Help Center/ Cloud Certificate & Manager/ Private Certificate Authority (PCA) User Guide/ Using IAM to Grant Access to PCA/ Using IAM Identity Policies to Grant Access to PCA
Updated on 2026-07-31 GMT+08:00
View PDF
Share

Using IAM Identity Policies to Grant Access to PCA

Use IAM to manage permissions for your PCA resources through Identity policy. With IAM, you can:

  • Create IAM users or user groups for personnel based on your enterprise's organizational structure. Each IAM user has their own identity credentials for accessing PCA resources.
  • Grant only the permissions required for users to perform a task.
  • Entrust a Huawei Cloud account or cloud service to perform professional and efficient O&M on your PCA resources.

If your Huawei Cloud account meets your permissions requirements, you can skip this section.

This section describes how to perform identity policy-based authorization. Figure 1 shows the process.

Prerequisites

Before granting permissions, learn about the PCA permissions and select them as required. For details about the system policies supported by PCA, see Identity Policy Permissions Management. For details about the permissions that can be granted to other services, see System-defined Permissions.

Process Flow

Figure 1 Process of granting PCA permissions
  1. On the IAM console, create an IAM user or create a user group.

    Create a user or user group on the IAM console.

  2. Attach a system identity policy to a user or user group.

    Assign the system-defined identity policy PCAReadOnlyPolicy to the user or user group.

  3. Log in and verify permissions.

    Log in to the console as an authorized user and verify the permissions.

    • Choose Service List > CCM. On the SCM page, click Buy Private CA in the upper right corner to purchase a private CA. If a private CA cannot be purchased (assume that the current permission contains only PCAReadOnlyPolicy), the PCAReadOnlyPolicy policy has already taken effect.
    • Choose another service from Service List. If a message appears indicating that you have insufficient permissions to access the service, the PCAReadOnlyPolicy policy is in effect.

Example Custom Policies

If the system-defined policies of SCM cannot meet your needs, you can create custom identity policies. For details about the actions supported by custom identity policies, see Actions Supported by Identity Policy-based Authorization.

You can create custom identity policies in either of the following ways:

  • Visual editor: Select cloud services, actions, resources, and request conditions without the need to know policy syntax.
  • JSON: Create a JSON policy or edit an existing one.

For details, see Creating a Custom Identity Policy and Attaching It to a Principal.

The following provides examples of custom identity policies for PCA.

  • Example 1: Allow a user to view the private certificate list only. 
    {
    "Version": "5.0",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "pca:cert:list"
            ]
        }
    ]
}
  • Example 2: Defining permissions for multiple services in a policy

    A custom policy can contain the actions of multiple services. The following example grants some PCA and KMS permissions:

    {
    "Version": "5.0",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "scm:cert:list",
                "pca:ca:list",
                "kms:cmk:create"
            ]
        }
    ]
}