Permissions Management

KooPhone Permissions

New IAM users do not come with default permissions, so add them to one or more groups and then attach policies or roles to these groups to grant specific operation permissions on cloud services.

KooPhone is a project-level service deployed and accessed in specific physical regions. When granting permissions, set Scope to Regional-level projects and set permissions in the project (for example, cn-north-4) corresponding to the specified region (for example, CN North-Beijing4). The permissions take effect only for this project. If you set permissions for All projects, the permissions will take effect for all region-specific projects. When accessing KooPhone, you need to switch to the authorized region.

You can grant permissions to a role or by creating a policy.

• Roles: A coarse-grained authorization mechanism provided by IAM to define permissions based on job responsibilities. Available service-level roles are limited. When using roles to grant permissions, you need to also assign other roles which the permissions depend on to take effect. Roles are not ideal for fine-grained authorization and least permission access.
• Policies: A fine-grained authorization tool, provided by IAM, that defines permissions required to perform operations on specific cloud resources under certain conditions. This type of authorization is more flexible and is ideal for least permission access. For example, for KooPhone, the administrator can control IAM users to perform specified operations only on a certain module.

Table 1 lists all the system roles supported by KooPhone. This permission setting applies only to the KooPhone service, but not to the KooPhone client.

Table 2 lists the common operations supported by system-defined permissions for KooPhone. You can choose proper permissions according to this table.

References

• What Is IAM?
• For details about how to create a user group or user and grant KooPhone permissions, see "Creating a User and Granting KooPhone Permissions" in User Guide.

Content of the KooPhone Administrator Role

{ 
        "Version": "1.1",
        "Statement": [ { 
            "Effect": "Allow",
             "Action": [ 
                 "Koophone:*:*" 
             ] 
         }] 
      }
   }
}

Content of the KooPhone ReadOnlyUser Role

{ 
        "Version": "1.1",
        "Statement": [ 
            {  
                 "Action": [ 
                     "Koophone:*get*",
                     "Koophone:*list*"
                 ], 
                 "Effect": "Allow",
             } 
          ] 
       }
    }
}