

      Policy Name

      Enter a policy name. Only letters, digits, spaces, and the following special characters are allowed: -_.,

      Policy View

      Select JSON.

      Policy Content

      Copy and paste the following content:

      {
    "Version": "1.1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "devcloud:monthlyPackage:changeSpecification",
                "devcloud:monthlyPackage:listResourceDetail"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "bss:order:pay",
                "bss:order:view"
            ]
        }
    ]
}

      Description

      Optional. Enter a brief description for the policy.
      Figure 2 Creating a custom policy
    4. Click OK. The custom policy is created.

      On the Policies/Roles page, view the new policy.

  3. Add the IAM user to a user group. If the user has been added to a user group, skip this step and go to 4.

    1. In the navigation tree on the left, choose User Groups.
    2. Click Create User Group in the upper right corner.
    3. Set the user group name, and click OK.

      The user group name consists of letters, digits, spaces, hyphens (-), and underscores (_).

    4. On the User Groups page, locate the target user group, and click Manage User in the Operation column.
    5. Select the target IAM user, and click OK.

  4. Assign the permissions of the custom policy to the user group.

    1. On the User Groups page, locate the target user group, and click Authorize in the Operation column.
    2. In the search box, enter the custom policy name configured in 2. Locate and select the policy. Click Next.
      Figure 3 Selecting the created custom policy
    3. Click OK. An information dialog box is displayed.
    4. Click OK. A message is displayed, indicating that the authorization is successful. Click Finish.

  5. Log in to the CodeArts Agent console using the IAM user account, and change the CodeArts Agent package.
  1. Log in to the IAM console using a HUAWEI ID.
  2. Add the IAM user to a user group. If the user has been added to a user group, skip this step and go to 3.

    1. In the navigation tree on the left, choose User Groups.
    2. Click Create User Group in the upper right corner.
    3. Set the user group name, and click OK.

      The user group name consists of letters, digits, spaces, hyphens (-), and underscores (_).

    4. On the User Groups page, locate the target user group, and click Manage User in the Operation column.
    5. Select the target IAM user, and click OK.

  3. Assign the Tenant Administrator permissions to the user group.

    1. On the User Groups page, locate the target user group, and click Authorize in the Operation column.
    2. Search for Tenant Administrator in the search box. Locate and select the permissions. Click Next.
      Figure 4 Selecting the Tenant Administrator permissions
    3. Click OK. An information dialog box is displayed.
    4. Click OK. A message is displayed, indicating that the authorization is successful. Click Finish.

  4. Log in to the CodeArts Agent console using the IAM user account, and change the CodeArts Agent package.