Permissions Management

If you need to assign different permissions to employees in your enterprise to access your DBSS resources, Identity and Access Management (IAM) is a good choice for fine-grained permissions management. IAM provides identity authentication, fine-grained permissions management, and access control. IAM helps you secure access to your Huawei Cloud resources. If your Huawei account works good for you and you do not need an IAM account to manage user permissions, then you may skip over this chapter.

IAM is a free service. You only pay for the resources in your account.

With IAM, you can control access to specific Huawei Cloud resources. For example, some developers in your enterprise need to use DBSS but you do not want them to have permissions to high-risk operations such as deleting DBSS. To achieve such purpose, you can use IAM to grant them only the permissions to use DBSS, but not delete DBSS. With IAM, you can control their usage of DBSS resources.

IAM supports role/policy-based authorization and identity policy-based authorization.

The following table describes the differences between these two authorization models.

**Table 1** Differences between the two types of authorization
Name	Core Relationship	Permissions	Authorization Method	Application Scenario
Role/Policy-based Authorization	User-permission-authorization scope	System-defined role System-defined policy Custom policy	Assigning roles or policies to principals	To authorize a user, you need to add it to a user group first and then specify the scope of authorization. It provides a limited number of condition keys and cannot meet the requirements of fine-grained permissions control. This method is suitable for small- and medium-sized enterprises.
Identity Policy-based Authorization	User-policy	System-defined identity policies Custom identity policies	Assigning identity policies to principals Attaching identity policies to principals	You can authorize a user by attaching an identity policy to it. User-specific authorization and a variety of key conditions allow for more fine-grained permissions control. However, this model can be hard to set up. It requires a certain amount of expertise and is suitable for medium- and large-sized enterprises.

Assume that you want to grant IAM users permission to create ECSs in CN North-Beijing4 and OBS buckets in CN South-Guangzhou. With role/policy-based authorization, the administrator needs to create two custom policies and assign both to the IAM users. With identity policy-based authorization, the administrator only needs to create one custom identity policy and configure the condition key g:RequestedRegion for the policy, and then attach the policy to the users or grant the users the access permissions to the specified regions. Identity policy-based authorization is more flexible than role/policy-based authorization.

Policies/identity policies and actions in the two authorization models are not interoperable. You are advised to use the identity policy-based authorization model.

For more details, see IAM Service Overview.

Role/Policy-based Permissions Management

DBSS supports role/policy-based authorization. New IAM users do not have any permissions assigned by default. You need to first add them to one or more groups and then attach policies or roles to these groups. The users then inherit permissions from the groups and can perform specified operations on cloud services based on the permissions they have been assigned.

DBSS is a project-level service deployed and accessed in specific physical regions. When you set Scope to Region-specific projects and select the specified projects (for example, ap-southeast-2) in the specified regions (for example, AP-Bangkok), the users only have permissions for ECSs in the selected projects. If you set Scope to All resources, the users have permissions for ECSs in all region-specific projects. When accessing DBSS, the users need to switch to a region where they have been authorized to use cloud services.

Table 2 lists all the system-defined permissions for DBSS. System-defined policies in role/policy-based authorization are not interoperable with those in identity policy-based authorization.

**Table 2** DBSS system permissions and roles
Role/Policy Name	Description	Dependency
DBSS System Administrator (DBSS system administrator, who has the permissions to perform operations on DBSS system resources)	Users with this set of permissions can perform the following operations on database audit: Purchasing an instance Starting, disabling, and restarting an instance Obtaining the instance list Obtaining the basic information of an instance Obtaining the audit statistics Obtaining the monitoring information Obtaining the operation logs Managing databases Managing agents Configuring email notifications Backup and restoration	To perform payment operations (for example, purchasing or renewing a DBSS instance), you must have the BSS Administrator, VPC Administrator, and ECS Administrator roles. VPC Administrator: Users with this set of permissions can perform all execution permission for VPC. It is a project-level role, which must be assigned in the same project. BSS Administrator: Users with this set of permissions can perform any operation on menu items on pages My Account, Billing Center, and Resource Center. It is a project-level role, which must be assigned in the same project. ECS Administrator: Users with this set of permissions can perform any operations on an ECS. It is a project-level role, which must be assigned in the same project.
DBSS Audit Administrator (DBSS audit administrator, who has the permissions to check DBSS security logs)	Users with this set of permissions can perform the following operations on database audit: Obtaining the instance list Obtaining the basic information of an instance Obtaining the audit statistics Obtaining the report results Obtaining the rule information Obtaining the statement information Obtaining the session information Obtaining the monitoring information Obtaining the operation logs Obtaining the database list Managing reports	None
DBSS Security Administrator (DBSS security administrator, who has the permissions to set DBSS security policies)	Users with this set of permissions can perform the following operations on database audit: Obtaining the instance list Obtaining the basic information of an instance Obtaining the audit statistics Obtaining the report results Obtaining the rule information Obtaining the statement information Obtaining the session information Obtaining the monitoring information Obtaining the operation logs Obtaining the database list Configuring audit rules Configuring alarm notifications Managing reports	None

Table 3 lists the common operations supported by each system-defined permission of DBSS. Select the permissions as needed.

**Table 3** Common operations supported by system-defined permissions
Service	Operation	DBSS System Administrator	DBSS Audit Administrator	DBSS Security Administrator
Database audit	Purchasing an instance	√	×	×
	Starting, disabling, and restarting an instance	√	×	×
	Obtaining the instance list	√	√	√
	Obtaining the basic information of an instance	√	√	√
	Obtaining the audit statistics	√	√	√
	Obtaining the monitoring information	√	√	√
	Obtaining the operation logs	√	√	√
	Managing databases	√	×	×
	Managing agents	√	×	×
	Configuring email notifications	√	×	×
	Backup and restoration	√	×	×
	Obtaining the report results	√	√	√
	Obtaining the rule information	√	√	√
	Obtaining the statement information	√	√	√
	Obtaining the session information	√	√	√
	Obtaining the database list	√	√	√
	Managing Reports	×	√	×
	Configuring audit rules	×	×	√
	Configuring alarm notifications	×	×	√