Introduction

This chapter describes fine-grained permissions management for your ServiceStage. If your account does not need individual Identity and Access Management (IAM) users, then you may skip over this chapter.

By default, new IAM users do not have permissions assigned. You need to add a user to one or more groups, and attach permissions policies or roles to these groups. Users inherit permissions from the groups to which they are added and can perform specified operations on cloud services based on the permissions.

You can grant users permissions by using roles and policies. Roles are a type of coarse-grained authorization mechanism that defines permissions related to user responsibilities. Policies define API-based permissions for operations on specific resources under certain conditions, allowing for more fine-grained, secure access control of cloud resources.

Policy-based authorization is recommended if you want to allow or deny the access to an API.

Your account has all the permissions required to call all APIs, but IAM users under your account must be assigned the required permissions. The permissions required for calling an API are determined by the actions supported by the API. Only users who have been granted permissions allowing the actions can call the API successfully.

Supported Actions

There are two kinds of policies: system-defined policies and custom policies. If the permissions preset in the system do not meet your requirements, administrators can create custom policies and apply these policies to user groups for refined access control. Operations supported by policies are specific to APIs. The following lists common concepts related to policies:

Permissions: Defined by actions in a custom policy.
Actions: Added to a custom policy to control permissions for specific operations.
APIs: REST APIs that can be called in a custom policy.

**Table 1** ServiceStage actions
Permissions	Actions	APIs
Creating an Application	servicestage:app:create	POST /v2/{project_id}/cas/applications
Deleting an Application Based on the Application ID	servicestage:app:delete	DELETE /v2/{project_id}/cas/applications/{application_id}
Modifying Application Information	servicestage:app:modify	PUT /v2/{project_id}/cas/applications/{application_id}
Obtaining All Applications	servicestage:app:list	GET /v2/{project_id}/cas/applications
Obtaining Application Details Based on the Application ID	servicestage:app:get	GET /v2/{project_id}/cas/applications/{application_id}
Querying Static Information About a Microservice	cse:registry:get	GET /v4/{project_id}/registry/microservices/{serviceId}
Querying Static Information About All Microservices	cse:registry:get	GET /v4/{project_id}/registry/microservices
Creating Static Information for a Microservice	cse:registry:modify	POST /v4/{project_id}/registry/microservices
Modifying Static Information About a Microservice	cse:registry:modify	PUT /v4/{project_id}/registry/microservices/{serviceId}/properties
Querying a Microservice Schema	cse:registry:get	GET /v4/{project_id}/registry/microservices/{serviceId}/schemas/{schemaId}
Modifying a Microservice Schema	cse:registry:modify	PUT /v4/{project_id}/registry/microservices/{serviceId}/schemas/{schemaId}
Creating a Dependency Between Services	cse:registry:modify	PUT /v4/{project_id}/registry/dependencies
Querying All Providers of a Microservice	cse:registry:get	GET /v4/{project_id}/registry/microservices/{serviceId}/providers
Querying the Unique Service or Schema ID of a Microservice	cse:registry:get	GET /v4/{project_id}/registry/existence
Registering a Microservice Instance	cse:registry:modify	POST /v4/{project_id}/registry/microservices/{serviceId}/instances
Querying a Microservice Instance Based on Service ID	cse:registry:get	GET /v4/{project_id}/registry/microservices/{serviceId}/instances
Deregistering a Microservice Instance	cse:registry:modify	DELETE /v4/{project_id}/registry/microservices/{serviceId}/instances/{instanceId}
Querying Details About a Microservice Instance	cse:registry:get	GET /v4/{project_id}/registry/microservices/{serviceId}/instances/{instanceId}
Modifying the Extended Information About a Microservice Instance	cse:registry:modify	PUT /v4/{project_id}/registry/microservices/{serviceId}/instances/{instanceId}/properties
Changing the Status of a Microservice Instance	cse:registry:modify	PUT /v4/{project_id}/registry/microservices/{serviceId}/instances/{instanceId}/status
Sending Heartbeat Information	cse:registry:modify	PUT /v4/{project_id}/registry/microservices/{serviceId}/instances/{instanceId}/heartbeat
Querying a Microservice Instance by Filter Criteria	cse:registry:get	GET /v4/{project_id}/registry/instances
Querying Configurations	cse:config:get	GET /v3/{project_id}/configuration/items
Deleting Static Information About a Microservice	cse:registry:modify	DELETE /v4/{project_id}/registry/microservices/{serviceId}
Deleting Static Information About Microservices in Batches	cse:registry:modify	DELETE /v4/{project_id}/registry/microservices
Querying Microservice Instances in Batches	cse:registry:modify	POST /v4/{project_id}/registry/instances/action
Querying All Schema Information About a Microservice	cse:registry:get	GET /v4/{project_id}/registry/microservices/{serviceId}/schemas