Permissions Management

If you need to assign different permissions to personnel in your enterprise to access your DMS for RocketMQ resources, Identity and Access Management (IAM) is a good choice for fine-grained permissions management. IAM provides identity authentication, permissions management, and access control, helping you to securely access your Huawei Cloud resources. If your HUAWEI ID does not require individual IAM users for permissions management, you can skip this section.

IAM is a free service. You only pay for the resources in your account.

With IAM, you can control access to specific Huawei Cloud resources. For example, if you want some software developers in your enterprise to use DMS for RocketMQ resources but do not want them to delete RocketMQ instances or perform any other high-risk operations, you can grant permission to use RocketMQ instances but not permission to delete them.

IAM supports role/policy-based authorization and identity policy-based authorization.

The following table describes the differences between these two authorization models.

**Table 1** Differences between role/policy-based and identity policy-based authorization
Authorization Model	Authorization Using	Permissions	Authorization Method	Scenario
Role/Policy	User-permission-authorization scope	System-defined role System-defined policy Custom policies	Assigning roles or policies to principals	To authorize a user, you need to add it to a user group first and then specify the scope of authorization. It provides a limited number of condition keys and cannot meet the requirements of fine-grained permissions control. This method is suitable for small- and medium-sized enterprises.
Identity policy	User-policy	System-defined identity policies Custom identity policies	Assigning identity policies to principals Attaching identity policies to principals	You can authorize a user by attaching an identity policy to it. User-specific authorization and a variety of key conditions allow for more fine-grained permissions control. However, this model can be hard to set up. It requires a certain amount of expertise and is suitable for medium- and large-sized enterprises.

Assume that you want to grant IAM users permission to create ECSs in AP-Bangkok and OBS buckets in AP-Singapore. With role/policy-based authorization, the administrator needs to create two custom policies and assign both to the IAM users. With identity policy-based authorization, the administrator only needs to create one custom policy, configure the condition key g:RequestedRegion for the policy, and then attach the policy to the users or grant the users the access permissions to the specified regions. Identity policy-based authorization is more flexible than role/policy-based authorization.

Policies/identity policies and actions in the two authorization models are not interoperable. You are advised to use the identity policy-based authorization model. For details about system-defined permissions, see Role/Policy-based Authorization and Identity Policy-based Authorization.

For more information about IAM, see What Is IAM?.

Role/Policy-based Authorization

DMS for RocketMQ supports role/policy-based authorization. New IAM users do not have any permissions assigned by default. You need to first add them to one or more groups and attach policies or roles to these groups. The users then inherit permissions from the groups and can perform specified operations on cloud services based on the permissions they have been assigned.

DMS for RocketMQ is a project-level service deployed for specific regions. When you set Scope to Region-specific projects and select the specified projects (for example, ap-southeast-2) in the specified regions (for example, AP-Bangkok), the users only have permissions for resources in the selected projects. If you set Scope to All resources, the users have permissions for resources in all region-specific projects. When accessing DMS for RocketMQ, the users need to switch to the authorized region.

Table 2 lists all the system-defined permissions for DMS for RocketMQ. System-defined policies and system-defined identity policies in the two authorization models are not interoperable.

**Table 2** System-defined permissions for DMS for RocketMQ
Role/Policy Name	Description	Type	Dependencies
DMS FullAccess	Administrator permissions for DMS. Users with these permissions can perform all operations on DMS.	System-defined policy	None
DMS UserAccess	Common user permissions for DMS, excluding permissions for creating, modifying, deleting, and scaling up instances.	System-defined policy	None
DMS ReadOnlyAccess	Read-only permissions for DMS. Users granted these permissions can only view DMS data.	System-defined policy	None
DMS Administrator	Administrator permissions for DMS.	System-defined role	Tenant Guest and VPC Administrator roles, which must be attached in the same project as the DMS Administrator role
DMS VPCAccess	VPC operation permissions to assign to DMS agencies.	System-defined policy	None
DMS KMSAccess	KMS operation permissions to assign to DMS agencies.	System-defined policy	None
DMS ELBAccess	ELB operation permissions to assign to DMS agencies.	System-defined policy	None
DMS VPCEndpointAccess	VPC endpoint operation permissions to assign to DMS agencies.	System-defined policy	None
DMSAgencyCheckAccessPolicy	IAM operation permissions to assign to DMS agencies.	System-defined policy	None
DMS BSSAccess	BSS operation permissions to assign to DMS agencies.	System-defined policy	None

Table 3 lists the common operations supported by system-defined permissions for DMS for RocketMQ.

**Table 3** Common operations supported by each system-defined policy or role of RocketMQ instances
Operation	DMS FullAccess	DMS UserAccess	DMS ReadOnlyAccess	DMS VPCAccess	DMS KMSAccess	DMS ELBAccess	DMS VPCEndpointAccess	DMSAgencyCheckAccessPolicy	DMS BSSAccess
Creating an instance	√	×	×	×	×	×	×	×	×
Modifying an instance	√	×	×	×	×	×	×	×	×
Deleting an instance	√	×	×	×	×	×	×	×	×
Modifying instance specifications	√	×	×	×	×	×	×	×	×
Restarting an instance	√	√	×	×	×	×	×	×	×
Querying instance information	√	√	√	×	×	×	×	×	×

Identity Policy-based Authorization

DMS for RocketMQ supports identity policy-based authorization. Table 4 lists all the system-defined identity policies for DMS for RocketMQ. System-defined policies in identity policy-based authorization are not interoperable with those in role/policy-based authorization.

**Table 4** System-defined identity policies for DMS for RocketMQ
Policy Name	Description	Type
DMSReadOnlyAccessPolicy	Read-only permissions for DMS	System-defined identity policies
DMSUserAccessPolicy	Common user permissions for DMS, excluding permissions for creating, modifying, deleting, and scaling up instances.	System-defined identity policies
DMSFullAccessPolicy	Full permissions for DMS	System-defined identity policies

Table 5 lists the common operations supported by system-defined policies for DMS for RocketMQ.

**Table 5** Common operations supported by system-defined policies of RocketMQ instances
Operation	DMSReadOnlyAccessPolicy	DMSUserAccessPolicy	DMSFullAccessPolicy
Creating an instance	×	×	√
Modifying an instance	×	×	√
Deleting an instance	×	×	√
Modifying instance specifications	×	×	√
Restarting an instance	×	√	√
Querying instance information	√	√	√