Permissions

If you need to assign different permissions to employees in your enterprise to access your Global Accelerator resources, Identity and Access Management (IAM) is a good choice for fine-grained permissions management. IAM provides identity authentication, permissions management, and access control, helping you securely access your cloud resources. Skip this section if your HUAWEI ID does not require IAM for permissions management.

IAM is a free service. You only pay for the resources in your account.

With IAM, you can control access to specific cloud resources. For example, if you want some software developers in your enterprise to use Global Accelerator resources but do not want them to delete these resources or perform any other high-risk operations, you can grant permission to use Global Accelerator resources but not permission to delete them.

IAM supports role/policy-based authorization and identity policy-based authorization.

The following table describes the differences between the two authorization models.

**Table 1** Differences between role/policy-based and identity policy-based authorization
Name	Authorization Using	Permissions	Authorization Method	Scenario
Role/Policy	User-permission-authorization scope	System-defined roles System-defined policies Custom policies	Assigning roles or policies to principals	To authorize a user, you need to add it to a user group first and then specify the scope of authorization. It is hard to provide fine-grained permissions control using authorization by user groups and a limited number of condition keys. This method is suitable for small- and medium-sized enterprises.
Identity policy	Policies	System-defined identity policies Custom policies	Assigning identity policies to principals Attaching identity policies to principals	You can authorize a user by attaching an identity policy to it. User-specific authorization and a variety of key conditions allow for more fine-grained permissions control. However, this model can be hard to set up. It requires a certain amount of expertise and is suitable for medium- and large-sized enterprises.

Assume that you want to grant IAM users the permissions needed to create ECSs in CN North-Beijing4 and OBS buckets in CN South-Guangzhou. With role/policy-based authorization, the administrator needs to create two custom policies and attach both to the IAM users. With identity policy-based authorization, the administrator only needs to create one custom policy and configure the condition key g:RequestedRegion for the policy, and then attach the policy to the principals or grant the principals the access permissions to the specified regions. Identity policy-based authorization is more flexible than role/policy-based authorization.

Policies and actions in the two authorization models are not interoperable. You are advised to use the role/policy-based authorization model. For details about system-defined permissions, see Role/Policy-based Authorization and Identity Policy-based Authorization.

For more information about IAM, see IAM Service Overview.

Role/Policy-based Authorization

Global Accelerator supports role/policy-based authorization. New IAM users do not have any permissions assigned by default. You need to first add them to one or more groups and attach policies or roles to these groups. The users then inherit permissions from the groups and can perform specified operations on cloud services based on the permissions they have been assigned.

Global Accelerator is a global service for access from any region. You can assign IAM permissions to users in the global service project. In this way, users do not need to switch regions when they access IAM.

Table 2 lists all the system-defined permissions for Global Accelerator. System-defined policies in RBAC and ABAC are not interoperable.

**Table 2** System-defined permissions for Global Accelerator
Role/Policy Name	Description	Type	Dependencies
GA FullAccess	Permissions: all permissions for Global Accelerator Scope: Global-level service	System-defined policy	None
GA ReadOnlyAccess	Permissions: read-only permissions for Global Accelerator Scope: Global-level service	System-defined policy	None

Table 3 lists the common operations supported by each system-defined permission for Global Accelerator.

**Table 3** Common operations supported by system-defined permissions
Operation	GA FullAccess	GA ReadOnlyAccess
Creating a global accelerator	√	×
Viewing a global accelerator	√	√
Modifying a global accelerator	√	×
Deleting a global accelerator	√	×
Adding a listener	√	×
Viewing a listener	√	√
Modifying a listener	√	×
Deleting a listener	√	×
Adding an endpoint group	√	×
Viewing an endpoint group	√	√
Modifying an endpoint group	√	×
Deleting an endpoint group	√	×
Adding an endpoint	√	×
Viewing an endpoint	√	√
Modifying an endpoint	√	×
Removing an endpoint	√	×
Configuring a health check	√	×
Viewing health check settings	√	√
Modifying health check settings	√	×
Disabling a health check	√	×
Deleting health check settings	√	×
Adding tags to a resource	√	×
Querying tags of a specific resource	√	√
Deleting tags from a resource	√	×

Identity Policy-based Authorization

Global Accelerator supports identity policy-based authorization. Table 4 lists all the system-defined policies for Global Accelerator with identity policy-based authorization. System-defined policies in identity policy-based authorization are not interoperable with those in role/policy-based authorization.

**Table 4** System-defined identity policies for Global Accelerator
Policy Name	Description	Type
GAFullAccessPolicy	Full permissions for Global Accelerator	System-defined identity policy
GAReadOnlyPolicy	Read-only permissions for Global Accelerator	System-defined identity policy

Table 5 lists the common operations supported by system-defined identity policies for Global Accelerator.

**Table 5** Common operations supported by system-defined policies
Operation	GAFullAccessPolicy	GAReadOnlyPolicy
Creating a global accelerator	√	×
Viewing a global accelerator	√	√
Modifying a global accelerator	√	×
Deleting a global accelerator	√	×
Adding a listener	√	×
Viewing a listener	√	√
Modifying a listener	√	×
Deleting a listener	√	×
Adding an endpoint group	√	×
Viewing an endpoint group	√	√
Modifying an endpoint group	√	×
Deleting an endpoint group	√	×
Adding an endpoint	√	×
Viewing an endpoint	√	√
Modifying an endpoint	√	×
Removing an endpoint	√	×
Configuring a health check	√	×
Viewing health check settings	√	√
Modifying health check settings	√	×
Disabling a health check	√	×
Deleting health check settings	√	×
Adding tags to a resource	√	×
Querying tags of a specific resource	√	√
Deleting tags from a resource	√	×