Permissions Management

You can use Identity and Access Management (IAM) to manage NAT Gateway permissions and control access to your resources. IAM provides identity authentication, permissions management, and access control.

You can create IAM users for your employees, and assign permissions to these users on a principle of least privilege (PoLP) basis to control their access to specific resource types. For example, you can create IAM users for software developers and assign specific permissions to allow them to use NAT Gateway resources but prevent them from being able to delete resources or perform any high-risk operations.

If your account does not require individual IAM users for permissions management, skip this section.

IAM can be used free of charge. You pay only for the resources in your account. For more information about IAM, see the Identity and Access Management User Guide.

NAT Gateway Permissions

By default, new IAM users do not have any permissions assigned. To assign permissions to these new users, add them to one or more groups, and attach permissions policies or roles to these groups.

NAT Gateway is a project-level service deployed and accessed in specific physical regions. When assigning NAT Gateway permissions to a user group, specify region-specific projects where the permissions will take effect. If you select All projects, the permissions will be granted for all region-specific projects. When accessing NAT Gateway, the users need to switch to a region where they have been authorized to use this service.

You can grant users permissions by using roles and policies.

Roles: A type of coarse-grained authorization mechanism that provides only a limited number of service-level roles. When using roles to grant permissions, you also need to assign dependency roles. However, roles are not an ideal choice for fine-grained authorization and secure access control.

Policies: A type of fine-grained authorization mechanism that defines permissions required to perform operations on specific cloud resources under certain conditions. This mechanism allows for more flexible policy-based authorization for securer access control. For example, you can grant NAT Gateway users only the permissions for managing a certain type of NAT gateways and SNAT rules. Most policies define permissions based on APIs. For the API actions supported by NAT Gateway, see section "Permissions Policies and Supported Actions" in the NAT Gateway API Reference.

Table 1 lists all the system-defined roles and policies supported by NAT Gateway.

**Table 1** System-defined roles and policies supported by NAT Gateway
Policy Name	Description	Type	Dependency
NAT FullAccess	All operations on NAT Gateway resources.	System-defined policy	N/A
NAT ReadOnlyAccess	Read-only permissions for all NAT Gateway resources.	System-defined policy	N/A
NAT Administrator	All operations on NAT Gateway resources.	System-defined role	All operations on NAT Gateway resources. To be granted this permission, users must also have the Tenant Guest permission.

Table 2 lists the common operations supported by each NAT Gateway system policy or role. Select the policies or roles as required.

**Table 2** Common operations supported by each system-defined policy or role of NAT Gateway
Operation	NAT FullAccess	NAT ReadOnlyAccess	NAT Gateway Administrator
Creating a NAT gateway	√	x	√
Querying NAT gateways	√	√	√
Querying NAT gateway details	√	√	√
Updating a NAT gateway	√	x	√
Deleting a NAT gateway	√	x	√
Adding an SNAT rule	√	x	√
Viewing an SNAT rule	√	√	√
Modifying an SNAT rule	√	x	√
Deleting an SNAT rule	√	x	√
Adding a DNAT rule	√	x	√
Viewing a DNAT rule	√	√	√
Modifying a DNAT rule	√	x	√
Deleting a DNAT rule	√	x	√

To add or modify a DNAT rule, your account must have the NAT FullAccess permission or fine-grained permission nat:dnatRules:create/nat:dnatRules:update. After a DNAT rule is configured, add a security group rule to allow the Internet to access servers for which the DNAT rule is configured. Otherwise, the DNAT rule cannot take effect. Therefore, the VPC FullAccess permission or fine-grained permission vpc:securityGroups:create is required.