Help Center/ MetaStudio/ Service Overview/ Permissions Management
Updated on 2024-09-27 GMT+08:00
View PDF
Share

Permissions Management

If you need to grant different permissions to employees in your enterprise to access your purchased MetaStudio resources, Identity and Access Management (IAM) is a good choice for fine-grained permissions management. IAM provides identity authentication, permissions management, and access control, helping you secure access to your resources.

With IAM, you can create IAM users and grant them permissions to access only specific resources. For example, if you want some software developers in your enterprise to be able to use MetaStudio resources but do not want them to be able to delete MetaStudio resources or perform any other high-risk operations, you can create IAM users and grant permission to use MetaStudio resources but not permission to delete them.

If your account does not need individual IAM users for permissions management, skip this section.

IAM is a free service. You pay only for the resources in your account. For more information about IAM, see IAM Service Overview.

MetaStudio does not support enterprise projects.

MetaStudio Permissions

By default, new IAM users do not have permissions assigned. You need to add a user to one or more groups, and attach permissions policies or roles to these groups. Users inherit permissions from the groups to which they are added and can perform specified operations on cloud services based on the permissions.

MetaStudio is a project-level service deployed and accessed in specific physical regions. To assign MetaStudio permissions to a user group, specify the scope as region-specific projects and select projects (such as ap-southeast-2) for the permissions to take effect. If you select All projects, the permissions will take effect for user groups in all region-specific projects. When accessing MetaStudio, the users need to switch to a region where they have been granted permissions to use this service.

You can grant users permissions by using roles and policies.
  • Roles: A type of coarse-grained authorization mechanism that defines permissions related to user responsibilities. This mechanism provides only a limited number of service-level roles for authorization. When using roles to grant permissions, you need to also assign other roles on which the permissions depend to take effect. However, roles are not an ideal choice for fine-grained authorization and secure access control.
  • Policies: A fine-grained authorization strategy that defines permissions required to perform operations on specific cloud resources under certain conditions. This mechanism allows for more flexible policy-based authorization, meeting requirements for secure access control.
Table 1 lists all system-defined policies of MetaStudio.
Table 1 System-defined policies of MetaStudio

Policy Name

Description

Type

Policy Content

MetaStudio FullAccess

Administrator permissions for MetaStudio. This policy contains all permissions of MetaStudio.

System-defined policy

MetaStudio FullAccess Policy

MetaStudio ReadOnlyAccess

Read-only permissions for MetaStudio. Users granted these permissions can only view MetaStudio data.

System-defined policy

MetaStudio ReadOnlyAccess Policy

Helpful Links

MetaStudio FullAccess Policy

{
            "Version": "1.1",
            "Statement": [
                {
                    "Action": [
                        "metastudio:*:*"
                    ],
                    "Effect": "Allow"
                }
            ]
}

MetaStudio ReadOnlyAccess Policy

{
            "Version": "1.1",
            "Statement": [
                {
                    "Action": [
                        "metastudio:*:show*"
                    ],
                    "Effect": "Allow"
                }
            ]
}