Using IAM Identity Policies to Grant Access to COC

Prerequisites

Before granting permissions, ensure that you have learned about COC permissions. For details about the system-defined identity policies supported by COC, see Permissions Management. For the permissions of other services, see Authorization Reference.

Example Workflow

Figure 1 Process of granting COC permissions to a user

1. Create an IAM user or create a user group and assign permissions to it.

   On the IAM console, create a user or user group.

2. Attach a system-defined identity policy to the user or user group.

   Assign the read-only system identity policy COCReadOnlyPolicy to the user or user group, or attach the identity policy to the user or user group.

3. Log in and verify permissions.

   Log in to the console as an authorized user and verify the permissions.

   • Log in to COC. In the navigation pane, choose Task Management > To-Do Center. In the upper right corner of the displayed page, click Create. If a to-do task fails to be created (assume that you have only the COCReadOnlyPolicy permission), the COCReadOnlyPolicy permission has taken effect.
   • Log in to COC. In the navigation pane, choose Task Management > To-Do Center. In the upper right corner of the displayed page, click Create. If a to-do task can be created (assume that you have only the COCFullAccessPolicy permission), the COCFullAccessPolicy permission has taken effect.

Examples of Custom Identity Policies of COC

You can create custom identity policies to supplement system-defined identity policies of COC. For details about actions supported in custom identity policies, see Actions Supported by Identity Policy-based Authorization.

You can create custom identity policies in either of the following ways:

• Visual editor: Select cloud services, actions, resources, and request conditions. This does not require knowledge of policy syntax.
• JSON: Create a JSON policy or edit an existing one.

For details, see Creating a Custom Identity Policy and Attaching It to a Principal.

When creating a custom identity policy, use the Resource element to specify the resources the identity policy applies to and use the Condition element (service-specific condition keys) to control when the identity policy is in effect. For details about the supported resource types and condition keys, see Actions Supported by Identity Policy-based Authorization.

The following lists example custom identity policies for COC.

• Example 1: Authorize users to create O&M tasks.

  {
    "Version": "5.0",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "coc:task:create"
        ]
      }
    ]
  }

• Example 2: Grant permissions to deny document deletion.

  A policy with only the Deny permissions must be used along with other policies to take effect. If the permissions granted to an IAM user contain both Allow and Deny, the Deny permissions take precedence over the Allow permissions.

  Assume that you want to grant the permissions of the COCFullAccessPolicy policy to a user but want to prevent them from deleting documents. You can create a custom policy for denying document deletion, and attach both policies to the user. As an explicit deny in any policy overrides any allows, the user can perform all operations on COC resources except deleting documents. The following is an example of a deny policy:

  {
    "Version": "5.0",
    "Statement": [
      {
        "Effect": "Deny",
        "Action": [
          "coc:document:delete"
        ]
      }
    ]
  }

• Example 3: Create a custom policy containing multiple actions.
  A custom policy can contain the actions of multiple services that are of the project-level type. The following is an example policy containing actions of multiple services:

  {
    "Version": "5.0",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "coc:document:create",
          "scm:cert:complete"
        ]
      }
    ]
  }