Introduction

If you need to assign different permissions to employees in your enterprise to access your Cost Center, Identity and Access Management (IAM) is a good choice for fine-grained permissions management.

IAM is a free service. You only pay for the resources in your account. For more information about IAM, see IAM Service Overview.

System-Defined Roles

New IAM users do not have any permissions assigned by default. You need to first add them to one or more groups and attach policies or roles to these groups. The users then inherit permissions from the groups and can perform specified operations on cloud services based on the permissions they have been assigned. IAM provides frequently used roles that have permissions to access different services, and you have the permissions granted to these roles.

You can grant users permissions by using roles and policies.

Roles: A coarse-grained authorization strategy provided by IAM to assign permissions based on users' job responsibilities. Only a limited number of service-level roles are available for authorization. Huawei Cloud services depend on each other. When you grant permissions using roles, you also need to attach dependent roles. Roles are not ideal for fine-grained authorization and least privilege access.
Policies: A fine-grained authorization strategy that defines permissions required to perform operations on specific cloud resources under certain conditions. This type of authorization is more flexible and is ideal for least privilege access.

Table 1 lists all the system-defined roles for Cost Center.

**Table 1** System-defined roles
Role Name	Permissions
BSS Administrator	Full permissions for Cost Center. This role is generally granted to the administrator.
BSS ReadonlyAccess	Read-only permissions for Billing Center, Cost Center, and Message Center.
BSS FinanceAccess	Billing Center's financial administrator, who has full permissions for financial operations.

Table 2 lists the common operations supported by system-defined permissions for Cost Center.

**Table 2** Common operations supported by system-defined permissions
Function	BSS Administrator	BSS ReadonlyAccess	BSS FinanceAccess
Viewing budget reports, including the budget report list and report details	Supported	Supported	Supported
Viewing cost monitors and anomalies	Supported	Supported	Supported
Viewing cost anomaly notifications	Supported	Supported	Supported
Viewing cost analyses	Supported	Supported	Supported
Exporting cost data, including analysis results, cost details, and budgets	Supported	Not supported	Supported
Analyzing utilization and coverage of savings plans	Supported	Supported	Supported
Evaluating cost optimization option of changing pay-per-use to yearly/monthly	Supported	Supported	Supported
Viewing cost tags	Supported	Supported	Supported
Viewing cost optimization subscriptions	Supported	Supported	Supported
Viewing a list of cost reports	Supported	Supported	Supported
Viewing the task list for exporting cost details to OBS	Supported	Supported	Supported
Viewing the analysis of RI utilization and coverage	Supported	Supported	Supported
Viewing cost optimization summary	Supported	Supported	Supported
Viewing the percentage of costs that are allocated	Supported	Supported	Supported
Viewing maturity scores	Supported	Supported	Supported
Viewing savings plans	Supported	Supported	Supported
Viewing bills, monthly costs, usage details, cost management, expenditures and revenues, and cost trends	Supported	Supported	Supported
Viewing budget information, including the budget list and budget details	Supported	Supported	Supported
Viewing parameter settings for Cost Center	Supported	Not supported	Not supported
Obtaining recommendations for savings plans	Supported	Not supported	Supported
Viewing cost category information, including the cost category list and the details of each cost category	Supported	Supported	Supported
Exporting bills, monthly costs, and usage details, and creating, deleting, modifying, exporting cost reports, and exporting income and revenues	Supported	Not supported	Supported
Disabling functions	Supported	Not supported	Supported
Enabling Cost Center	Supported	Not supported	Supported
Setting parameters for Cost Center	Supported	Not supported	Not supported
Deleting cost monitors	Supported	Not supported	Supported
Enabling functions	Supported	Not supported	Supported
Configuring cost categories, including creating and editing cost categories	Supported	Not supported	Supported
Managing cost reports, including creating, modifying, and deleting custom reports.	Supported	Not supported	Supported
Activating or deactivating cost tags	Supported	Not supported	Supported
Creating and modifying cost monitors	Supported	Not supported	Supported
Creating cost anomaly notifications	Supported	Not supported	Supported
Deleting cost categories	Supported	Not supported	Supported
Deleting budget reports	Supported	Not supported	Supported
Managing budgets, including creating, modifying, and deleting budgets	Supported	Not supported	Supported
Configuring cost optimization subscriptions	Supported	Not supported	Supported
Creating and modifying budget reports	Supported	Not supported	Supported
Creating, modifying, or deleting tasks for exporting cost details to OBS	Supported	Not supported	Supported

Creating a Custom Policy

You can create custom policies to supplement the system-defined roles. For details about the actions supported by custom policies, see Table 3.

**Table 3** Supported actions
Fine-Grained Permissions Policy	Description
bss:costcenter:start	Enables Cost Center.
bss:costanalysis:view	Views cost analysis and overview.
bss:costanalysis:export	Exports cost details, including original and amortized cost details, with cost tags.
bss:costreport:view	Views a list of cost reports.
bss:costreport:update	Manages cost reports, including creating, modifying, and deleting custom reports. If this permission is granted to an IAM user, you must also grant the user the bss:costreport:view permission.
bss:budget:update	Manages budgets, including creating, modifying, and deleting budgets. If this permission is granted to an IAM user, you must also grant the user the bss:budget:view permission.
bss:budget:view	Views budget information, including the budget list and budget details.
bss:budgetreport:update	Creates and modifies budget reports.
bss:budgetreport:delete	Deletes budget reports.
bss:budgetreport:view	Views budget reports, including the budget report list and report details.
bss:riusageanalysis:view	Views the analysis of RI utilization and coverage.
bss:costtag:view	Views cost tags.
bss:costtag:update	Activates or deactivates cost tags. If this permission is granted to an IAM user, you must also grant the user the bss:costtag:view permission.
bss:costunit:update	Configures cost categories, including creating and editing cost categories. If this permission is granted to an IAM user, you must also grant the user the bss:costunit:view and bss:costanalysis:view permissions.
bss:costunit:delete	Deletes cost categories. If this permission is granted to an IAM user, you must also grant the user bss:costunit:view permission.
bss:costunit:view	Views cost category information, including the cost category list and the details of each cost category.
bss:monitor:update	Creates and modifies cost monitors.
bss:monitor:delete	Deletes cost monitors.
bss:monitor:view	Views cost monitors and anomalies.
bss:monitoralert:update	Creates cost anomaly notifications. If this permission is granted to an IAM user, you must also grant the user the bss:monitoralert:view permission.
bss:monitoralert:view	Views cost anomaly notifications.
bss:costoptimization:view	Evaluates cost optimization option of changing pay-per-use to yearly/monthly.
bss:costpreferences:update	Enables functions on the Preferences page.
bss:costpreferences:delete	Disables functions on the Preferences page.
bss:savingsplan:view	Views savings plans.
bss:savingsplan:analysis	Views the analysis of savings plan utilization and coverage.
bss:savingsplan:suggest	Obtains recommendations for savings plans.
bss:recommendation:view	Views cost optimization summary.
bss:recommendationsub:view	Views cost optimization subscriptions.
bss:recommendationsub:update	Configures cost optimization subscriptions.
bss:costdetailreport:view	Views tasks for exporting cost details to OBS.
bss:costdetailreport:update	Creates, modifies, or deletes tasks for exporting cost details to OBS.