Permissions Management

You can use Identity and Access Management (IAM) to manage DMS for RabbitMQ permissions and control access to your resources. IAM provides identity authentication, permissions management, and access control.

You can create IAM users for your employees, and assign permissions to these users on a principle of least privilege (PoLP) basis to control their access to specific resource types. For example, you can create IAM users for software developers and assign specific permissions to allow them to use DMS for RabbitMQ resources but prevent them from being able to delete resources or perform any high-risk operations.

If your HUAWEI ID does not require individual IAM users for permissions management, skip this section.

IAM is free of charge. You pay only for the resources you use. For more information, see IAM Service Overview.

DMS for RabbitMQ Permissions

By default, new IAM users do not have any permissions assigned. To assign permissions to these new users, add them to one or more groups, and attach permissions policies or roles to these groups.

DMS for RabbitMQ is a project-level service deployed and accessed in specific physical regions. When assigning DMS for RabbitMQ permissions to a user group, specify region-specific projects where the permissions will take effect. If you select All projects, the permissions will be granted for all region-specific projects. When accessing DMS for RabbitMQ, the users need to switch to a region where they have been authorized to use this service.

You can grant permissions by using roles and policies.

Roles: A type of coarse-grained authorization mechanism that provides only a limited number of service-level roles. When using roles to grant permissions, you also need to assign dependency roles. However, roles are not an ideal choice for fine-grained authorization and secure access control.
Policies: A fine-grained authorization strategy that defines permissions required to perform operations on specific cloud resources under certain conditions. This mechanism allows for more flexible policy-based authorization for securer access control. For example, you can grant DMS for RabbitMQ users only the permissions for managing a certain type of DMS for RabbitMQ instances. Most policies define permissions based on APIs. For the API actions supported by DMS for RabbitMQ, see Permissions Policies and Supported Actions.

Permissions policies of DMS for RabbitMQ are based on DMS. Therefore, when assigning permissions, select DMS permissions policies.

Table 1 lists all the system-defined roles and policies supported by DMS for RabbitMQ.

**Table 1** System-defined roles and policies supported by DMS for RabbitMQ
Role/Policy Name	Description	Type	Dependency
DMS FullAccess	Administrator permissions for DMS. Users granted these permissions can perform all operations on DMS.	System-defined policy	None
DMS UserAccess	Common user permissions for DMS, excluding permissions for creating, modifying, deleting, and scaling up instances.	System-defined policy	None
DMS ReadOnlyAccess	Read-only permissions for DMS. Users granted these permissions can only view DMS data.	System-defined policy	None
DMS VPCAccess	VPC operation permissions to assign to DMS agencies.	System-defined policies	None
DMS KMSAccess	KMS operation permissions to assign to DMS agencies.	System-defined policies	None
DMS ELBAccess	ELB operation permissions to assign to DMS agencies.	System-defined policies	None
DMS VPCEndpointAccess	VPC endpoint operation permissions to assign to DMS agencies.	System-defined policies	None
DMSAgencyCheckAccessPolicy	IAM operation permissions to assign to DMS agencies.	System-defined policies	None
DMS Administrator	Administrator permissions for DMS.	System-defined role	This role depends on the Tenant Guest and VPC Administrator roles.

Table 2 lists the common operations supported by each DMS for RabbitMQ system policy or role. Select the policies or roles as required.

**Table 2** Common operations supported by system-defined policies
Operation	DMS FullAccess	DMS UserAccess	DMS ReadOnlyAccess	DMS VPCAccess	DMS KMSAccess	DMS ELBAccess	DMS VPCEndpointAccess	DMSAgencyCheckAccessPolicy
Creating an instance	√	×	×	×	×	×	×	×
Modifying instances	√	×	×	×	×	×	×	×
Deleting instances	√	×	×	×	×	×	×	×
Modifying instance specifications	√	×	×	×	×	×	×	×
Querying instance information	√	√	√	×	×	×	×	×