Permissions

If you need to assign different permissions to personnel in your enterprise to access your DMS for RabbitMQ resources, Identity and Access Management (IAM) is a good choice for fine-grained permissions management. IAM provides identity authentication, permissions management, and access control, helping you to securely access your Huawei Cloud resources. If your HUAWEI ID does not require individual IAM users for permissions management, you can skip this section.

IAM is a free service. You only pay for the resources in your account.

With IAM, you can control access to specific Huawei Cloud resources. For example, if you want some software developers in your enterprise to use DMS for RabbitMQ resources but do not want them to delete RabbitMQ instances or perform any other high-risk operations, you can grant permission to use RabbitMQ instances but not permission to delete them.

IAM supports role/policy-based authorization and identity policy-based authorization.

The following table describes the differences between the two authorization models.

**Table 1** Differences between role/policy-based and identity policy-based authorization
Authorization Model	Authorization Using	Permissions	Authorization Method	Description
Role/Policy	User-permission-authorization scope	System-defined roles System-defined policies Custom policies	Assigning roles or policies to principals	To grant permissions to a user, you need to add it to a user group and then grant permissions to the user group. You cannot directly grant permissions to a user. There are a lot of user groups for management but only a limited number of condition keys for use. It is hard to provide fine-grained permissions control. This method is suitable for small- and medium-sized enterprises.
Identity policy	User-policy	System-defined identity policies Custom identity policies	Assigning identity policies to principals Attaching identity policies to principals	You can authorize a user by attaching an identity policy to it. User-specific authorization and a variety of key conditions allow for more fine-grained permissions control. However, this model can be hard to set up. It requires a certain amount of expertise and is suitable for medium- and large-sized enterprises.

Assume that you want to grant IAM users permission to create ECSs in AP-Bangkok and OBS buckets in AP-Singapore. With role/policy-based authorization, the administrator needs to create two custom policies and assign both to the IAM users. With identity policy-based authorization, the administrator only needs to create one custom identity policy, configure the condition key g:RequestedRegion for the policy, and then attach the policy to the users or grant the users the access permissions to the specified regions. Identity policy-based authorization is more flexible than role/policy-based authorization.

Policies/identity policies and actions in the two authorization models are not interoperable. You are advised to use the identity policy-based authorization model. For details about system-defined permissions, see System-defined Permissions in Role/Policy-based Authorization and System-defined Permissions in Identity Policy-based Authorization.

For more information about IAM, see IAM Service Overview.

System-defined Permissions in Role/Policy-based Authorization

DMS for RabbitMQ supports role/policy-based authorization. New IAM users do not have any permissions assigned by default. You need to first add them to one or more groups and attach policies or roles to these groups. The users then inherit permissions from the groups and can perform specified operations on cloud services based on the permissions they have been assigned.

DMS for RabbitMQ is a project-level service deployed for specific regions. When you set Scope to Region-specific projects and select the specified projects (for example, ap-southeast-2) in the specified regions (for example, AP-Bangkok), the users only have permissions for resources in the selected projects. If you set Scope to All resources, the users have permissions for resources in all region-specific projects. When accessing DMS for RabbitMQ, the users need to switch to the authorized region.

Table 2 lists all the system-defined permissions for DMS for RabbitMQ. System-defined policies and system-defined identity policies in the two authorization models are not interoperable.

**Table 2** System-defined permissions for DMS for RabbitMQ
Role/Policy Name	Description	Type	Dependencies
DMS FullAccess	Administrator permissions for DMS. Users with these permissions can perform all operations on DMS.	System-defined policy	None
DMS UserAccess	Common user permissions for DMS, excluding permissions for creating, modifying, deleting, and scaling up instances.	System-defined policy	None
DMS ReadOnlyAccess	Read-only permissions for DMS. Users granted these permissions can only view DMS data.	System-defined policy	None
DMS VPCAccess	VPC operation permissions to assign to DMS agencies.	System-defined policies	None
DMS KMSAccess	KMS operation permissions to assign to DMS agencies.	System-defined policies	None
DMS ELBAccess	ELB operation permissions to assign to DMS agencies.	System-defined policies	None
DMS VPCEndpointAccess	VPC endpoint operation permissions to assign to DMS agencies.	System-defined policies	None
DMSAgencyCheckAccessPolicy	IAM operation permissions to assign to DMS agencies.	System-defined policies	None
DMS BSSAccess	BSS operation permissions to assign to DMS agencies.	System-defined policy	None
DMS OBSAccess	OBS operation permissions to assign to DMS agencies.	System-defined policy	None
DMS Administrator	Administrator permissions for DMS.	System-defined role	Tenant Guest and VPC Administrator roles, which must be attached in the same project as the DMS Administrator role

Table 3 lists the common operations supported by system-defined permissions for DMS for RabbitMQ.

**Table 3** Common operations supported by system-defined policies
Operation	DMS FullAccess	DMS UserAccess	DMS ReadOnlyAccess
Creating an instance	√	×	×
Modifying an instance	√	×	×
Deleting an instance	√	×	×
Modifying instance specifications	√	×	×
Querying instance information	√	√	√

Only system-defined policies listed in Table 3 have permissions to perform common operations on DMS for RabbitMQ.

System-defined Permissions in Identity Policy-based Authorization

DMS for RabbitMQ supports identity policy-based authorization. Table 4 lists all the system-defined identity policies for DMS for RabbitMQ. System-defined identity policies and system-defined policies in the two authorization models are not interoperable.

**Table 4** System-defined identity policies for DMS for RabbitMQ
Policy Name	Description	Type
DMSReadOnlyAccessPolicy	Read-only permissions for DMS	System-defined identity policies
DMSUserAccessPolicy	Common user permissions for DMS, excluding permissions for creating, modifying, deleting, and scaling up instances	System-defined identity policies
DMSFullAccessPolicy	Full permissions for DMS	System-defined identity policies
DMSServiceLinkedAgencyPolicy	Permissions of service-linked agencies for DMS.	System-defined identity policies
DMSConsoleFullAccessPolicy	Full permissions for operations on the DMS console.	System-defined identity policies

Table 5 lists the common operations supported by system-defined policies for DMS for RabbitMQ.

**Table 5** Common operations supported by system-defined identity policies
Operation	DMSReadOnlyAccessPolicy	DMSUserAccessPolicy	DMSFullAccessPolicy	DMSConsoleFullAccessPolicy
Creating an instance	×	×	√	√
Modifying an instance	×	×	√	√
Deleting an instance	×	×	√	√
Modifying instance specifications	×	×	√	√
Querying instance information	√	√	√	√