How Do I Use the New IAM Edition to Isolate Permissions by Enterprise Project?

Configuring Custom Permission Policies for IAM Users on the IAM Console

1. Click in the upper left corner of the console, and search for and click Identity and Access Management.
2. Click Go to New Console in the upper right corner.
3. Create custom identity policies.
   1. In the navigation pane, choose Identity Policies.
   2. Click Create Custom Policy in the upper right corner. Enter a policy name based on your enterprise project or authorization scope, for example, EnterpriseProjectA_policy. For Policy Content, select Allow, then click Select service and select CodeArts PerfTest (codeartsperftest). In the displayed action list, select the desired user permission policies.
      Figure 3 User permission policies
      
   3. Still for Policy Content, click (Optional) Add request condition > Add Request Condition. In the displayed dialog box, set parameters as instructed in Table 1 and click OK.

      Table 1 Request condition parameters

      Parameter	Description	Remarks
      Condition Key	g:ResourceTag	Fixed value.
      Tag Key	EnterpriseProject	Fixed value.
      Qualifier	Default	Fixed value.
      Operator	StringEquals	Fixed value.
      Value	Enterprise project A	User-defined. Enter an enterprise project name.

   4. Click OK.
   5. Repeat 3.b to 3.d to create multiple custom identity policies and associate them with different enterprise project tags.

4. Grant permissions to a user group. The following operations use a user group as an example. The operations for a user are similar.
   1. In the navigation pane, choose User Groups.
   2. Locate the user group to which you want to attach a custom identity policy, and click Authorize in the Operation column.
   3. Select a custom identity policy created in 3 and click OK.
   4. Repeat 4.b to 4.c to attach different custom identity policies to different user groups.

Configuring Resource Tags for the Target Project on the CodeArts PerfTest Console

1. Log in to the CodeArts PerfTest console and locate the target test project.
2. Click on the right and choose Modify Tag.
   Figure 4 Modifying a tag
   

3. Click Add Tag. In the displayed dialog box, enter EnterpriseProject for Tag Key, enter the enterprise project name configured in IAM (Enterprise project A in this example) for Tag Value, and click OK.
   Figure 5 Adding a tag
   

Verifying Permission Configurations

After the preceding configurations are complete, when a user accesses the target test project, CodeArts PerfTest verifies if the enterprise project resource tag associated with that test project has been configured for the user on the IAM console. In this example, if a custom identity policy with the EnterpriseProject:Enterprise project A tag has been configured for user 1 in IAM, user 1 can access only the projects carrying this tag. If user 1 tries to access other projects, a message indicating insufficient permissions will be displayed.