Creating a User Group and Assigning Permissions
As an administrator, you can create user groups, and grant them permissions by attaching policies or roles. Users you add to the user groups inherit permissions of the policies or roles. IAM provides general permissions (such as administrator or read-only permissions) for each cloud service, which you can assign to user groups. Users in the groups can then use cloud services based on the assigned permissions. For details, see Assigning Permissions to an IAM User. For details about the system-defined permissions of all cloud services, see "Permissions".
Prerequisites
Before creating a user group, learn about the following:
- Understand the basic concepts of permissions.
- Know permissions provided by IAM.
Creating a User Group
- Log in to the IAM console as the administrator.
- On the IAM console, choose User Groups from the navigation pane, and click Create User Group in the upper right corner.
- On the displayed page, enter a user group name.
- Click OK.
You can create a maximum of 20 user groups. To create more user groups, increase the quota by referring to Quotas
Assigning Permissions to a User Group
To assign permissions to a user group, do as follows. To revoke permissions of a user group, see Revoking Permissions of a User Group.
- In the user group list, click Authorize in the row that contains the created user group.
- On the Authorize User Group page, select the permissions to be assigned to the user group and click Next.
If the system-defined policies do not meet your requirements, click Create Policy in the upper right to create custom policies. You can use them to supplement system-defined policies for refined permissions control. For details, see Creating a Custom Policy.
- Specify the scope. The system automatically recommends an authorization scope for the permissions you selected. Table 1 describes all the authorization scopes provided by IAM.
Table 1 Authorization scopes Scope
Description
All resources
IAM users will be able to use all resources, including those in enterprise projects, region-specific projects, and global services under your account based on assigned permissions.
Enterprise projects
IAM users can use the resources in the enterprise projects you select based on the assigned permissions. This option is available only when Enterprise Project is enabled.
For details about enterprise projects, see "Enterprise Management" in the Enterprise Management User Guide.
Region-specific projects
IAM users can use the resources in the region-specific projects you select based on the assigned permissions.
If you have selected global service permissions and specified the scope as Region-specific projects, the global service permissions will be applied to all resources by default. The selected permissions for project-level services will be applied to the region-specific projects you select.
Global services
IAM users can use global services based on the assigned permissions. Global services are deployed with no physical regions specified. IAM users do not need to specify a region when accessing these services, such as Object Storage Service (OBS) and Content Delivery Network (CDN).
If you have selected project-level service permissions and specified the scope as Global services, the project-level service permissions will be applied to all resources by default. The selected permissions for global services will still be applied to the global services you select.
- Click OK.
![](https://support.huaweicloud.com/intl/en-us/my-kualalumpur-1-usermanual-iam/public_sys-resources/note_3.0-en-us.png)
- If you add a user to multiple groups, the user will inherit all the permissions that have been assigned to these groups.
Category |
Policy/Role Name |
Description |
Authorization Scope |
---|---|---|---|
General administration |
FullAccess |
Full permissions for services supporting policy-based access control. |
All |
Resource management |
Tenant Administrator |
Administrator permissions for all services except IAM. |
All |
Viewing resources |
Tenant Guest |
Read-only permissions for all resources. |
All |
IAM user management |
Security Administrator |
Administrator permissions for IAM. |
Global services |
Computing O&M |
ECS FullAccess |
Administrator permissions for ECS. |
Region-specific projects |
CCE FullAccess |
Administrator permissions for Cloud Container Instance (CCI). |
Region-specific projects |
|
BMS FullAccess |
Administrator permissions for Bare Metal Server (BMS). |
Region-specific projects |
|
IMS FullAccess |
Administrator permissions for Image Management Service (IMS). |
Region-specific projects |
|
AutoScaling Admin |
Administrator permissions for Auto Scaling (AS). |
Region-specific projects |
|
Network O&M |
VPC FullAccess |
Administrator permissions for Virtual Private Cloud (VPC). |
Region-specific projects |
ELB FullAccess |
Administrator permissions for Elastic Load Balance (ELB). |
Region-specific projects |
|
Database O&M |
RDS FullAccess |
Administrator permissions for Relational Database Service (RDS). |
Region-specific projects |
DDS FullAccess |
Administrator permissions for Document Database Service (DDS). |
Region-specific projects |
|
DDM FullAccess |
Administrator permissions for Distributed Database Middleware (DDM). |
Region-specific projects |
|
Security O&M |
Anti-DDoS Administrator |
Administrator permissions for Anti-DDoS. |
Region-specific projects |
WAF Administrator |
Administrator permissions for Web Application Firewall (WAF). |
Region-specific projects |
|
VSS Administrator |
Administrator permissions for Vulnerability Scan Service (VSS). |
Region-specific projects |
|
CGS FullAccess |
Administrator permissions for Container Guard Service (CGS). |
Region-specific projects |
|
KMS Administrator |
Administrator permissions for Key Management Service (KMS), which has been renamed Data Encryption Workshop (DEW). |
Region-specific projects |
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot