Using IAM Roles or Policies to Grant Access to SMS

Prerequisites

Before granting permissions to user groups, learn about Role/Policy-based Authorization for SMS. To grant permissions for other services, learn about all system-defined permissionssupported by IAM.

Process Flow

Figure 1 Process for granting SMS permissions

1. Create a user group and assign it permissions.

   You can assign system-defined policies and custom policies to the user group. Custom policies extend and supplement system-defined policies, providing more refined access control. Select proper authorization policies based on service requirements.

   • If the IAM users in the user group need all permissions for SMS, attach system-defined policies to the user group. On the IAM console, create a user group and attach the SMS FullAccess, OBS OperateAccess, ECS FullAccess, VPC FullAccess, IMS FullAccess, EVS FullAccess, and EIP FullAccess policies to the user group. If disk encryption is required, EVS KMSAccess must also be attached.
   • If the IAM users only need specific SMS permissions, create custom policies and attach these policies to the user group. For details about the content and creation method of custom policies, see Example Custom Policies.
2. Create an IAM user and add it to the created user group.

   Create an IAM user and add it to the user group created in 1.

3. Log in as the IAM user and verify permissions.
   In the authorized region, perform the following operations:

   • Choose Service List > Server Migration Service. In the navigation pane on the left, click Servers. In the server list, locate the server to be migrated, and click Configure in the Target column to configure the target server. If the target server can be configured, the permissions have taken effect.
   • Choose a service other than SMS and its dependents services in the Service List. If a message appears indicating that you have insufficient permissions to access the service, the permissions have taken effect.

Example Custom Policies

1. Custom policies can be created to supplement the system-defined policies of SMS.

   To create a custom policy, choose either visual editor or JSON.

   • Visual editor: Select cloud services, actions, resources, and request conditions. This does not require knowledge of policy syntax.
   • JSON: Create a JSON policy or edit an existing one.

   For details, see Creating a Custom Policy. The following lists examples of common SMS custom policies.

• Example SMS policy that contains permissions for project-level services

  {
      "Version": "1.1",
      "Statement": [
          {
              "Action": [
                  "vpc:securityGroups:create",
                  "vpc:securityGroupRules:create",
                  "vpc:vpcs:create",
                  "vpc:publicIps:create",
                  "vpc:subnets:create",
                  "ecs:cloudServers:create",
                  "ecs:cloudServers:attach",
                  "ecs:cloudServers:detachVolume",
                  "ecs:cloudServers:start",
                  "ecs:cloudServers:stop",
                  "ecs:cloudServers:delete",
                  "ecs:cloudServers:reboot",
                  "ecs:cloudServers:updateMetadata",
                  "ecs:serverPasswords:manage",
                  "ecs:serverKeypairs:delete",
                  "ecs:diskConfigs:use",
                  "ecs:CloudServers:create",
                  "ecs:servers:setMetadata",
                  "ecs:serverVolumes:use",
                  "ecs:serverKeypairs:create",
                  "ecs:serverInterfaces:use",
                  "ecs:serverGroups:manage",
                  "ecs:securityGroups:use",
                  "ecs:servers:unlock",
                  "ecs:servers:rebuild",
                  "ecs:servers:lock",
                  "ecs:servers:reboot",
                  "evs:volumes:use",
                  "evs:volumes:create",
                  "evs:volumes:update",
                  "evs:volumes:delete",
                  "evs:volumes:attach",
                  "evs:volumes:detach",
                  "evs:snapshots:create",
                  "evs:snapshots:delete",
                  "evs:snapshots:rollback",
                  "kms:cmk:list",
                  "kms:cmk:get",
                  "kms:dek:create",
                  "kms:dek:decrypt",
                  "ecs:*:get*",
                  "ecs:*:list*",
                  "evs:*:get*",
                  "evs:*:list*",
                  "vpc:*:list*",
                  "vpc:*:get*",
                  "ims:*:get*",
                  "ims:*:list*"
              ],
              "Effect": "Allow"
          }
      ]
  }

• Example SMS policy that contains permissions for global services

  {
      "Version": "1.1",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                   "sms:server:registerServer",
                   "sms:server:migrationServer",
                   "sms:server:queryServer",
                   "iam:roles:listRoles",
                   "iam:agencies:listAgencies",
                   "iam:permissions:listRolesForAgency"
              ]
          }
      ]
  }