Help Center/ Workspace/ User Guide (Administrators)/ Using IAM to Grant Access to Workspace/ Using IAM Roles or Policies to Grant Access to Workspace
Updated on 2026-07-14 GMT+08:00
View PDF
Share

Using IAM Roles or Policies to Grant Access to Workspace

To manage permissions on Workspace based on roles and policies, you can use Identity and Access Management (IAM). With IAM, you can:

  • Create IAM users for employees from different departments of your enterprise. In this way, each IAM user has a unique security credential to use Workspace resources.
  • Assign users only the permissions required to perform a given task based on their job responsibilities.
  • Entrust a HUAWEI ID or cloud service to perform efficient O&M on your Workspace resources.

If your HUAWEI ID does not require individual IAM users, skip this section.

Figure 1 shows the process flow of role/policy-based authorization.

Prerequisites

Before granting permissions to user groups, learn about the permissions supported by Workspace and choose permissions as required. For details about the system permissions supported by Workspace, see Role/Policy-based Authorization. To grant permissions for other services, you need to learn about all system permissions supported by IAM.

Process Flow

Figure 1 Process of assigning Workspace permissions to a user
  1. Create a user group and assign permissions to it.

    Create a user group on the IAM console, and assign the Workspace ReadOnlyAccess permission to the group.

  2. Create a user and add them to the user group.

    On the IAM console, create a user and add them to the user group created in 1.

  3. Log in and verify permissions.

    Log in to the console as the created user and perform the following operations in an authorized region:

    • Select Workspace in Service List. On the Workspace console, click Buy Desktop in the upper right corner. If the operation fails (assume that the permission contains only the Workspace ReadOnlyAccess policy), the Workspace ReadOnlyAccess policy has already taken effect.
    • Select any service other than Workspace in Service List. If a message is displayed indicating insufficient permissions for performing the operation (assume that the permission contains only the Workspace ReadOnlyAccess policy), the Workspace ReadOnlyAccess policy has already taken effect.

Example Custom Policies

Custom identity policies can be created to supplement the system-defined policies of Workspace. For details about actions supported by custom identity policies, see Actions Supported by Policy-based Authorization.

To create a custom policy, choose either visual editor or JSON.

  • Visual editor: Select cloud services, actions, resources, and request conditions. This does not require knowledge of policy syntax.
  • JSON: Create a JSON policy or edit an existing one.

For details, see Creating a Custom Policy. The following lists examples of common Workspace custom policies.

  • Example 1: Assign users the permission to create and delete a cloud desktop. 
    {
    "Version": "1.1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "workspace:desktops:delete",
                "workspace:desktops:create"
            ]
        }
    ]
}
  • Example 2: Create a custom identity policy containing multiple actions.
    A custom policy can contain the actions of multiple services that are all of the global or project-level type. Example of a policy containing multiple actions: 
    {
    "Version": "1.1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "workspace:desktops:delete",
                "workspace:desktops:create"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "ecs:servers:create",
                "ecs:servers:get"
            ]
        }
    ]
}
Parent Topic: Using IAM to Grant Access to Workspace