Using IAM Roles or Policies to Grant Access to CBR

Prerequisites

Before granting permissions to user groups, learn about CBR system-defined permissions in Permissions Management. For details about how to grant permissions for other services, see System-defined Permissions.

Process Flow

Figure 1 Process of granting CBR permissions

1. On the IAM console, create a user group and grant it permissions.

   Create a user group on the IAM console, and assign the CBR ReadOnlyAccess policy to the group.

2. Create an IAM user and add it to the user group.

   On the IAM console, create a user and add it to the user group created in 1.

3. Log in as the IAM user and verify permissions.
   Log in to the CBR console as the created user. Switch to the authorized region and verify permissions.

   • Choose Service List > Cloud Backup and Recovery. Then click Buy Server Backup Vault on the CBR console. If a message appears indicating insufficient permissions to perform the operation, the CBR ReadOnlyAccess policy is in effect.
   • Choose another service in Service List. If a message appears indicating insufficient permissions to access the service, the CBR ReadOnlyAccess policy is in effect.

Example Custom Policies

You can create custom policies to supplement the system-defined policies of CBR. Add actions in custom policies as needed. For details about supported actions, see Permissions and Supported Actions > Actions Supported by Role/Policy-based Authorization in the Cloud Backup and Recovery API Reference.

To create a custom policy, choose either visual editor or JSON.

• Visual editor: Select cloud services, actions, resources, and request conditions. This does not require knowledge of policy syntax.
• JSON: Create a JSON policy or edit an existing one.

For details, see Creating a Custom Policy. The following lists examples of common CBR custom policies.

• Example 1: Grant permission to create, modify, and delete vaults.

  {
      "Version": "1.1",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "cbr:vaults:delete",
                  "cbr:vaults:create",
                  "cbr:vaults:update"
              ]
          }
      ]
  }

• Example 2: Grant permission to deny vault and backup deletion.

  A policy with only "Deny" permissions must be used together with other policies. If the permissions granted to an IAM user contain both "Allow" and "Deny", the "Deny" permissions take precedence over the "Allow" permissions.

  Assume that you want to grant the permissions of the CBR FullAccess policy to a user but want to prevent them from deleting vaults and backups. You can create a custom policy for denying vault and backup deletion, and attach this policy together with the CBR FullAccess policy to the user. As an explicit deny in any policy overrides any allows, the user can perform all operations on vaults and backups excepting deleting them.

  Example policy denying vault and backup deletion:

  {
      "Version": "1.1",
      "Statement": [
          {
              "Effect": "Deny",
              "Action": [
                  "cbr:backups:delete",
                  "cbr:vaults:delete"
              ]
          }
      ]
  }

• Example 3: Create a custom policy containing multiple actions.

  A custom policy can contain the actions of one or multiple services that are of the same type (global or project-level).

  Example policy containing multiple actions:

  {
      "Version": "1.1",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "cbr:vaults:create",
                  "cbr:vaults:update",
                  "cbr:vaults:delete"
              ]
          },
          {
              "Effect": "Allow",
              "Action": [
                  "sfs:shares:createShare"
              ]
          }
      ]
  }