Permissions Management

If you need to assign different permissions to employees in your enterprise to access your CCI resources, Identity and Access Management (IAM) is a good choice for fine-grained permissions management. IAM provides identity authentication, permissions management, and access control, enabling secure access to your cloud resources.

With IAM, you can use your account to create IAM users, and assign permissions to the users to control their access to specific resources. For example, some software developers in your enterprise need to use CCI resources but should not be allowed to delete the resources or perform any other high-risk operations. In this scenario, you can create IAM users for the software developers and grant them only the permissions required for using CCI resources.

If your account does not require individual IAM users for permissions management, skip this topic.

IAM can be used free of charge. You only pay for the resources in your account.

For more information about IAM, see IAM Service Overview.

CCI Permissions

By default, new IAM users do not have permissions assigned. You need to add a user to one or more groups, and attach permissions policies or roles to these groups. Users inherit permissions from the groups to which they are added and can perform specified operations on cloud services based on the permissions.

CCI is a project-level service deployed and accessed in specific regions. To assign CCI permissions to a user group, specify the scope as region-specific projects and select projects for the permissions to take effect. If All projects is selected, the permissions will take effect for the user group in all region-specific projects. When accessing CCI, the users need to switch to a region where they have been authorized to use this service.

You can grant users permissions by using roles and policies.

Roles: A type of coarse-grained authorization mechanism that defines permissions related to user responsibilities. This mechanism provides only a limited number of service-level roles for authorization. Cloud services depend on each other. When using roles to assign permissions, you also need to assign dependent roles. However, roles are not an ideal choice for fine-grained authorization and secure access control.
Policies: A type of fine-grained authorization mechanism that defines permissions required to perform operations on specific cloud resources under certain conditions. This mechanism allows for more flexible policy-based authorization, meeting requirements for least privilege access. For example, you can grant CCI users only the permissions for managing a certain type of CCI resources. Most policies define permissions based on APIs.

Table 1 lists all the system-defined roles and policies supported by CCI. System-defined policies in role/policy-based authorization are not interoperable with those in identity policy-based authorization.

**Table 1** System-defined roles and policies supported by CCI
Role/Policy Name	Description	Type
CCI FullAccess	Full permissions for CCI. Users granted these permissions can create, delete, query, and update all CCI resources.	System-defined policy
CCI ReadOnlyAccess	Read-only permissions for CCI. Users granted these permissions can only view CCI resources.	System-defined policy
CCI CommonOperations	Common user permissions for CCI. Users granted these permissions can perform all operations except creating, deleting, and modifying networks, and resources in namespaces.	System-defined policy
CCI Administrator	Administrator permissions for CCI. Users granted these permissions can create, delete, query, and update all CCI resources.	System-defined role

Table 2 lists the permissions granted by a CCI FullAccess policy.

**Table 2** Permissions granted by a CCI FullAccess policy
Action	Description
cci::	Perform all operations on Cloud Container Instance (CCI).
vpc::	Perform all operations on Virtual Private Cloud (VPC).
elb::	Perform all operations on Elastic Load Balance (ELB).
sfs::	Perform all operations on Scalable File Service (SFS).
obs::	Perform all operations on Object Storage Service (OBS).
evs::	Perform all operations on Elastic Volume Service (EVS).
aom::	Perform all operations on Application Operations Management (AOM).
apm::	Perform all operations on Application Performance Management (APM).
swr::	Perform all operations on SoftWare Repository for Container (SWR).
nat::	Perform all operations on NAT Gateway.
kms:cmk:*	Perform all operations on Data Encryption Workshop (DEW).

Table 3 lists the permissions granted by a CCI ReadOnlyAccess policy.

**Table 3** Permissions granted by a CCI ReadOnlyAccess policy
Action	Description
cci:*:get	View details about all CCI resources.
cci:*:list	List all CCI resources.
vpc:*:get	View details about all VPC resources.
vpc:*:list	List all VPC resources.
ecs:*:get	View details about all ECS resources.
ecs:*:list	List all ECS resources.
elb:*:get	View details about all ELB resources.
elb:*:list	List all ELB resources.
sfs::get	View details about all SFS resources.
sfs:*:list	List all SFS resources.
obs::get	View details about all OBS resources.
obs:*:list	List all OBS resources.
evs::get	View details about all EVS resources.
evs:*:list	List all EVS resources.
aom:*:get	View details about all AOM resources.
aom:*:list	List all AOM resources.
amp:*:get	View details about all APM resources.
apm:*:list	List all APM resources.
swr:*:get	View details about all SWR resources.
swr:*:list	List all SWR resources.
nat:*:get	View details about all NAT Gateway resources.
nat:*:list	List all NAT Gateway resources.
kms:cmk:get	Query key information.
kms:cmk:list	List all keys.

Table 4 lists the permissions granted by a CCI CommonOperations policy.

**Table 4** Permissions granted by a CCI CommonOperations policy
Action	Description
cci:namespace:get	Query namespace details.
cci:namespace:list	List all namespaces.
cci:network:get	Query network details.
cci:network:list	List all networks.
cci:namespaceSubResource:*	Perform all operations on resources in namespaces.
cci:addonTemplate:*	Perform all operations on add-on templates.
cci:addonInstance:*	Perform all operations on add-on pods.
vpc::	Perform all operations on VPC.
elb::	Perform all operations on ELB.
sfs::	Perform all operations on SFS.
obs::	Perform all operations on OBS.
evs::	Perform all operations on EVS.
aom::	Perform all operations on AOM.
apm::	Perform all operations on APM.
swr::	Perform all operations on SWR.
nat::	Perform all operations on NAT Gateway.
kms:cmk:*	Perform all operations on DEW.

Table 5 lists the common operations supported by system-defined permissions for CCI.

**Table 5** Common operations supported by system-defined permissions
Operation	CCIFullAccess	CCIReadOnlyAccess	CCI CommonOperations
Creating a namespace	√	x	x
Deleting a namespace	√	x	x
Listing the namespaces	√	√	√
Querying namespace details	√	√	√
Creating a network	√	x	x
Deleting networks	√	x	x
Listing the networks	√	√	√
Querying network details	√	√	√
Updating a network	√	x	x
Creating a pod	√	x	√
Deleting pods	√	x	√
Listing the pods	√	√	√
Querying pod details	√	√	√
Updating a pod	√	x	√
Running commands in a pod	√	x	√
Querying pod logs	√	√	√
Creating a ConfigMap	√	x	√
Deleting a ConfigMap	√	x	√
Listing the ConfigMaps	√	√	√
Querying ConfigMap details	√	√	√
Updating a ConfigMap	√	x	√
Creating a secret	√	x	√
Deleting a secret	√	x	√
Listing the secrets	√	√	√
Querying secret details	√	√	√
Updating a secret	√	x	√
Creating a Service	√	x	√
Deleting a Service	√	x	√
Listing the Services	√	√	√
Querying Service details	√	√	√
Updating a Service	√	x	√
Creating a Deployment	√	x	√
Deleting a Deployment	√	x	√
Listing the Deployments	√	√	√
Querying Deployment details	√	√	√
Updating a Deployment	√	x	√
Creating an HPA policy	√	x	√
Deleting an HPA policy	√	x	√
Listing the HPA policies	√	√	√
Querying HPA policy details	√	√	√
Updating an HPA policy	√	x	√
Creating a PV	√	x	√
Deleting a PV	√	x	√
Listing the PVs	√	√	√
Querying PV details	√	√	√
Updating a PV	√	x	√
Creating a PVC	√	x	√
Deleting a PVC	√	x	√
Listing the PVCs	√	√	√
Querying PVC details	√	√	√
Updating a PVC	√	x	√
List storage classes	√	√	√
Creating an image snapshot	√	x	√
Deleting an image snapshot	√	x	√
Listing the image snapshots	√	√	√
Querying image snapshot details	√	√	√

CCI supports authorization with identity policies. Table 6 lists all system-defined identity policies for CCI with identity policy-based authorization. System-defined policies in identity policy-based authorization are not interoperable with those in role/policy-based authorization.

**Table 6** System-defined identity policies for CCI
Identity Policy Name	Description	Type
CCIFullAccessPolicy	Full permissions for CCI	System-defined identity policy
CCIReadOnlyPolicy	Read-only permissions for CCI	System-defined identity policy

The following table lists the permissions of the CCIFullAccessPolicy identity policy.

**Table 7** Permissions assigned by CCIFullAccessPolicy
Action	Description
cci::	Perform all operations on CCI.
vpc:subnets:create	Create a VPC subnet.
vpc:subnets:get	Query VPC subnet details.
vpc:subnets:update	Update a VPC subnet.
vpc:subnets:delete	Delete a VPC subnet.
vpc:vpcs:create	Create a VPC.
vpc:vpcs:get	Query VPC details.
vpc:vpcs:list	List the VPCs.
vpc:vpcs:update	Update a VPC.
vpc:vpcs:delete	Delete a VPC.
vpc:ports:get	Query VPC port details.
vpc:ports:list	List VPC ports.
vpc:quotas:list	Query VPC resource quotas.
vpc:securityGroups:get	Query security group details.
vpc:securityGroupRules:get	Query security group rule details.
swr:namespace:list*	(SWR Shared Edition) List the organizations.
swr:namespace:get*	(SWR Shared Edition) Query organization permissions and details.
swr:repo:list*	(SWR Shared Edition) List all image resources.
swr:repo:get*	(SWR Shared Edition) Query details about all image resources.
swr:repo:download	(SWR Shared Edition) Download images.
swr::listQuotas	(SWR Shared Edition) Query quotas.
swr::getDomainOverview	(SWR Shared Edition) Query the tenant resource overview.
swr::getDomainResourceReports	(SWR Shared Edition) Query tenant resource statistics.
swr:instance:get*	Query details about all SWR instance resources.
swr:instance:list*	List all SWR instance resources.

**Table 8** Permissions assigned by CCIReadOnlyPolicy
Action	Description
cci::get	Query details about all CCI resources.
cci::list	List all CCI resources.
vpc:subnets:get	Query VPC subnet details.
vpc:vpcs:get	Query VPC details.
vpc:vpcs:list	List the VPCs.
vpc:ports:get	Query VPC port details.
vpc:ports:list	List VPC ports.
vpc:quotas:list	Query VPC resource quotas.
vpc:securityGroups:get	Query security group details.
vpc:securityGroupRules:get	Query security group rule details.
swr:namespace:list*	(SWR Shared Edition) List the organizations.
swr:namespace:get*	(SWR Shared Edition) Query organization permissions and details.
swr:repo:list*	(SWR Shared Edition) List all image resources.
swr:repo:get*	(SWR Shared Edition) Query details about all image resources.
swr:repo:download	(SWR Shared Edition) Download images.
swr::listQuotas	(SWR Shared Edition) Query quotas.
swr::getDomainOverview	(SWR Shared Edition) Query the tenant resource overview.
swr::getDomainResourceReports	(SWR Shared Edition) Query tenant resource statistics.
swr:instance:get*	Query details about all SWR instance resources.
swr:instance:list*	List all SWR instance resources.

Table 9 lists the common operations supported by system-defined identity policies for CCI.

**Table 9** Common operations supported by system-defined identity policies
Operation	CCIFullAccessPolicy	CCIReadOnlyPolicy
Creating a namespace	√	x
Deleting a namespace	√	x
Listing the namespaces	√	√
Querying namespace details	√	√
Creating a network	√	x
Deleting a network	√	x
Listing the networks	√	√
Querying network details	√	√
Updating a network	√	x
Creating a pod	√	x
Deleting a pod	√	x
Listing the pods	√	√
Querying pod details	√	√
Updating a pod	√	x
Running commands in a pod	√	x
Querying pod logs	√	x
Creating a ConfigMap	√	x
Deleting a ConfigMap	√	x
Listing the ConfigMaps	√	√
Querying ConfigMap details	√	√
Updating a ConfigMap	√	x
Creating a secret	√	x
Deleting a secret	√	x
Listing the secrets	√	√
Querying secret details	√	√
Updating a secret	√	x
Creating a Service	√	√
Deleting a Service	√	√
Listing the Services	√	√
Querying Service details	√	√
Updating a Service	√	x
Creating a Deployment	√	x
Deleting a Deployment	√	x
Listing the Deployments	√	√
Querying Deployment details	√	√
Updating a Deployment	√	x
Creating an HPA policy	√	x
Deleting an HPA policy	√	x
Listing the HPA policies	√	√
Querying HPA policy details	√	√
Updating an HPA policy	√	x
Creating a PV	√	x
Deleting a PV	√	x
Listing the PVs	√	√
Querying PV details	√	√
Updating a PV	√	x
Creating a PVC	√	x
Deleting a PVC	√	x
Listing the PVCs	√	√
Querying PVC details	√	√
Updating a PVC	√	x
Listing the storage classes	√	√
Creating an image snapshot	√	x
Deleting an image snapshot	√	x
Listing the image snapshots	√	√
Querying image snapshot details	√	√

The following table lists the actions associated with CCI fine-grained policies.

**Table 10** Actions associated with CCI fine-grained policies
Action	Description
cci:namespace:create	Create a namespace.
cci:namespace:delete	Delete a namespace.
cci:namespace:list	List the namespaces.
cci:namespace:get	Query namespace details.
cci:network:create	Create a network.
cci:network:delete	Delete a network.
cci:network:list	List the networks.
cci:network:get	Query network details.
cci:network:update	Update a network.
cci:pod:create	Create a pod.
cci:pod:delete	Delete a pod.
cci:pod:list	List the pods.
cci:pod:get	Query pod details.
cci:pod:update	Update a pod.
cci:pod:exec	Run commands in a pod.
cci:pod:getLog	Query pod logs.
cci:configmap:create	Create a ConfigMap.
cci:configmap:delete	Delete a ConfigMap.
cci:configmap:list	List the ConfigMaps.
cci:configmap:get	Query ConfigMap details.
cci:configmap:update	Update a ConfigMap.
cci:secret:create	Create a secret.
cci:secret:delete	Delete a secret.
cci:secret:list	List the secrets.
cci:secret:get	Query secret details.
cci:secret:update	Update a secret.
cci:service:create	Create a Service.
cci:service:delete	Delete a Service.
cci:service:list	List the Services.
cci:service:get	Query Service details.
cci:service:update	Update a Service.
cci:deployment:create	Create a Deployment.
cci:deployment:delete	Delete a Deployment.
cci:deployment:list	List the Deployments.
cci:deployment:get	Query Deployment details.
cci:deployment:update	Update a Deployment.
cci:horizontalpodautoscaler:create	Create an HPA policy.
cci:horizontalpodautoscaler:delete	Delete an HPA policy.
cci:horizontalpodautoscaler:list	List the HPA policies.
cci:horizontalpodautoscaler:get	Query HPA policy details.
cci:horizontalpodautoscaler:update	Update an HPA policy.
cci:persistentvolume:create	Create a PV.
cci:persistentvolume:delete	Delete a PV.
cci:persistentvolume:list	List the PVs.
cci:persistentvolume:get	Query PV details.
cci:persistentvolume:update	Update a PV.
cci:persistentvolumeclaim:create	Create a PVC.
cci:persistentvolumeclaim:delete	Delete a PVC.
cci:persistentvolumeclaim:list	List the PVCs.
cci:persistentvolumeclaim:get	Query PVC details.
cci:persistentvolumeclaim:update	Update a PVC.
cci:storageclass:list	List the storage classes.
cci:imagesnapshot:create	Create an image snapshot.
cci:imagesnapshot:delete	Delete an image snapshot.
cci:imagesnapshot:list	List the image snapshots.
cci:imagesnapshot:get	Query image snapshot details.