Creating a User and Granting Permissions for CBH Instances to It

To implement fine-grained permissions control for your CBH resources, Identity and Access Management (IAM) is exactly what you need. With IAM, you can:

Create IAM users for employees based on the organizational structure of your enterprise. Each IAM user has their own security credentials, providing access to CBH resources.
Grant only the permissions required for users to perform a task.
Entrust an account or cloud service to perform professional and efficient O&M on your CBH resources.

If your account does not require individual IAM users, skip over this section.

This section describes the procedure for granting permissions. Figure 1 shows the process.

Prerequisites

Learn about the permissions supported by CBH and choose policies or roles based on your requirements. For more details, see Permissions Management of CBH Instances.

Authorization Process

Figure 1 Process for granting permissions

Create a user group and assign permissions.
Create a user group on the IAM console, and attach the CBH ReadOnlyAccess policy to the group.
Creating an IAM User.
Create a user on the IAM console and add the user to the group created in 1.
Log in and verify permissions.
Log in to the CBH console by using the created user, and verify that the user only has read permissions for CBH.
- Choose Service List > Cloud Bastion Host. On the displayed page, click Purchase CBH Instance. If a message is displayed indicating that you do not have the permission to purchase the CBH instance (assume that the current permission contains only CBH ReadOnlyAccess), the CBH ReadOnlyAccess policy has taken effect.
- Choose any other service in Service List. (Assume that the current permission contains only CBH ReadOnlyAccess). If a message appears indicating that you have insufficient permissions to access the service, the CBH ReadOnlyAccess policy has already taken effect.