Using IAM Roles or Policies to Grant Access to CNAD

Prerequisites

Before assigning permissions to a user group, you need to understand the CNAD permissions that can be added to the user group and select appropriate permissions. If you need to assign permissions for services other than CNAD, see System-defined Policies/Roles.

Process

Figure 1 Process for granting CNAD permissions

1. Creating a User Group and Assigning Permissions

   Create a user group on the IAM console, and assign the CNAD ReadOnlyAccess policy to the group.

2. Creating an IAM User

   On the IAM console, create an IAM user and add it to the user group created in 1.

3. Log in and verify the user's permissions.

   In the authorized region, perform the following operations:

   • Choose Service List > Anti-DDoS Service > Advanced Anti-DDoS. Then click Buy AAD on the Instances tab page. If a message appears indicating insufficient permissions, the CNAD ReadOnlyAccess policy has already taken effect.
   • Choose any other service in the Service List. (Assume that the current policy contains only CNAD ReadOnlyAccess.) If a message appears indicating insufficient permissions, the CNAD ReadOnlyAccess policy has already taken effect.

Example of Custom CNAD Policies

Custom policies can be created to supplement the system-defined policies of CNAD. Add actions in custom policies as needed. For details about supported actions, see Supported Actions in ABAC.

You can create custom policies in either of the following ways:

• Visual editor: Select cloud services, actions, resources, and request conditions. This does not require knowledge of policy syntax.
• JSON: Edit JSON policies from scratch or based on an existing policy.

For details, see Creating a Custom Policy. The following lists examples of common CNAD custom policies.

• Example 1: Granting a user the permission to query policy details

  {
      "Version": "1.1",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "cnad:policy:get"
              ]
          }
      ]
  }

• Example 2: Denying the permission to delete alarm notifications

  A deny policy must be used together with other policies. If the policies assigned to a user contain both Allow and Deny actions, the Deny actions take precedence over the Allow actions.

  If you have granted the system policy CNAD Administrator to a user but do not want the user to have the permission to delete CNAD alarm notifications, you can create a custom policy that denies the deletion of CNAD alarm notifications and grant it to the user. Then, the user can perform all operations on CNAD except deleting alarm notifications. The following is an example of a deny policy:

  {
      "Version": "1.1",
      "Statement": [
          {
              "Effect": "Deny",
              "Action": [
                  "cnad:alarmConfig:delete"
              ]
          }
      ]
  }

• Example 3: Defining actions for multiple services in a policy

  A custom policy can contain the actions of multiple services that are of the global or project-level type. An example is as follows.

  {
      "Version": "1.1",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "cnad:alarmConfig:delete"
              ]
          },
          {
              "Effect": "Allow",
              "Action": [
                  "tms:resourceTags:list"
              ]
          }
      ]
  }