Using IAM Identity Policies to Grant Access to MRS

Prerequisites

Before granting permissions, learn about system-defined permissions for MRS. To grant permissions for other services, learn about all system-defined permissions supported by IAM by referring to System-defined Policies/Roles.

Process Flow

Figure 1 Process for granting MRS permissions

1. Create an IAM user or create a user group.

2. Attach a system-defined identity policy to a user or user group.

   Assign MRSReadOnlyAccessPolicy to the user group to which the user belongs.

3. Log in as the IAM user and verify permissions.

   In the authorized region, perform the following operations:

   • Choose Service List > MapReduce Service. Then click Buy Cluster on the MRS console. If a message appears indicating that you have insufficient permissions to perform the operation, the MRSReadOnlyAccessPolicy is in effect.
   • Choose another service from Service List. If a message appears indicating that you have insufficient permissions to access the service, the MRSReadOnlyAccessPolicy policy is in effect.

Example Custom Policies

You can create custom identity policies to supplement the system-defined policies of MRS. For details about the actions supported by custom identity policies, see MRS Role/Policy-based Permissions Management.

You can create custom policies in either of the following ways:

• Visual editor: Select cloud services, actions, resources, and request conditions. This does not require knowledge of policy syntax.
• JSON: Create a JSON policy or edit an existing one.

For details, see Creating a Custom Identity Policy and Attaching It to a Principal.

Examples of common MRS custom identity policies:

• Example 1: Grant permission to submit, view, and stop jobs.

  {
      "Version": "5.0",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "mrs:cluster:createJob",
                  "mrs:cluster:getJob",
                  "mrs:cluster:stopJob"
              ],
              "Resource": [
                  "mrs:*:*:cluster:*"
              ]
          }
      ]
  }

• Example 2: Create a custom policy containing multiple actions.

  A custom policy can contain the actions of one or more services.

  Example policy containing multiple actions:

  {
      "Version": "5.0",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "mrs:cluster:list",
                  "mrs:cluster:getCluster"
              ]
          },
          {
              "Effect": "Allow",
              "Action": [
                  "ecs:cloudServers:showServer"
              ]
          },
          {
              "Effect": "Allow",
              "Action": [
                  "vpc:vpcs:get"
              ]
          }
      ]
  }