Creating a User and Granting Permissions

Scenarios

This section describes how to use Identity and Access Management (IAM) to implement fine-grained permissions control over your images. With IAM, you can:

• Create IAM users in your account for personnel based on your enterprise's organizational structure. Each IAM user has their own security credentials for accessing IMS resources.
• Grant only the permissions required for users to perform a specific task.
• Entrust an account or a cloud service to perform efficient O&M on your IMS resources.

If your account does not require individual IAM users, you can skip this section.

This section uses the IMS ReadOnlyAccess permission as an example to describe how to grant permissions to a user. Figure 1 shows the process.

Prerequisites

Learn about the permissions (see IMS Permissions) supported by IMS. For the system permissions of other services, see System Permissions.

Process Flow

Figure 1 Process for granting IMS permissions

1. Create a user group and grant permissions to it.

   Create a user group on the IAM console, and grant the read-only permission to the group by assigning IMS ReadOnlyAccess.

2. Create an IAM user and add it to the user group.

   Create a user on the IAM console and add the user to the group created in 1.

3. Log in and verify permissions.

   Log in to the IMS console as the created IAM user, switch to the authorized region, and verify the permissions (assume that the user only has the IMS ReadOnlyAccess permissions).

   • On the IMS console, perform operations except querying images, such as creating, modifying, and deleting an image.

     For example, click Create Private Image in the upper right corner. If you are prompted for insufficient permissions, the IMS ReadOnlyAccess permission has taken effect.

   • Choose any other service in the Service List, such as Virtual Private Cloud. If a message appears indicating insufficient permissions to access the service, the IMS ReadOnlyAccess permission has taken effect.