What Should I Do If IAM Users Cannot Enable COC Due to Insufficient Permissions?

Issue Description

When an IAM user attempts to enable COC, the message is displayed, indicating that the current user does not have certain IAM permissions to enable COC.

Figure 1 Insufficient permissions

Cause Analysis

The IAM user does not have the IAM permissions required to enable COC.

Solution

1. Log in to the IAM permissions management page using the HUAWEI ID to which the IAM user belongs.
2. In the navigation pane, choose Permissions > Policies/Roles. On the displayed page, click Create Custom Policy. Create a custom policy for enabling COC. For details, see Creating a Custom Policy.

   The following permissions need to be added to the custom policy:

   {
       "Version": "1.1",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "iam:agencies:list*",
                   "iam:agencies:createAgency",
                   "iam:agencies:createServiceLinkedAgencyV5",
                   "coc:agency:get",
                   "coc:agency:create",
                   "iam:permissions:grantRoleToAgency",
                   "iam:permissions:grantRoleToAgencyOnDomain",
                   "iam:roles:listRoles"
               ]
           }
       ]
   }

   Figure 2 Creating a custom policy
   

3. Create a user group and assign the custom policy created in 2 to the group. For details, see Creating a User Group and Assigning Permissions.
4. On the Users page of the IAM console, locate the target user and click Authorize in the Operation to assign COC permissions to the user.
5. On the displayed page, select the user group created in 3 so that the user inherits permissions from the group.

   For details, see Assigning Permissions to an IAM User.