Help Center/ Cloud Service Engine/ User Guide/ Permissions Management/ Creating a Custom Policy for a Microservice Engine
Updated on 2024-02-29 GMT+08:00
View PDF

Creating a Custom Policy for a Microservice Engine

Custom policies can be created as a supplement to the system policies of CSE.

You can create custom policies in either of the following ways:

  • Visual editor: Select cloud services, actions, resources, and request conditions. This does not require knowledge of policy syntax.
  • JSON: Create a policy in the JSON format from scratch or based on an existing policy.

For details, see Creating a Custom Policy. The following section contains examples of common CSE custom policies.

Example Custom Policy

This procedure creates a policy that an IAM user is prohibited to create and delete a microservice engine. 
{
        "Version": "1.1",
        "Statement": [
                {
                        "Action": [
                                "cse:*:*"
                        ],
                        "Effect": "Allow"
                },
                {
                        "Action": [
                                "cse:engine:create",
                                "cse:engine:delete"
                        ],
                        "Effect": "Deny"
                }
        ]
}

A deny policy must be used in conjunction with other policies to take effect. If the permissions assigned to a user contain both "Allow" and "Deny", the "Deny" permissions take precedence over the "Allow" permissions.

After authorization, users in the group can verify their permissions using the console or REST APIs.

The following uses the custom policy as an example to describe how to verify that a user is not allowed to create microservice engines on the console.

  1. Log in to Huawei Cloud as an IAM user.
    • Tenant name: Name of the account used to create the IAM user
    • IAM username and password: Username and password specified during the IAM user creation using the tenant name
  2. Create a microservice engine on the CSE console. If error 403 is returned, the permissions are correct and have taken effect.
Parent topic: Permissions Management