Help Center/ Auto Scaling/ User Guide/ Using IAM to Grant Access to AS/ Using IAM Identity Policies to Grant Access to AS
Updated on 2026-01-07 GMT+08:00
View PDF
Share

Using IAM Identity Policies to Grant Access to AS

System-defined permissions in identity policy-based authorization provided by IAM let you control access to your AS resources. With IAM, you can:

  • Create IAM users or user groups for personnel based on your enterprise's organizational structure. Each IAM user has their own identity credentials for accessing AS resources.
  • Grant users only the permissions required to perform a given task based on their job responsibilities.
  • Entrust a Huawei Cloud account or a cloud service to perform efficient O&M on your AS resources.

If your Huawei Cloud account meets your permissions requirements, you can skip this section.

Figure 1 shows the process flow of identity policy-based authorization.

Prerequisites

Before granting permissions, learn about Identity Policy-based Authorization for AS. To grant permissions for other services, learn about all system-defined permissions supported by IAM.

Process Flow

Figure 1 Process for granting AS permissions
  1. On the IAM console, create an IAM user or create a user group.
  2. Attach a system-defined policy (ASReadOnlyPolicy as an example) to the user or user group.

    Assign the permissions defined in the system-defined identity policy ASReadOnlyPolicy to the user or group, or attach the system-defined identity policy to it.

  3. Log in and verify permissions.

    Log in to the AS console using the IAM user and verify the permissions.

    • Click Create AS Group in the upper right corner. If a message appears indicating that you have insufficient permissions to perform the operation, the ASReadOnlyPolicy is in effect.
    • Choose another service from Service List. If a message appears indicating that you have insufficient permissions to access the service, the ASReadOnlyPolicy policy is in effect.
  4. (Optional) Create custom policies to supplement the system-defined identity policies of AS. Add actions in custom identity policies as needed. For details, see Actions Supported by Identity Policy-based Authorization.

    To create a custom identity policy, choose either visual editor or JSON.

    • Visual editor: Select cloud services, actions, resources, and request conditions. This does not require knowledge of policy syntax.
    • JSON: Create a JSON policy or edit an existing one.

    For details, see Creating a Custom Identity Policy and Attaching It to a Principal.

    When creating a custom identity policy, use the Resource element to specify the resources the policy applies to and use the Condition element (condition keys) to control when the policy is in effect. For details about the supported resource types and condition keys, see Identity Policy-based Authorization. The following are examples of custom AS identity policies.

Example Custom Identity Policies

  • Example 1: Grant permissions to create and delete AS groups. 
    {
    "Version": "5.0",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "as:scalingGroup:create",
                "as:scalingGroup:delete"
            ]
        }
    ]
}
  • Example 2: Create a custom policy containing multiple actions.

    A custom identity policy can contain the actions of one or multiple services. The following is an example policy containing multiple actions:

    {
    "Version": "5.0",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "as:scalingGroup:create",
                "as:scalingGroup:delete",
                "as:scalingGroup:list"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "ecs:cloudServers:showServer"
            ]
        }
    ]
}