Help Center/ Cloud Firewall/ Service Overview/ Permissions Management
Updated on 2024-07-05 GMT+08:00
View PDF
Share

Permissions Management

If you need to assign different permissions to employees in your enterprise to access your CFW resources, Identity and Access Management (IAM) is a good choice for fine-grained permissions management. IAM provides identity authentication, permissions management, and access control, helping you securely manage access to your Huawei Cloud resources.

With IAM, you can use your Huawei Cloud account to create IAM users for your employees, and assign permissions to the users to control their access to specific resource types. For example, if you have software developers and you want to assign them the permission to access CFW but not to delete CFW or its resources, then you can create an IAM policy to assign the developers the permission to access CFW but prevent them from deleting CFW related data.

If your Huawei Cloud account does not require individual IAM users for permissions management, skip this section.

IAM can be used free of charge. You pay only for the resources in your account. For more information about IAM, see What Is IAM?

CFW Permissions

By default, new IAM users do not have any permissions assigned. To assign permissions to these new users, you need add them to one or more groups, and attach permission policies or roles to these groups. Users inherit permissions from the groups to which they are added and can perform specified operations on cloud services.

CFW is a project-level service deployed and accessed in specific physical regions. To assign permissions to a user group, specify the scope as region-specific projects and select projects for the permissions to take effect. If All projects is selected, the permissions will take effect for the user group in all region-specific projects. When accessing CFW, the users need to switch to a region where they have been authorized to use cloud services.

You can grant users permissions by using roles and policies.
  • Roles: a type of coarse-grained authorization mechanism that defines service-level permissions based on user responsibilities. There are only a limited number of roles for granting permissions to users. If one role has a dependency role required for accessing CFW, assign both roles to the users. Roles are not an ideal choice for fine-grained authorization and secure access control.
  • Policies: Policy-based permission management is a type of fine-grained authorization mechanism that grants permissions to perform operations on specific cloud resources. This mechanism allows for more flexible policy-based authorization and secure access control. For example, you can grant HSS users only the permissions for managing a certain type of resources.

Table 1 describes the system roles of CFW.

Table 1 System policies supported by CFW

Role Name

Description

Category

Dependency

CFW FullAccess

All permissions for CFW

System-defined policy

None

CFW ReadOnlyAccess

Read-only permissions for CFW

System-defined policy

None

CFW FullAccess Policy Content

{
    "Version": "1.1",
    "Statement": [
        {
            "Action": [
                "cfw:*:*",
                "vpc:publicIps:list",
                "vpc:publicipTags:get",
                "vpc:vpcs:create",
                "vpc:vpcs:list",
                "vpc:vpcs:get",
                "vpc:subnets:get",
                "vpc:subnets:create",
                "vpc:routeTables:list",
                "vpc:routeTables:update",
                "vpc:quotas:list",
                "er:instances:list",
                "er:attachments:list",
                "er:attachments:create",
                "er:routeTables:list", 
                "er:routes:list",
                "er:associations:list",
                "er:instances:get", 
                "ecs:cloudServers:list",
                "ecs:availabilityZones:list",
                "smn:topic:list",
                "nat:natGateways:list",
                "lts:groups:list",
                "lts:topics:get",
                "dcaas:vgw:list",
                "eps:resources:list",
                "tms:predefineTags:list"
            ],
            "Effect": "Allow"
        }
    ]
}

CFW ReadOnlyAccess Policy Content

{
    "Version": "1.1",
    "Statement": [
        {
            "Action": [
                "cfw:*:list",
                "cfw:*:get",
                "vpc:publicIps:list",
                "vpc:publicipTags:get",
                "vpc:vpcs:list",
                "vpc:vpcs:get",
                "vpc:subnets:get",
                "vpc:routeTables:list",
                "vpc:quotas:list",
                "er:instances:list",
                "er:attachments:list",
               "er:routeTables:list",
               "er:routeTables:list",
               "er:routes:list",
               "er:associations:list",
               "er:instances:get",
                "ecs:cloudServers:list",
                "ecs:availabilityZones:list",
                "smn:topic:list",
                "nat:natGateways:list",
                "lts:groups:list",
                "lts:topics:get",
                "dcaas:vgw:list",
                "eps:resources:list",
                "tms:predefineTags:list"
            ],
            "Effect": "Allow"
        }
    ]
}

Special Permission Policy

Certain CFW functions depend on cloud services such as Elastic Cloud Server (ECS) and Virtual Private Cloud (VPC). Some functions of these cloud services do not support enterprise projects, so some permissions may become invalid after the CFW FullAccess and CFW ReadOnlyAccess system policies are granted to enterprise projects.

To avoid this problem, log in to your Huawei Cloud account to create two system policies. For details, see Creating Custom Policies.

  • For the cloud services that CFW depends on, if they do not support enterprise projects, add the following content to grant permissions to them. For Log Tank Service (LTS), grant all permissions to it on the CFW page. 
    {
    "Version": "1.1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "vpc:quotas:list",
                "vpc:publicipTags:get"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "ecs:availabilityZones:list"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "lts:groups:list",
                "lts:groups:get",
            ]
        }
    ]
}
  • CFW depends on the following global service permissions: 
    {
    "Version": "1.1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "eps:resources:list"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "tms:predefineTags:list"
            ]
        }
    ]
}