Authorization Using an Agency

Constraints

Comply with the following constraints s when using an agency for CCI to avoid service interruptions:

• Do not delete the agency automatically created by CCI on the IAM console. CCI uses this agency to access your compute, storage, networking, and monitoring resources.
• If the agency is deleted, the core functions of CCI (such as pod startup) will become invalid immediately, and resource billing will be abnormal.
• If the agency is deleted by mistake, you must call the API for creating an agency or trigger re-authorization on the CCI console.

Permission Configuration Requirements

Before using CCI 2.0 (including the console and APIs), you need to create and manage the CCI agency. Based on the principle of least privilege (PoLP), an IAM user must have the IAM operation permissions below when creating or updating an agency, or the operations will fail.

Policy Configuration Example

You can create a custom policy (on the old IAM console) or custom identity policy (on the new IAM console), copy the content below to the JSON view, and grant permissions to the user or user group that manages CCI.

Content of a custom policy (old IAM console):

{
    "Version": "1.1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "iam:agencies:createAgency",
                "iam:permissions:grantRoleToAgencyOnProject"
            ]
        }
    ]
}

Content of a custom identity policy (old IAM console):

{
  "Version": "5.0",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "iam:agencies:create",
        "iam:agencies:grantRoleOnProject"
      ]
    }
  ]
}