CodeArts Console Permissions

If you need to assign different permissions to employees in your enterprise to access your purchased CodeArts resources, IAM is a good choice for fine-grained permissions management. IAM provides identity authentication, permissions management, and access control, helping you secure access to your resources.

With IAM, you can use your account to create IAM users, and assign permissions to the users to control their access to specific resources. For example, some software developers in your enterprise need to use CodeArts resources but should not be allowed to perform any other high-risk operations, such as buying CodeArts resources. In this scenario, you can create IAM users for the software developers and grant them only the permissions required for viewing CodeArts resources.

If you do not require individual IAM users, skip this chapter.

IAM can be used free of charge. You pay only for the resources in your account. For more information about IAM, see IAM Service Overview.

CodeArts Console Permissions

By default, new IAM users do not have any permissions. You need to add them to one or more groups, and then add permissions policies or roles to these groups. The users inherit permissions from their groups and can then perform specified operations on cloud services.

CodeArts is a project-level service deployed and accessed in specific physical regions. To assign permissions to a user group, specify the scope as region-specific projects and select projects for the permissions to take effect. If All projects is selected, the permissions will take effect for the user group in all region-specific projects. When accessing CodeArts, the users need to switch to a region where they have been authorized.

CodeArts uses policies for fine-grained authorization.

Policies: a type of fine-grained authorization mechanism that defines permissions required to perform operations on specific cloud resources under certain conditions. This mechanism allows for more flexible authorization. Policies allow you to meet requirements for more secure access control. For example, you can grant CodeArts users only the permissions for performing specific operations on the CodeArts console.

Table 1 lists all system permissions of CodeArts.

**Table 1** System permissions of CodeArts
Policy	Description	Type
DevCloud Console FullAccess	Full permissions for the CodeArts console. Users with these permissions can buy CodeArts resources. NOTE: If an IAM user wants to purchase CodeArts, they must also have one of the BSS Administrator, BSS Finance, and BSS Operator roles in addition to this policy.	System-defined policy
DevCloud Console ReadOnlyAccess	Full permissions for the CodeArts console. Users with these permissions can only view the usage of CodeArts resources.	System-defined policy

Table 2 lists the common operations supported by each system-defined policy of CodeArts. Select a proper policy as required.

**Table 2** Common operations and system permissions
Console Operation	DevCloud Console FullAccess	DevCloud Console ReadOnlyAccess	Description
Check CodeArts Req resource usage	√	√	-
Subscribe to CodeArts Req with pay-per-use billing	√	×	Available soon
Unsubscribe from CodeArts Req with pay-per-use billing	√	×	Available soon
View CodeArts Req subscription records	√	√	Available soon
View CodeArts Req resources	√	√	-
Check CodeArts Repo resource usage	√	√	-
Subscribe to CodeArts Repo with pay-per-use billing	√	×	Available soon
Unsubscribe from CodeArts Repo with pay-per-use billing	√	×	Available soon
View CodeArts Repo subscription records	√	√	Available soon
View CodeArts Repo resources	√	√	-
Check CodeArts Check resource usage	√	√	-
Subscribe to CodeArts Check with pay-per-use billing	√	×	Available soon
Unsubscribe from CodeArts Check with pay-per-use billing	√	×	Available soon
View CodeArts Check subscription records	√	√	Available soon
View CodeArts Check resources	√	√	-
Check CodeArts Build resource usage	√	√	-
Subscribe to CodeArts Build with pay-per-use billing	√	×	Available soon
Unsubscribe from CodeArts Build with pay-per-use billing	√	×	Available soon
View CodeArts Build subscription records	√	√	Available soon
View CodeArts Build resources	√	√	-
Check CodeArts TestPlan – Test Management resource usage	√	√	-
Subscribe to CodeArts TestPlan – Test Management with pay-per-use billing	√	×	Available soon
Unsubscribe from CodeArts TestPlan – Test Management with pay-per-use billing	√	×	Available soon
View CodeArts TestPlan – Test Management subscription records	√	√	Available soon
View CodeArts TestPlan – Test Management resources	√	√	-
Subscribe to CodeArts TestPlan – APITest with pay-per-use billing	√	×	Available soon
Unsubscribe from CodeArts TestPlan – APITest with pay-per-use billing	√	×	Available soon
View CodeArts TestPlan – APITest subscription records	√	√	Available soon
View CodeArts TestPlan – APITest resources	√	√	-
Check CodeArts TestPlan – APITest resource usage	√	√	-
Check CodeArts Artifact resource usage	√	√	-
Subscribe to CodeArts Artifact with pay-per-use billing	√	×	Available soon
Unsubscribe from CodeArts Artifact with pay-per-use billing	√	×	Available soon
View CodeArts Artifact subscription records	√	√	Available soon
View CodeArts Artifact resources	√	√	-
Check CodeArts IDE Online resource usage	√	√	Available soon
Subscribe to CodeArts IDE Online with pay-per-use billing	√	×	Available soon
Unsubscribe from CodeArts IDE Online with pay-per-use billing	√	×	Available soon
View CodeArts IDE Online subscription records	√	√	Available soon
View CodeArts IDE Online resources	√	√	Available soon
Check CodeArts Classroom resource usage	√	√	Available soon
Subscribe to CodeArts Classroom with pay-per-use billing	√	×	Available soon
Unsubscribe from CodeArts Classroom with pay-per-use billing	√	×	Available soon
View CodeArts Classroom subscription records	√	√	Available soon
View CodeArts Classroom resources	√	√	Available soon
Buy the Agile and DevOps Training service	√	×	Available soon
View resources of the Agile and DevOps Training service	√	√	Available soon
Authorize an enterprise account	√	×	-
Cancel the authorization granted to an enterprise account	√	×	-
Accept or reject authorization to an enterprise account	√	×	-
View the authorization list	√	√	-
Purchase a pay-per-use package on the console	√	×	Available soon
View details of a pay-per-use package on the console	√	√	Available soon
Subscribe to a pay-per-use package	√	×	Available soon
Unsubscribe from a pay-per-use package	√	×	Available soon
View pay-per-use package subscription records	√	√	Available soon
Buy a CodeArts package	√	×	-
Change CodeArts package specifications	√	×	-
View CodeArts package resource details	√	√	-

The service names in permission policies may differ from those on the console. The mapping relationship between these names is shown in Table 3.

**Table 3** Service name mapping
Service Name in Permission Policies	Service Name on the Console
DevCloud	CodeArts
ProjectMan	CodeArts Req
CodeHub	CodeArts Repo
CodeCheck	CodeArts Check
CloudBuild	CodeArts Build
CloudDeploy	CodeArts Deploy
CloudArtifact	CodeArts Artifact
CloudTest	CodeArts TestPlan
CloudPipeline	CodeArts Pipeline