Permissions

If you need to assign different permissions to employees in your enterprise to access your Huawei Cloud ROMA Connect resources, IAM is a good choice for fine-grained permissions management. IAM provides identity authentication, permissions management, and access control, helping you secure access to your resources.

With IAM, you can use your Huawei Cloud account to create IAM users for your employees, and assign permissions to the users to control their access to specific resource types. For example, some software developers in your enterprise need to use ROMA Connect resources but should not be allowed to delete them or perform any high-risk operations. In this scenario, you can create IAM users for the software developers and grant them only the permissions required for using ROMA Connect resources.

If your Huawei Cloud account does not need individual IAM users for permissions management, you may skip this chapter.

IAM is free of charge. You pay only for the resources in your account. For more information about IAM, see IAM Service Overview.

ROMA Connect Permissions

By default, new IAM users do not have any permissions assigned. To assign permissions to these new users, add them to one or more groups, and attach permissions policies or roles to these groups.

ROMA Connect is a project-level service deployed and accessed in specific physical regions. To assign permissions to a user group, specify the scope as region-specific projects and select projects for the permissions to take effect. If All projects is selected, the permissions will take effect for the user group in all region-specific projects. When accessing ROMA Connect, the users need to switch to a region where they have been authorized to use this service.

You can grant users permissions by using roles and policies.

Roles: A type of coarse-grained authorization mechanism first provided by IAM to define permissions related to user responsibilities. There are only a limited number of roles for granting permissions to users. When using roles to grant permissions, you may also need to assign other roles on which the permissions depend. However, roles are not an ideal choice for fine-grained authorization and secure access control.
Policies: A type of fine-grained authorization mechanism lately provided by IAM to define permissions required to perform operations on specific cloud resources under certain conditions. This mechanism allows for more flexible policy-based authorization and secure access control. For example, regarding ROMA Connect services, you can grant IAM users only the permissions for managing instance resources. Most policies define permissions based on APIs. For details, see supported actions of fine-grained policies.

Table 1 lists all the system roles supported by ROMA Connect.

**Table 1** ROMA Connect system permissions
Role/Policy Name	Description	Type	Dependency
ROMA FullAccess	Full permissions for ROMA Connect. Users granted these permissions can operate and use all ROMA Connect instances.	System-defined policy	None
ROMA CommonOperations	Common user permissions for ROMA Connect. This does not include permissions to create, modify, and delete instances.	System-defined policy	None
ROMA ReadOnlyAccess	Read-only permissions for ROMA Connect. Users granted these permissions can only view ROMA Connect data.	System-defined policy	None
ROMA Administrator	All permissions for ROMA Connect. Users granted these permissions can operate and use all ROMA Connect instances.	System-defined policy	None

Table 2 lists the common operations supported by each system-defined policy of ROMA Connect. Select the proper system-defined policies as required.

**Table 2** Common operations supported by each system-defined policy or role of ROMA Connect
Operation	ROMA FullAccess	ROMA CommonOperations	ROMA ReadOnlyAccess	ROMA Administrator
Creating a ROMA Connect instance	√	x	x	√
Querying instance information	√	√	√	√
Modifying a ROMA Connect instance	√	x	x	√
Deleting a ROMA Connect instance	√	x	x	√
Operating resources in an instance	√	√	x	√

Integration Application Permissions

ROMA Connect provides strict permissions management for user resources. In one instance, IAM users can view and manage only the integration applications and resources created by themselves. With integration application authorization, IAM users can share applications and resources with other IAM users under the same account.

**Table 3** Application permissions
Permission	FDI	APIC	MQS	LINK
read	View data sources of applications.	View, debug, and export APIs of applications.	View and export topics of applications.	View and export devices, products, and rules of applications, as well as debug devices.
modify	Create and edit data sources of applications.	Create, edit, release, take APIs offline, and import APIs of applications.	Create and edit topics of applications.	Create, edit, and import devices, products, and rules of applications, as well as reset device and product passwords.
delete	Delete data sources of applications.	Delete APIs of applications.	Delete topics of applications.	Delete devices, products, and rules of applications, product properties, device topics, as well as rule data sources and destinations.
access	N/A	Configure authorization, access control, request throttling, and signature key binding for APIs of applications.	Configure permissions for topics of applications.	Deliver commands to and forcibly take offline devices, as well as configure plug-ins for devices that use the OPC UA or Modbus protocol.
admin	Application administrator permissions.

ABM Permissions

Table 4 lists all the system policies or roles supported by ABM.

**Table 4** ABM system permissions
Role/Policy Name	Description	Type	Dependency
ROMA ABM FullAccess	Full permissions for ROMA ABM	System-defined policy	None
ROMA ABM CommonOperations	Common user permissions for ROMA ABM. This does not include permissions to create, modify, and delete instances.	System-defined policy	None
ROMA ABM ReadOnlyAccess	Read-only permissions for ROMA ABM	System-defined policy	None

ROMA Connect Business Flow Permissions

Table 5 shows all system permissions of a business flow.

**Table 5** ROMA Connect business flow permissions
System Policy/Policy Name	Description	Type	Dependency
ROMA BFS CommonOperations	Operation (such as create) permissions	System-defined policy	None
ROMA BFS FullAccess	Administrator permissions	System-defined policy	None
ROMA BFS ReadOnlyAccess	Read-only permissions	System-defined policy	None

ROMA Connect Business Flow Diagram Permissions

ROMA Connect implements strict permission management on service flow diagrams. IAM users can view and manage only the service flow diagrams created by themselves. By default, IAM users cannot view the service flow diagrams created by other IAM users. ROMA Connect business flows can be shared with other IAM users under the same account to view and use.

**Table 6** ROMA Connect business flow diagram permissions
Permission	Business Flow
read	You can view the authorized business flow diagram.
modify	You can modify and save the authorized service flow diagram.
delete	You can delete the authorized business flow diagram.
operate	You can start, stop, restart, and manually schedule the authorized business flow diagram.
admin	Administrator permissions for business flow diagrams.