Permissions Management

If you need to assign different permissions to personnel in your enterprise to access your VPN resources purchased on Huawei Cloud, Identity and Access Management (IAM) is a good choice for fine-grained permissions management. IAM provides identity authentication, permissions management, and access control, helping you securely manage access to your resources.

With IAM, you can use your account to create IAM users, and assign permissions to the users to control their access to specific Huawei Cloud resources. For example, some software developers in your enterprise need to use VPN resources but should not be allowed to delete them or perform any high-risk operations. In this scenario, you can create IAM users for the software developers and grant them only the permissions required for using VPN resources.

If your Huawei Cloud account does not need individual IAM users for permissions management, skip this section, which has no impact on using functions of VPN.

IAM is a free service. You only pay for the resources in your account.

For more information about IAM, see IAM Service Overview.

VPN Permissions

New IAM users do not have any permissions assigned by default. You need to first add them to one or more groups and attach policies or roles to these groups. The users then inherit permissions from the groups and can perform specified operations on cloud services based on the permissions they have been assigned.

VPN is a project-level service deployed for specific regions. When you set Scope to Region-specific projects and select the specified projects in the specified regions, the users only have permissions for VPN in the selected projects. If you set Scope to All resources, users have permissions for VPN in all region-specific projects. When accessing VPN, the users need to switch to the authorized region.

You can grant permissions by using roles or policies.

Roles: A type of coarse-grained authorization mechanism that defines permissions related to user responsibilities. There are only a limited number of roles for granting permissions to users. Some roles depend other roles to take effect. When you assign such roles to users, remember to assign the roles they depend on. However, roles are not an ideal choice for fine-grained authorization and secure access control.
Policies: a type of fine-grained authorization mechanism that defines permissions required to perform operations on specific cloud resources under certain conditions. This mechanism allows for more flexible policy-based authorization, meeting requirements for secure access control. For example, administrators can grant IAM users only permissions to manage VPN resources of a certain type.

Table 1 lists all system-defined permissions for VPN.

**Table 1** System-defined permissions for VPN
System Role/Policy Name	Description	Dependency
VPN Administrator (not recommended)	Administrator permissions for VPN. Users with these permissions can perform all operations on VPN. Users with these permissions have the VPC Administrator and Tenant Guest permissions by default. VPC Administrator: project-level policy, which is selected in the same project as VPN Administrator. Tenant Guest: project-level policy, which is selected in the same project as VPN Administrator.	-
VPN FullAccess (recommended)	Full permissions for VPN.	The actions of global services and the region-level actions cannot be configured in the same policy. As such, the following global actions are added: "tms:predefineTags:list" "scm:cert:list" "scm:cert:get" "scm:cert:download"
VPN ReadOnlyAccess	Read-only permissions on VPN resources. Users who have these permissions can only view information about VPN resources.	The actions of global services and the region-level actions cannot be configured in the same policy. As such, the following global actions are added: "tms:predefineTags:list" "scm:cert:list" "scm:cert:get"

Table 2 lists the common operations supported by system-defined permissions for S2C VPN.

**Table 2** Common operations supported by system-defined permissions for S2C VPN
Operation	VPN Administrator (Not Recommended)	VPN FullAccess (Recommended)	VPN ReadOnlyAccess
Creating a VPN gateway	√	Enterprise Edition VPN: √ Classic VPN: ×	×
Viewing a VPN gateway	√	√	√
Querying the VPN gateway list	√	√	√
Updating a VPN gateway	√	Enterprise Edition VPN: √ Classic VPN: ×	×
Deleting a VPN gateway	√	Enterprise Edition VPN: √ Classic VPN: ×	×
Creating a VPN connection	√	Enterprise Edition VPN: √ Classic VPN: √	×
Viewing a VPN connection	√	√	√
Querying the VPN connection list	√	√	√
Updating a VPN connection	√	Enterprise Edition VPN: √ Classic VPN: √	×
Deleting a VPN connection	√	Enterprise Edition VPN: × Classic VPN: √	×
Creating a customer gateway	√	Enterprise Edition VPN: √ Classic VPN: N/A	×
Viewing a customer gateway	√	Enterprise Edition VPN: √ Classic VPN: N/A	√
Querying the customer gateway list	√	Enterprise Edition VPN: √ Classic VPN: N/A	√
Updating a customer gateway	√	Enterprise Edition VPN: √ Classic VPN: N/A	×
Deleting a customer gateway	√	Enterprise Edition VPN: √ Classic VPN: N/A	×
Creating a VPN connection monitor	√	Enterprise Edition VPN: √ Classic VPN: ×	×
Querying a VPN connection monitor	√	Enterprise Edition VPN: √ Classic VPN: ×	√
Querying the VPN connection monitor list	√	Enterprise Edition VPN: √ Classic VPN: ×	√
Deleting a VPN connection monitor	√	Enterprise Edition VPN: √ Classic VPN: ×	×

Table 3 lists the common operations supported by system-defined permissions for P2C VPN.

**Table 3** Common operations supported by system-defined permissions for P2C VPN
Operation	VPN Administrator (Not Recommended)	VPN FullAccess (Recommended)	VPN ReadOnlyAccess
Subscribing to a yearly/monthly P2C VPN gateway	√	√	×
Changing the specification of a yearly/monthly P2C VPN gateway	√	√	×
Updating a P2C VPN gateway	√	√	×
Querying details about a P2C VPN gateway	√	√	√
Querying the P2C VPN gateway list	√	√	√
Querying the P2C VPN connection list	√	√	√
Creating a VPN server	√	× The actions of global services and the region-level actions cannot be configured in the same policy. As such, the following global actions are added: scm:cert:get scm:cert:list scm:cert:download	×
Querying server information on a gateway	√	√	√
Updating server information on a specified gateway	√	× The actions of global services and the region-level actions cannot be configured in the same policy. As such, the following global actions are added: scm:cert:get scm:cert:list scm:cert:download	×
Exporting the client configuration information corresponding to a server	√	√	×
Verifying the validity of CA certificates	√	√	√
Importing a client CA certificate	√	√	×
Modifying a client CA certificate	√	√	×
Querying a client CA certificate	√	√	√
Deleting a client CA certificate	√	√	×
Querying information about all servers of a tenant	√	√	√
Creating a VPN user	√	√	×
Querying the VPN user list	√	√	√
Modifying a VPN user	√	√	×
Querying a VPN user	√	√	√
Deleting a VPN user	√	√	×
Changing the password of a VPN user	√	√	×
Resetting the password of a VPN user	√	√	×
Creating a VPN user group	√	√	×
Querying the VPN user group list	√	√	√
Modifying a VPN user group	√	√	×
Querying a VPN user group	√	√	√
Deleting a VPN user group	√	√	×
Adding VPN users to a group	√	√	×
Deleting VPN users from a group	√	√	×
Querying VPN users in a group	√	√	√
Creating a VPN access policy	√	√	×
Querying the VPN access policy list	√	√	√
Modifying a VPN access policy	√	√	×
Querying a VPN access policy	√	√	√
Deleting a VPN access policy	√	√	×
Querying the AZs of P2C VPN gateways	√	√	√
Adding resource tags in batches	√	√	×
Deleting resource tags in batches	√	√	×
Querying resource instances by resource tag	√	√	√
Querying the number of resource instances	√	√	√
Querying resource tags by resource instance	√	√	√
Querying the resource tag list	√	√	√