Using IAM Roles or Policies to Allow Access to CAE

Prerequisites

Before granting permissions to user groups, learn about system-defined permissions in role/policy-based authorization for CAE. To grant permissions for other services, learn about all system-defined permissions supported by IAM.

Process Flow

Figure 1 Process for granting CAE permissions

1. On the IAM console, create a user group and grant it permissions.

   Create a user group on the IAM console and grant the CAE ReadOnlyAccess permission to CAE.

2. Create an IAM user and add it to the created user group.

   On the IAM console, create a user and add it to the user group created in 1.

3. Log in as the IAM user and verify permissions.

   In the authorized region, perform the following operations:

   • In Service List, choose Cloud Application Engine. On the CAE console, choose Components > Create Component. If a message appears indicating insufficient permissions after you click Create and Deploy Component, the CAE ReadOnlyAccess policy has taken effect.
   • Choose any other service in Service List. If a message appears indicating insufficient permissions, the CAE ReadOnlyAccess policy has taken effect.

Example Custom Policies

Custom policies supplement the system-defined policies of CAE. Add actions in custom policies as needed. For details about supported actions, see Actions Supported by Policy-based Authorization.

To create a custom policy, choose either visual editor or JSON.

• Visual editor: Select cloud services, actions, resources, and request conditions. This does not require knowledge of policy syntax.
• JSON: Create a JSON policy or edit an existing one.

For operation details, see Creating a Custom Policy. The following lists examples of common CAE custom policies.

• Example 1: Deny the CAE component deletion.

  A policy with only "Deny" permissions must be used together with other policies. If the permissions granted to an IAM user contain both "Allow" and "Deny", the "Deny" permissions take precedence over the "Allow" permissions.

  Assume that you want to grant all CAE system policies to a user but do not want the user to have the permission to delete CAE components. You can create a custom policy for denying CAE component deletion, and attach both policies to the user. As an explicit deny in any policy overrides any allows, the user can perform all operations on CAE components except deleting CAE components. The following is an example of a deny policy:

  {
          "Version": "1.1",
          "Statement": [
                  {
                          "Action": [
                                  "cae:*:*"
                          ],
                          "Effect": "Allow"
                  },
                  {
                          "Action": [
                                  "cae:application:delete"
                          ],
                          "Effect": "Deny"
                  }
          ]
  }

  After authorization, users in the group can verify their permissions using the console or REST APIs.

  The following uses the custom policy as an example to describe how to log in to the CAE console to verify that a user is not allowed to delete components.

  1. Log in to Huawei Cloud as an IAM user.
     • Tenant name: Name of the account used to create the IAM user
     • IAM username and password: Username and password specified during the IAM user creation using the tenant name
  2. On the Components page, create a component for test, and click More > Delete in the Operation column of the component. If a message is displayed indicating that you do not have the operation permissions, the permissions configuration is correct and has taken effect.

• Example 2: Create a custom policy containing multiple actions.

  A custom policy can contain the actions of multiple services that are of the global or project-level type. The following is an example policy containing multiple actions.

  {
          "Version": "1.1",
          "Statement": [
                  {
                          "Action": [
                                  "cae:environment:create"
                                  "cae:application:create"
                                  "cae:component:create"
                                  "ecs:cloudServers:delete"
                                  "ims:images:list"
                                  "ims:serverImages:create"
                          ],
                          "Effect": "Allow"
                  },
          ]
  }