Permissions Management

KooPhone Rights

New IAM users do not come with default permissions, so add them to one or more groups and then attach policies or roles to these groups to grant specific operation permissions on cloud services.

VIAS is a project-level service deployed and accessed in specific physical regions. When granting permissions, set Scope to Regional-level projects and set permissions in the cn-north-4 project corresponding to the specified region (for example, CN North-Beijing4). The permissions take effect only for this project. If you set permissions for All projects, the permissions will take effect for all region-specific projects. When accessing KooPhone, the users need to switch to the authorized region.

You can grant permissions to a role or by creating a policy.

• Roles: A coarse-grained authorization strategy that defines permissions by job responsibility. Available service-level roles are limited. When using roles to grant permissions, you need to also assign other roles which the permissions depend on to take effect. Roles are not an ideal choice for fine-grained authorization and secure access control.
• Policies: A fine-grained authorization strategy that defines permissions required to perform operations on specific cloud resources under certain conditions. This mechanism enables more flexible authorization and meets secure access control requirements. For example, for KooPhone, the administrator can control IAM users to perform specified operations only on a certain module.

Table 1 lists all the system roles supported by KooPhone.

Table 2 lists the common operations supported by system-defined permissions for KooPhone.

References

• Identity and Access Management (IAM) Service Overview
• For details about how to create a user group and user and grant KooPhone permissions, see "Permissions Management" in the User Guide.

Content of the KooPhone Administrator Role

{ 
        "Version": "1.1",
        "Statement": [ { 
            "Effect": "Allow",
             "Action": [ 
                 "Koophone:*:*" 
             ] 
         }] 
      }
   }
}

Content of the KooPhone ReadOnlyUser Role

{ 
        "Version": "1.1",
        "Statement": [ 
            {  
                 "Action": [ 
                     "Koophone:*get*",
                     "Koophone:*list*"
                 ], 
                 "Effect": "Allow",
             } 
          ] 
       }
    }
}