Permissions

If you need to grant your enterprise personnel permission to access your SMN resources, use Identity and Access Management (IAM). IAM provides identity authentication, fine-grained permissions management, and access control. IAM helps you secure access to your Huawei Cloud resources. If your HUAWEI ID does not require IAM for permissions management, you can skip this section.

IAM is free. You only pay for the resources in your account.

With IAM, you can control access to specific Huawei Cloud resources. For example, if you want some software developers in your enterprise to use SMN resources but do not want them to delete the resources or perform any other high-risk operations, you can grant permissions to use the resources but not permissions to delete them.

IAM supports role/policy-based authorization and identity policy-based authorization.

The following table describes the differences between these two authorization models.

**Table 1** Differences between role/policy-based authorization and identity policy-based authorization
Authorization Model	Core Relationship	Permissions	Authorization Method	Description
Role/Policy	User-permission-authorization scope	System-defined roles System-defined policies Custom policies	Assigning roles or policies to principals	To authorize a user, you need to add it to a user group first and then specify the scope of authorization. It is hard to provide fine-grained permissions control using authorization by user groups and a limited number of condition keys. This method is suitable for small- and medium-sized enterprises.
Identity policy	User-policy	System-defined identity policies Custom identity policies	Assigning identity policies to principals Attaching identity policies to principals	You can authorize a user by attaching an identity policy to it. User-specific authorization and a variety of key conditions allow for more fine-grained permissions control. However, this model can be hard to set up. It requires a certain amount of expertise and is suitable for medium- and large-sized enterprises.

Assume that you want to grant IAM users the permissions needed to create ECSs in CN North-Beijing4 and OBS buckets in CN South-Guangzhou. With role/policy-based authorization, the administrator needs to create two custom policies and assign both to the IAM users. With identity policy-based authorization, the administrator only needs to create one custom identity policy and configure the condition key g:RequestedRegion for the policy, and then attach the policy to the users or grant the users the access permissions to the specified regions. Identity policy-based authorization is more flexible than role/policy-based authorization.

Policies/identity policies and actions in the two authorization models are not interoperable. You are advised to use the identity policy-based authorization model. For details about system-defined permissions, see Role/Policy-based Authorization and Identity Policy-based Authorization.

For more information about IAM, see IAM Service Overview.

Role/Policy-based Authorization

SMN supports authorization with roles and policies. By default, new IAM users do not have any permissions assigned. You need to add them to one or more groups and attach policies or roles to these groups. The users then inherit permissions from the groups and can perform specified operations on cloud services based on the permissions they have been assigned.

SMN is a project-level service deployed for specific regions. When you set Scope to Region-specific projects and select the specified projects (for example, ap-southeast-2) in the specified regions (for example, AP-Bangkok), the users only have permissions for VPC Endpoint resources in the selected projects. If you set Scope to All resources, the users have permissions for VPC Endpoint resources in all region-specific projects. When accessing SMN, the users need to switch to a region where they have been authorized to use this service.

Table 2 lists all the system-defined permissions for SMN. System-defined policies and system-defined identity policies in the two authorization models are not interoperable.

**Table 2** SMN system-defined permissions
Role/Policy	Description	Type	Dependency
SMN Administrator	Administrator permissions for SMN. Users with these permissions can perform all operations on SMN.	System-defined roles	The Tenant Guest and SMN Administrator roles need to be assigned in the same project.
SMN FullAccess	Administrator permissions for SMN. Users with these permissions can perform all operations on SMN.	System-defined policies	None
SMN ReadOnlyAccess	Read-only permissions for SMN. Users granted these permissions can only view SMN data.	System-defined policies	None

Table 3 lists the common operations supported by SMN system-defined permissions.

**Table 3** Common operations supported by each system-defined policy
Operation	SMN Administrator	SMN FullAccess	SMN ReadOnlyAccess
Creating a topic	√	√	×
Updating a topic	√	√	×
Deleting a topic	√	√	×
Querying topics	√	√	√
Adding a subscription to a topic	√	√	×
Adding a tag to a topic	√	√	×
Configuring a topic policy	√	√	×
Publishing a message	√	√	×
Adding a subscription	√	√	×
Requesting subscription confirmation	√	√	×
Canceling a subscription	√	√	×
Deleting a subscription	√	√	×
Querying subscriptions	√	√	√
Creating a message template	√	√	×
Modifying a message template	√	√	×
Deleting a message template	√	√	×
Querying a message template	√	√	√

Identity Policy-based Authorization

SMN supports authorization with identity policies. Table 4 lists all the system-defined identity policies for SMN. System-defined identity policies and system-defined policies in the two authorization models are not interoperable.

**Table 4** System-defined identity policies for SMN
Identity Policy Name	Description	Type
SMNFullAccessPolicy	Full permissions for SMN	System-defined identity policies
SMNReadOnlyPolicy	Read-only permissions for SMN	System-defined identity policies

Table 5 lists common operations supported by system-defined identity policies for SMN.

**Table 5** Common operations supported by system-defined identity policies of SMN
Operation	SMNFullAccessPolicy	SMNReadOnlyPolicy
Querying topics	√	√
Creating a topic	√	x
Querying details of a topic	√	√
Updating a topic	√	x
Deleting a topic	√	x
Querying a topic policy	√	√
Deleting all topic policies	√	x
Updating a topic policy	√	x
Deleting a topic policy	√	x
Querying subscriptions	√	√
Querying subscriptions of a topic	√	√
Adding a subscription	√	x
Canceling a subscription	√	x
Updating a subscription	√	x
Importing subscribers	√	x
Querying message templates	√	√
Creating a message template	√	x
Querying details of a message template	√	√
Modifying a message template	√	x
Deleting a message template	√	x
Publishing a message	√	x
Publishing a detection message	√	x
Obtaining the HTTP detection result	√	√
Querying resources by tag	√	x
Batch adding or deleting resource tags	√	x
Querying resource tags	√	√
Adding a resource tag	√	x
Query project tags	√	√
Deleting tags from a resource	√	x
Querying all SMN API versions	√	√
Querying the version of SMN API v2	√	√
Binding a cloud log to a topic	√	x
Querying a cloud log	√	√
Updating a cloud log	√	x
Unbinding a cloud log from a topic	√	x
Creating message filter policies for a subscriber	√	x
Updating message filter policies of subscribers	√	x
Deleting message filter policies of subscribers	√	x