Help Center/ MapReduce Service/ User Guide/ Preparations/ Creating an IAM User and Granting MRS Permissions

Updated on 2024-10-25 GMT+08:00

View PDF

Creating an IAM User and Granting MRS Permissions

Use IAM to implement fine-grained permission control over your MRS. With IAM, you can:

Create IAM users under your Huawei Cloud account for employees based on your enterprise's organizational structure so that each employee is allowed to access MRS resources using their unique security credential (IAM user).
Grant only the permissions required for users to perform a specific task.
Entrust a Huawei Cloud account or cloud service to perform efficient O&M on your MRS resources.

If your Huawei Cloud account does not require IAM users, skip this section.

This section describes the procedure for granting permissions (see Figure 1).

Prerequisites

Learn about the permissions supported by MRS by referring to Permission Management. For the permissions of other services, see System Permissions.

Process Flow

Figure 1 Process for granting MRS permissions

Creating a User Group and Assigning Permissions
Create a user group on the IAM console, and assign MRS permissions to the group.
Create a user and add it to a user group.
Create a user on the IAM console and add the user to the group created in 1.
Log in and verify permissions.
Log in to the console by using the user created, and verify that the user has the granted permissions.
- Choose Service List > Analytics > MapReduce Service. Click Buy Cluster on the MRS console. If you fail to buy an MRS cluster (assume that you only have the MRS ReadOnlyAccess permission), the MRS ReadOnlyAccess policy has taken effect.
- Choose any other service in Service List. If a message appears indicating that you have insufficient permissions to access the service, the MRS ReadOnlyAccess policy has already taken effect.

IAM permissions of MRS

By default, new IAM users lack permissions assigned. Add a user to one or more groups, and attach permissions policies or roles to these groups. Users inherit permissions from the groups to which they are added and can perform specified operations on cloud services.

MRS is a project-level service deployed for specific regions. To assign permissions to a user group, specify Scope as Region-specific projects and select projects in the corresponding region for the permissions to take effect. If All projects is selected, the permissions will take effect for the user group in all region-specific projects. When accessing MRS, the users need to switch to the authorized region.

You can grant permissions by using roles and policies.

Roles: A coarse-grained IAM authorization strategy to assign permissions based on user responsibilities. Only a limited number of service-level roles are available. Some roles depend other roles to take effect. When you assign such roles to users, remember to assign the roles they depend on. Roles are not an ideal choice for fine-grained authorization and secure access control.
Policies: A fine-grained authorization mechanism that defines permissions required to perform operations on specific cloud resources under certain conditions. This type of authorization is more flexible and is ideal for secure access control. For example, you can grant MRS users only the permissions for performing specified operations on MRS clusters, such as creating a cluster and querying a cluster list rather than deleting a cluster. Most policies define permissions based on APIs. For the API actions supported by MRS, see Permissions Policies and Supported Actions.

Table 1 lists all the default system policies supported by MRS.

**Table 1** MRS system policies
Policy	Description	Type
MRS FullAccess	Administrator permissions for MRS. Users with these permissions can perform all operations on MRS resources.	Fine-grained policy
MRS CommonOperations	Common user permissions for MRS. Users with these permissions can use MRS but cannot add or delete resources.	Fine-grained policy
MRS ReadOnlyAccess	Read-only permission for MRS. Users with these permissions can only view MRS resources.	Fine-grained policy
MRS Administrator	Operation permissions: All operations on MRS Permissions of the Tenant Guest and Server Administrator policies, which must also be granted to the users	RBAC policy

Table 2 lists the common operations supported by each system-defined policy or role of MRS. Select the permissions as needed.

**Table 2** Common operations supported by each system-defined policy
Operation	MRS FullAccess	MRS CommonOperations	MRS ReadOnlyAccess	MRS Administrator
Creating a cluster	√	x	x	√
Resizing a cluster	√	x	x	√
Upgrading node specifications	√	x	x	√
Deleting a cluster	√	x	x	√
Querying cluster details	√	√	√	√
Listing all clusters	√	√	√	√
Configuring an auto scaling rule	√	x	x	√
Querying a host list	√	√	√	√
Querying operation logs	√	√	√	√
Creating and executing a job	√	√	x	√
Stopping a job	√	√	x	√
Deleting a single job	√	√	x	√
Deleting jobs in batches	√	√	x	√
Querying job details	√	√	√	√
Querying a job list	√	√	√	√
Creating a folder	√	√	x	√
Deleting a file	√	√	x	√
Querying a file list	√	√	√	√
Operating cluster tags in batches	√	√	x	√
Creating a single cluster tag	√	√	x	√
Deleting a single cluster tag	√	√	x	√
Querying a resource list by tag	√	√	√	√
Querying cluster tags	√	√	√	√
Accessing Manager	√	√	x	√
Querying a patch list	√	√	√	√
Installing a patch	√	√	x	√
Uninstalling a patch	√	√	x	√
Authorizing O&M channels	√	√	x	√
Sharing O&M channel logs	√	√	x	√
Querying an alarm list	√	√	√	√
Subscribing to alarm notifications	√	√	x	√
Submitting a SQL statement	√	√	x	√
Querying SQL query results	√	√	x	√
Canceling a SQL execution task	√	√	x	√