Authorization

Scenario

Some HSS functions depend on other cloud service resources. To use these functions, you need to delegate HSS to perform operations on related cloud service resources, such as task scheduling and resource O&M.

Table 1 describes the cloud service resource permissions that HSS needs you to assign.

**Table 1** Required permissions on other cloud service resources
Function	Required Permission	Cloud Service Permission		Usage
Function	Required Permission	Permission	Action	Usage
Container audit (image repository audit)	CTSOperatePolicy	Query audit events	cts:trace:list	Obtain image operation logs (CTS logs of SWR).
Installation and configuration on servers	VPCOperatePolicy	Create a port	vpc:ports:create	Create network interface cards (NICs) and modify security groups to ensure that the port used for installing the agent is accessible.
		Delete a port	vpc:ports:delete
		Create a security group rule	vpc:securityGroupRules:create
		Delete a security group rule	vpc:securityGroupRules:delete
		Query the port list or the details about a port	vpc:ports:get
		Query the network list or the details about a network	vpc:networks:get
		Query the subnet list or the details about a subnet	vpc:subnets:get
	VPCEPOperatePolicy	Create an endpoint	vpcep:endpoints:create	Maintain the network channel between the agent and the HSS cloud protection center (master).
		Query the endpoint list	vpcep:endpoints:list
		Delete an endpoint	vpcep:endpoints:delete
Installation and configuration on containers	CCEOperatePolicy	Query cluster information	cce:cluster:get	Manage the lifecycle of HSS-Daemonset and Configmap in a CCE cluster.
		Query clusters in a project	cce:cluster:list
		Query agencies based on specified conditions	iam:agencies:listAgencies

Assigning Cloud Service Resource Permissions

Log in to the management console.
Click in the upper left corner and select a region or project.
In the upper left corner of the page, click and choose Security > Host Security Service.

In the navigation pane, choose Installation & Configuration > Permissions Management.
Click Assign. The Assign dialog box is displayed.
Select permissions and click OK.

Deleting Cloud Service Resource Permissions

Log in to the management console.
Click in the upper left corner and select a region or project.
In the upper left corner of the page, click and choose Security > Host Security Service.
In the navigation pane, choose Installation & Configuration > Permissions Management.
Locate a permission and click Remove in the Operation column. The Remove Permissions dialog box is displayed.

Alternatively, select multiple permissions and click Remove above the list.
Confirm the permission information, enter DELETE in the dialog box, and click OK.

If the permission is no longer displayed in the permission list, it indicates the permission has been removed.