Using IAM Identity Policies to Grant Access to DMS for RabbitMQ

Prerequisites

Before granting permissions, learn about the system identity policies supported by DMS for RabbitMQ, as described in Identity Policy-based Authorization. To grant permissions for other services, learn about all system-defined permissions supported by IAM.

Process Flow

Figure 1 Process of granting DMS for RabbitMQ permissions

1. On the IAM console, create an IAM user or create a user group.

2. Attach a system-defined policy (DMSReadOnlyAccessPolicy as an example) to the user or user group.

3. Log in as the IAM user and verify permissions.
   In the authorized region, perform the following operations:

   • Choose Service List > Distributed Message Service for RabbitMQ. Then click Buy Instance on the console of DMS for RabbitMQ. If a message appears indicating that you have insufficient permissions to perform the operation, the DMS DMSReadOnlyAccessPolicy policy is in effect.
   • Choose Service List > Elastic Volume Service. If a message appears indicating that you have insufficient permissions to access the service, the DMS DMSReadOnlyAccessPolicy policy is in effect.
   • Choose Service List > Distributed Message Service for RabbitMQ. The RabbitMQ console is displayed. If a list of RabbitMQ instances are displayed, the DMS ReadOnlyAccess policy is in effect.

Example Custom Policies

You can create custom identity policies to supplement the system-defined identity policies of DMS for RabbitMQ. For details about actions supported in custom identity policies, see Actions Supported by Identity Policy-based Authorization.

To create a custom identity policy, choose either visual editor or JSON.

• Visual editor: Select cloud services, actions, resources, and request conditions. There is no need to know much about policy syntax.
• JSON: Create a JSON policy or edit an existing one.

For details, see Creating a Custom Identity Policy and Attaching It to a Principal.

When creating a custom identity policy, use the Resource element to specify the resources the policy applies to and use the Condition element (service-specific condition keys) to control when the policy is in effect. For details about the supported resource types and condition keys, see Actions Supported by Identity Policy-based Authorization. The following lists examples of common DMS for RabbitMQ custom identity policies.

• Example 1: Grant permission to create and delete instances.

  {
      "Version": "5.0",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "dms:instance:create",
                  "dms:instance:delete"
              ]
          }
      ]
  }

• Example 2: Create a custom policy containing multiple actions.

  A custom policy can contain the actions of one or multiple services.

  Example policy containing multiple actions:

  {
      "Version": "5.0",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "dms:instance:create",
                  "dms:instance:delete"
              ]
          },
          {
              "Effect": "Allow",
              "Action": [
                  "vpc:vpcs:list",
                  "vpc:subnets:list",
                  "vpc:securityGroups:list"
              ]
          }
      ]
  }