Permissions

If you need to assign different permissions to personnel in your enterprise to access your Cloud Eye resources, Identity and Access Management (IAM) is a good choice for fine-grained permissions management. IAM provides identity authentication, fine-grained permissions management, and access control. IAM helps you secure access to your Huawei Cloud resources. If your HUAWEI ID does not require IAM for permissions management, you can skip this section.

IAM is a free service. You only pay for the resources in your account.

With IAM, you can control access to specific Huawei Cloud resources. For example, if you want some software developers in your enterprise to be able to use Cloud Eye resources but do not want them to be able to delete these resources or perform any other high-risk operations, you can grant them permissions to use Cloud Eye resources but not permissions to delete them.

IAM supports role/policy-based authorization and identity policy-based authorization.

The following table describes the differences between these two authorization models.

**Table 1** Differences between role/policy-based and identity policy-based authorization
Authorization Model	Core Relationship	Permissions	Authorization Method	Scenario
Role/Policy	User-permission-authorization scope	System-defined roles System-defined policies Custom policies	Assigning roles or policies to principals	To authorize a user, you need to add it to a user group first and then specify the scope of authorization. It provides a limited number of condition keys and cannot meet the requirements of fine-grained permissions control. This method is suitable for small- and medium-sized enterprises.
Identity policy	User-policy	System-defined identity policies Custom identity policies	Assigning identity policies to principals Attaching identity policies to principals	You can authorize a user by attaching an identity policy to it. User-specific authorization and a variety of key conditions allow for more fine-grained permissions control. However, this model can be hard to set up. It requires a certain amount of expertise and is suitable for medium- and large-sized enterprises.

Policies/identity policies and actions in the two authorization models are not interoperable. You are advised to use the identity policy-based authorization model. For details about system-defined permissions, see Role/Policy-based Authorization and Identity Policy-based Authorization.

For more information about IAM, see IAM Service Overview.

Role/Policy-based Authorization

Cloud Eye supports authorization with roles and policies. New IAM users do not have any permissions assigned by default. You need to first add them to one or more groups and then attach policies or roles to these groups. The users then inherit permissions from the groups and can perform specified operations on cloud services based on the permissions they have been assigned.

Cloud Eye is a project-level service deployed and accessed in specific physical regions. When you set Scope to Region-specific projects and select the specified projects (for example, ap-southeast-2) in the specified regions (for example, AP-Bangkok), the users only have permissions for resources in the selected projects. If you set Scope to All resources, the users have permissions for resources in all region-specific projects. When users access Cloud Eye, they need to switch to a region where they have been authorized to use this service.

Table 2 lists all the system-defined permissions for Cloud Eye. System-defined policies in role/policy-based authorization are not interoperable with those in identity policy-based authorization.

**Table 2** System-defined permissions for Cloud Eye
Role/Policy Name	Description	Type	Dependencies
CES FullAccessPolicy	All permissions for Cloud Eye. Users granted these permissions can perform all operations on Cloud Eye.	System-defined policies	Cloud Eye monitoring involves querying resources of other cloud services. This policy contains the resource query permissions of some cloud services. If you encounter permission problems, configure required fine-grained permissions for the services involved. For details, see Supported Cloud Services. Alarm notification: depends on SMN FullAccess. Data dump: depends on OBS OperateAccess.
CES ReadOnlyAccessPolicy	Read-only permissions for viewing data on Cloud Eye	System-defined policies	Cloud Eye monitoring involves querying resources of other cloud services. This policy contains the resource query permissions of some cloud services. If you encounter permission problems, configure required fine-grained permissions of the involved services. For details, see Supported Cloud Services.
CES AgentAccess	Permissions required for the Cloud Eye Agent to run NOTE: To ensure that the Cloud Eye Agent can provide services, you need to configure an agency. For details, see How Do I Configure an Agency?	System-defined policies	None
CES Administrator	Administrator permissions for Cloud Eye	System-defined roles	Depends on the Tenant Guest policy. Tenant Guest: global policy, which must be assigned in the global project.
CES FullAccess	All permissions for Cloud Eye. Users granted these permissions can perform all operations on Cloud Eye. NOTE: It is recommended that you use CES FullAccessPolicy because CES FullAccess does not meet the least privilege principle.	System-defined policies	Cloud Eye monitoring involves querying resources of other cloud services. This policy contains the resource query permissions of some cloud services. If you encounter permission problems, configure required fine-grained permissions of the involved services. For details, see Supported Cloud Services. Alarm notification: depends on SMN FullAccess. Data dump: depends on OBS OperateAccess.
CES ReadOnlyAccess	Read-only permissions for viewing data on Cloud Eye NOTE: It is recommended that you use CES ReadOnlyAccessPolicy because CES ReadOnlyAccess does not meet the least privilege principle.	System-defined policies	Cloud Eye monitoring involves querying resources of other cloud services. This policy contains the resource query permissions of some cloud services. If you encounter permission problems, configure required fine-grained permissions for the services involved. For details, see Supported Cloud Services.

Table 3 lists common operations supported by the Cloud Eye system-defined permissions.

**Table 3** Common operations supported by system-defined permissions
Feature	Operation	CES FullAccessPolicy	CES ReadOnlyAccessPolicy	CES Administrator (The Tenant Guest policy must be added at the same time.)	Tenant Guest
Overview	Viewing the Overview page	Supported	Supported	Supported	Supported
Overview	Viewing monitoring data in a large screen	Supported	Supported	Supported	Supported
Dashboards	Creating a dashboard	√	Not supported	Supported	×
	Viewing a dashboard	√	Supported	Supported	Supported
	Viewing monitoring data in a large screen	Supported	Supported	Supported	√
	Adding a graph	Supported	Not supported	Supported	Not supported
	Viewing a graph	Supported	Supported	Supported	Supported
	Modifying a graph	Supported	Not supported	Supported	Not supported
	Deleting a graph	Supported	Not supported	Supported	Not supported
	Adjusting the position of a graph	Supported	Not supported	Supported	×
	Deleting a dashboard	√	Not supported	Supported	×
My Dashboards	Creating a dashboard	Supported	Not supported	Supported	Not supported
	Viewing monitoring data in a large screen	Supported	Supported	Supported	Supported
	Viewing a dashboard	Supported	Supported	Supported	Supported
	Deleting a dashboard	Supported	Not supported	Supported	Not supported
	Adding a graph	Supported	Not supported	Supported	Not supported
	Viewing a graph	Supported	Supported	Supported	Supported
	Modifying a graph	Supported	Not supported	Supported	Not supported
	Deleting a graph	Supported	Not supported	Supported	Not supported
	Adjusting the position of a graph	Supported	Not supported	Supported	Not supported
Resource Groups	Creating a resource group	Supported	Not supported	Supported	Not supported
	Viewing resource groups	Supported	Supported	Supported	Supported
	Viewing resources in a resource group.	Supported	Supported	Supported	Supported
	Viewing alarm rules in a resource group	Supported	Supported	Supported	Supported
	Modifying a resource group	Supported	Not supported	Supported	Not supported
	Deleting a resource group	Supported	Not supported	Supported	Not supported
Alarm Rules	Creating an alarm rule	Supported	Not supported	Supported	Not supported
	Modifying an alarm rule	Supported	Not supported	Supported	Not supported
	Enabling an alarm rule	Supported	Not supported	Supported	Not supported
	Disabling an alarm rule	Supported	Not supported	Supported	Not supported
	Deleting an alarm rule	Supported	Not supported	Supported	Not supported
	Exporting alarm rules	Supported	Supported	Supported	Not supported
	Viewing alarm rules	Supported	Supported	Supported	Supported
	Viewing details of an alarm rule	Supported	Supported	Supported	Supported
	Viewing graphs	Supported	Supported	Supported	Supported
Alarm Records	Viewing alarm records	Supported	Supported	Supported	Supported
	Viewing monitoring details	√	Supported	Supported	√
	Masking an alarm	√	Not supported	Supported	×
	Manually clearing an alarm record	√	Not supported	Supported	×
Alarm Templates	Viewing a default alarm template	Supported	Supported	Supported	Supported
	Viewing a custom alarm template	Supported	Supported	Supported	Supported
	Creating a custom alarm template	Supported	Not supported	Supported	Not supported
	Modifying a custom alarm template	Supported	Not supported	Supported	Not supported
	Deleting a custom alarm template	Supported	Not supported	Supported	Not supported
One-Click Monitoring	Enable one-click monitoring	Supported	Not supported	Supported	Not supported
	Viewing one-click monitoring	Supported	Supported	Supported	Supported
	Modifying one-click monitoring	Supported	Not supported	Supported	Not supported
	Disabling one-click monitoring	Supported	Not supported	Supported	Not supported
Server Monitoring	Viewing the server list	Supported	Supported	Supported	Supported
	Viewing server monitoring metrics	Supported	Supported	Supported	Supported
	Installing the Agent	Supported (You must have the ECS FullAccess permissions.)	Not supported	Supported (You must have the ECS FullAccess permissions.)	Not supported
	Restoring the Agent configurations	√ (You must have the Security Administrator and ECS FullAccess permissions.)	Not supported	√ (You must have the Security Administrator and ECS FullAccess permissions.)	Not supported
	Uninstalling the Agent	Supported (You must have the ECS FullAccess permissions.)	Not supported	Supported (You must have the ECS FullAccess permissions.)	Not supported
	Configuring process monitoring	Supported	Not supported	Supported	Not supported
	Configuring monitoring for a process	Supported	Not supported	Supported	Not supported
Cloud Service Monitoring	Viewing the cloud service list	Supported (See Supported Cloud Services.)	Supported (See Supported Cloud Services.)	Supported	Supported
Cloud Service Monitoring	Querying metrics of a cloud service	Supported	Supported	Supported	Supported
Custom Monitoring	Adding custom monitoring data	Supported	Not supported	Supported	Not supported
	Viewing the custom monitoring list	Supported	Supported	Supported	Supported
	Viewing custom monitoring data	Supported	Supported	Supported	Supported
Event Monitoring	Adding a custom event	Supported	Not supported	Supported	Not supported
	Viewing events	Supported	Supported	Supported	Supported
	Viewing event details	Supported	Supported	Supported	Supported
Data Dumping to DMS Kafka	Creating a dump task	Supported	Not supported	Supported	Not supported
	Querying data dump tasks	Supported	Supported	Supported	Supported
	Querying a data dump task	Supported	Supported	Supported	Supported
	Modifying a data dump task	Supported	Not supported	Supported	Not supported
	Starting a data dump task	Supported	Not supported	Supported	Not supported
	Stopping a data dump task	Supported	Not supported	Supported	Not supported
	Deleting a data dump task	Supported	Not supported	Supported	Not supported
Others	Configuring data dump	Supported (You must have the OBS Bucket Viewer permissions.)	Not supported	Supported (You must have the Tenant Administrator permissions.)	Not supported
	Exporting monitoring data	Supported	Supported	Supported	Not supported
	Sending an alarm notification	Supported	Not supported	Supported	Not supported

Roles or Policies Required for Operations on the Cloud Eye Console

To grant an IAM user the permissions to view or use resources of other cloud services on the Cloud Eye console, you must first grant the CES Administrator, CES FullAccessPolicy, or CES ReadOnlyAccessPolicy policy to the user group that the user belongs to and then grant the dependency roles or policies listed in Table 4 to the user. These dependency policies will allow the IAM user to access resources of other cloud services.

**Table 4** Roles or policies required for operations on the Cloud Eye console
Console Function	Dependency	Roles or Policies Required
Cloud Service Monitoring	Cloud Phone Host (CPH) ROMA Connect: Business Flow Service (BFS) Fast Data Integration (FDI) API Connect (APIC) Cloud Search Service (CSS) Workspace Message & SMS	IAM users with the CES Administrator, CES FullAccessPolicy, or CES ReadOnlyAccessPolicy permission can view information about cloud service monitoring.

Identity Policy-based Authorization

Cloud Eye supports authorization with identity policies. Table 5 lists all system-defined identity policies for Cloud Eye. System-defined policies in identity policy-based authorization are not interoperable with those in role/policy-based authorization.

**Table 5** System policies
Identity Policy Name	Description	Type
CESServiceReadOnlyPolicy	Read-only permissions for Cloud Eye	System-defined identity policies
CESServiceFullAccessPolicy	Full permissions for Cloud Eye	System-defined identity policies
CESServiceAgencyPolicy	Agency permissions for Cloud Eye	System-defined identity policies

Table 6 lists common operations supported by system-defined identity policies for Cloud Eye.

**Table 6** Common operations supported by system-defined policies
Feature	Operation	CESServiceReadOnlyPolicy	CESServiceFullAccessPolicy
Overview	Viewing resource monitoring metrics	Supported	Supported
Dashboards	Creating a dashboard	Not supported	Supported
	Viewing a dashboard	Supported	Supported
	Viewing monitoring data in a large screen	Supported	Supported
	Adding a graph	Not supported	Supported
	Viewing a graph	Supported	Supported
	Modifying a graph	Not supported	Supported
	Deleting a graph	Not supported	Supported
	Adjusting the position of a graph	Supported	Supported
	Deleting a dashboard	Not supported	Supported
My Dashboards	Creating a dashboard	Not supported	Supported
	Viewing monitoring data in a large screen	Supported	Supported
	Viewing a dashboard	Supported	Supported
	Deleting a dashboard	Not supported	Supported
	Adding a graph	Not supported	Supported
	Viewing a graph	Supported	Supported
	Modifying a graph	Not supported	Supported
	Deleting a graph	Not supported	Supported
	Adjusting the position of a graph	Supported	Supported
Resource Groups	Creating a resource group	Not supported	Supported
	Viewing resource groups	Supported	Supported
	Viewing resources in a resource group.	Supported	Supported
	Viewing alarm rules in a resource group	Supported	Supported
	Modifying a resource group	Not supported	Supported
	Deleting a resource group	Not supported	Supported
Alarm Rules	Creating an alarm rule	Not supported	Supported
	Modifying an alarm rule	Not supported	Supported
	Enabling an alarm rule	Not supported	Supported
	Disabling an alarm rule	Not supported	Supported
	Deleting an alarm rule	Not supported	Supported
	Exporting alarm rules	Supported	Supported
	Viewing alarm rules	Supported	Supported
	Viewing details of an alarm rule	Supported	Supported
	Viewing graphs	Supported	Supported
Alarm Records	Viewing alarm records	Supported	Supported
	Viewing monitoring details	Supported	Supported
	Masking an alarm	Not supported	Supported
	Manually clearing an alarm record	Not supported	Supported
Alarm Templates	Viewing a default alarm template	Supported	Supported
	Viewing a custom alarm template	Supported	Supported
	Creating a custom alarm template	Not supported	Supported
	Modifying a custom alarm template	Not supported	Supported
	Deleting a custom alarm template	Not supported	Supported
One-Click Monitoring	Enable one-click monitoring	Not supported	Supported
	Viewing one-click monitoring	Supported	Supported
	Modifying one-click monitoring	Not supported	Supported
	Disabling one-click monitoring	Not supported	Supported
Alarm Notification Policies	Creating a notification policy	Not supported	Supported
	Modifying a notification policy	Not supported	Supported
	Deleting a notification policy	Not supported	Supported
	Viewing a notification policy	Supported	Supported
Notification Groups	Creating a notification group	Not supported	Supported
	Adding or removing a recipient	Not supported	Supported
	Deleting a notification group	Not supported	Supported
	Viewing notification groups	Supported	Supported
Recipients	Creating a recipient	Not supported	Supported
	Modifying a recipient	Not supported	Supported
	Deleting a recipient	Not supported	Supported
	Viewing a recipient	Supported	Supported
Server Monitoring	Viewing the server list	Supported	Supported
	Viewing server monitoring metrics	Supported	Supported
	Installing the Agent	Not supported	Supported
	Configuring an agency by one click	Not supported	Supported
	Uninstalling the Agent	Not supported	Supported
	Configuring process monitoring	Not supported	Supported
	Configuring monitoring for custom processes	Not supported	Supported
Cloud Service Monitoring	Viewing the cloud service list	Supported	√
Cloud Service Monitoring	Querying metrics of a cloud service	Supported	Supported
Custom Monitoring	Adding custom monitoring data	Not supported	Supported
	Viewing the custom monitoring list	Supported	Supported
	Viewing custom monitoring data	Supported	Supported
Event Monitoring	Adding a custom event	Not supported	Supported
	Viewing events	Supported	Supported
	Viewing event details	Supported	Supported
Data Dump	Creating a dump task	Not supported	Supported
	Querying data dump tasks	Supported	Supported
	Querying a data dump task	Supported	Supported
	Modifying a data dump task	Not supported	Supported
	Starting a data dump task	Not supported	Supported
	Stopping a data dump task	Not supported	Supported
	Deleting a data dump task	Not supported	Supported
Others	Configuring data dump	Not supported	Supported
	Exporting monitoring data	×	Supported
	Sending an alarm notification	Not supported	Supported

Helpful Links

IAM Service Overview
For details about how to grant permissions using IAM, see section "Using IAM to Grant Access to Cloud Eye" in the Cloud Eye User Guide.
For details about identity policy-based authorization, see section "Actions Supported by Identity Policy-based Authorization" in Cloud Eye API Reference.

Previous topic: Region and AZ