Permissions Management

If you need to assign different permissions to employees in your enterprise to access your ServiceStage resources, IAM is a good choice for fine-grained permissions management. IAM provides identity authentication, permissions management, and access control, helping you secure access to your resources.

With IAM, you can use your cloud service account to create IAM users for your employees, and assign permissions to the users to control their access to specific resource types. For example, some software developers in your enterprise need to use ServiceStage resources but must not delete them or perform any high-risk operations. To achieve this result, you can create IAM users for the software developers and grant them only the permissions required for using ServiceStage resources.

If your cloud service account does not need individual IAM users for permissions management, you may skip over this chapter.

IAM can be used free of charge. For more information about IAM, see IAM Service Overview.

ServiceStage Permissions

By default, new IAM users do not have any permissions assigned. You need to add a user to one or more groups, and assign permissions policies to these groups. The user then inherits permissions from the groups it is a member of. This process is called authorization. After authorization, the user can perform specified operations on ServiceStage based on the granted permissions policies.

ServiceStage is a project-level service deployed and accessed in specific physical regions. To assign ServiceStage permissions to a user group, specify the scope as region-specific projects and select projects for the permissions to take effect. If All projects is selected, the permissions will take effect for the user group in all region-specific projects. When accessing ServiceStage, the users need to switch to a region where they have been authorized to use cloud services.

You can grant users permissions by using roles and policies.

Roles: A type of coarse-grained authorization mechanism that defines permissions related to user responsibilities. This mechanism provides only a limited number of service-level roles for authorization. When using roles to grant permissions, you also need to assign other roles on which the permissions depend to take effect. However, roles are not an ideal choice for fine-grained authorization and secure access control.
Policies are a type of fine-grained authorization mechanism that defines permissions required to perform operations on specific cloud resources under certain conditions. This mechanism allows for more flexible policy-based authorization, meeting requirements for secure access control.

Table 1 lists all the system policies supported by ServiceStage.

**Table 1** Permissions description
Role/Policy Name	Description	Type	Dependencies
ServiceStage FullAccess	Full permissions for ServiceStage.	System-defined policy	None
ServiceStage Developer	ServiceStage developer, who has permissions to perform operations on applications, components, and environments, but does not have permissions to approve applications or create infrastructure. .	System-defined policy	None
ServiceStage ReadOnlyAccess	Read-only permissions for ServiceStage.	System-defined policy	None
CSE Admin	Administrator permissions for CSE.	System-defined policy	None
CSE Viewer	View permissions for CSE.	System-defined policy	None

If these policies do not meet actual requirements, you can customize policies. For more information, see Creating a Custom Policy.

Table 2 lists the common operations supported by each system-defined policy of ServiceStage. Please choose proper system-defined policies according to this table.

**Table 2** Common operations supported by each system policy
Operation	ServiceStage ReadOnlyAccess	ServiceStage Developer	ServiceStage FullAccess	CSE Viewer	CSE Admin
Creating an application	x	√	√	x	x
Modifying an application	x	√	√	x	x
Querying an application	√	√	√	x	x
Deleting an application	x	√	√	x	x
Creating a component	x	√	√	x	x
Searching for a component	√	√	√	x	x
Deploying a component	x	√	√	x	x
Maintaining a component	x	√	√	x	x
Deleting a component	x	√	√	x	x
Creating a build job	x	√	√	x	x
Modifying a build job	x	√	√	x	x
Querying a build job	√	√	√	x	x
Starting a build job	x	√	√	x	x
Deleting a build job	x	√	√	x	x
Creating a pipeline	x	√	√	x	x
Modifying a pipeline	x	√	√	x	x
Querying a pipeline	√	√	√	x	x
Starting a pipeline	x	√	√	x	x
Cloning a pipeline	x	√	√	x	x
Deleting a pipeline	x	√	√	x	x
Creating repository authorization	x	√	√	x	x
Modifying repository authorization	x	√	√	x	x
Querying repository authorization	√	√	√	x	x
Deleting repository authorization	x	√	√	x	x
Creating a microservice engine	x	x	√	x	√
Maintaining a microservice engine	x	x	√	x	√
Querying a microservice engine	√	√	√	√	√
Deleting a microservice engine	x	x	√	x	√
Registering a microservice	√	√	√	x	√
Configuring a microservice	√	√	√	x	√
Governing a microservice	x	√	√	x	√

SWR does not support fine-grained permissions. Related permissions need to be authorized separately.

To use a custom fine-grained policy, log in to the IAM console as an administrator and select the desired fine-grained permissions for ServiceStage, and CSE.

Table 3 describes fine-grained permission dependencies of CSE.
Table 4 describes fine-grained permission dependencies of ServiceStage.

**Table 3** Fine-grained permission dependencies of CSE
Permission Name	Description	Permission Dependency	Application Scenario
cse:engine:list	Lists all microservice engines.	None	Engine list view
cse:engine:get	Views engine information.	cse:engine:list	Engine details view (supported by only exclusive microservice engines)
cse:engine:modify	Modifies an engine.	cse:engine:list cse:engine:get	Engine modification, including enabling or disabling public access, enabling or disabling security authentication, and retrying failed tasks, supported by only exclusive microservice engines
cse:engine:upgrade	Upgrades an engine.	cse:engine:list cse:engine:get	Engine upgrade, including upgrading the engine version supported by only exclusive microservice engines.
cse:engine:delete	Deletes an engine.	cse:engine:list cse:engine:get	Engine deletion (supported by only exclusive microservice engines.)
cse:engine:create	Creates an engine.	cse:engine:get cse:engine:list	Engine creation, including creating an engine and creating a backup or restoration task, supported by only exclusive microservice engines.
cse:config:modify	Modifies configuration and management functions.	cse:engine:list cse:engine:get cse:config:get	Modification on global and governance configurations
cse:config:get	Views configuration and management functions.	cse:engine:list cse:engine:get	Service configuration view
cse:governance:modify	Modifies the governance center.	cse:engine:list cse:engine:get cse:config:get cse:config:modify cse:registry:get cse:registry:modify cse:governance:get	Service governance creation and modification
cse:governance:get	Views the governance center.	cse:engine:list cse:engine:get cse:config:get cse:registry:get	Service governance view
cse:registry:modify	Modifies service registry and management.	cse:engine:list cse:engine:get cse:registry:get	Service modification
cse:dashboard:modify	Modifies the dashboard.	cse:engine:list cse:engine:get cse:registry:get cse:dashboard:get cse:registry:modify	Dashboard modification
cse:dashboard:get	Views the dashboard.	cse:engine:list cse:engine:get cse:registry:get	Dashboard view
cse:registry:get	Views service registry and management.	cse:engine:list cse:engine:get	Service catalog view

The dashboard does not need to be authenticated but requires registry permissions, because it uses the service catalog function to distinguish services.

**Table 4** Fine-grained permission dependencies of ServiceStage
Permission Name	Description	Permission Dependency	Application Scenario
servicestage:app:get	Views application information.	None	Application information view
servicestage:app:create	Creates an application.	None	Application creation
servicestage:app:modify	Updates an application.	None	Application update
servicestage:app:delete	Deletes an application.	None	Application deletion
servicestage:app:list	Views the environment and application list.	None	Environment and application list view
servicestage:environment:create	Creates an environment.	None	Environment creation
servicestage:environment:modify	Updates an environment.	None	Environment update
servicestage:environment:delete	Deletes an environment.	None	Environment deletion
servicestage:pipeline:get	Views pipeline information.	None	Pipeline information view
servicestage:pipeline:create	Creates a pipeline.	None	Pipeline creation
servicestage:pipeline:modify	Modifies a pipeline.	None	Pipeline modification
servicestage:pipeline:delete	Deletes a pipeline.	None	Pipeline deletion
servicestage:pipeline:list	Views the pipeline list.	None	Pipeline list view
servicestage:pipeline:execute	Executes a pipeline.	None	Pipeline execution.
servicestage:assembling:get	Views the build information.	None	Build information view
servicestage:assembling:create	Creates a build job.	None	Build job creation.
servicestage:assembling:modify	Modifies a build job.	None	Build job modification
servicestage:assembling:delete	Deletes a build job.	None	Build job deletion
servicestage:assembling:list	Views the build list.	None	Build list view