Help Center/ Anti-DDoS Service/ User Guide/ CNAD Basic (Anti-DDoS) User Guide/ Using IAM to Grant Anti-DDoS Permissions/ Using IAM Identity Policies to Grant Access to Anti-DDoS
Updated on 2026-09-15 GMT+08:00
View PDF
Share

Using IAM Identity Policies to Grant Access to Anti-DDoS

You can use IAM to manage permissions for Anti-DDoS. With IAM, you can:

  • Create IAM users or user groups for personnel based on your enterprise's organizational structure. Each IAM user has their own identity credentials for accessing ECS resources.
  • Grant only the permissions required for users to perform a task.
  • Entrust another Huawei Cloud account or cloud service to perform professional and efficient O&M to your Anti-DDoS resources.

If your Huawei Cloud account meets your permissions requirements, you can skip this section.

Figure 1 shows the process flow of identity policy-based authorization.

Prerequisites

Before granting permissions, learn about the Anti-DDoS permissions and select them as required. For details about the system-defined identity policies supported by Anti-DDoS, see Actions Supported by Identity Policy-based Authorization. For more information about the permissions supported by other services, see Actions Supported by Identity Policy-based Authorization.

Process

Figure 1 Process for granting Anti-DDoS permissions
  1. Creating a User or Creating a User Group

    Log in to the IAM console to create a user or user group.

  2. Attach a system identity policy to a user or user group.

    Assign the Anti-DDoSReadOnlyPolicy system identity policy of the read-only permission to a user or user group, or attach the identity policy to a user or user group.

  3. Log in and verify the user's permissions.

    Log in to the console as an authorized user and test the permissions.

    • Log in to the AAD console, locate the row that contains the public IP address, click Set Protection, and set the traffic cleaning threshold. If the threshold cannot be set, the Anti-DDoSReadOnlyPolicy policy has taken effect.
    • Select any service except Anti-DDoS (assume that the current policy contains only Anti-DDoSReadOnlyPolicy). If the system displays that you have insufficient permissions to access the service, the Anti-DDoS ReadOnlyAccess policy has taken effect.

Example of a Custom Anti-DDoS Identity Policies

You can create custom identity policies to supplement the system-defined identity policies of Anti-DDoS. For details about the actions supported by custom identity policies, see Actions Supported by Identity Policy-based Authorization.

You can create custom identity policies in either of the following ways:

  • Visual editor: Select cloud services, actions, resources, and request conditions without the need to know policy syntax.
  • JSON: Edit JSON policies from scratch or based on an existing policy.

For details, see Creating a Custom Identity Policy and Attaching It to a Principal.

The following provides examples of custom Anti-DDoS identity policies.

  • Example 1: Grant the permission to query Anti-DDoS. 
    {    "Version": "5.0",    "Statement": [        {            "Effect": "Allow",            "Action": [                "anti-ddos:ip:getDefensePolicy"            ]        }    ]}
  • Example 2: Create a custom policy containing multiple actions.

    A custom identity policy can contain the actions of multiple services. The example is as follows:

    {    "Version": "5.0",    "Statement": [        {            "Effect": "Allow",            "Action": [                "waf:host:get"            ]        },        {            "Effect": "Allow",            "Action": [                "anti-ddos:ip:getDefensePolicy"            ]        }    ]}
Parent Topic: Using IAM to Grant Anti-DDoS Permissions