Updated on 2024-08-16 GMT+08:00

Introduction

If you need to assign different permissions to employees in your enterprise to access your Cost Center, Identity and Access Management (IAM) is a good choice for fine-grained permissions management.

IAM is a free service. You only pay for the resources in your account. For more information about IAM, see IAM Service Overview.

System-Defined Roles

New IAM users do not have any permissions assigned by default. You need to first add them to one or more groups and attach policies or roles to these groups. The users then inherit permissions from the groups and can perform specified operations on cloud services based on the permissions they have been assigned. IAM provides frequently used roles that have permissions to access different services, and you have the permissions granted to these roles.

You can grant users permissions by using roles and policies.

  • Roles: A coarse-grained authorization strategy provided by IAM to assign permissions based on users' job responsibilities. Only a limited number of service-level roles are available for authorization. Huawei Cloud services depend on each other. When you grant permissions using roles, you also need to attach dependent roles. Roles are not ideal for fine-grained authorization and least privilege access.
  • Policies: A fine-grained authorization strategy that defines permissions required to perform operations on specific cloud resources under certain conditions. This type of authorization is more flexible and is ideal for least privilege access.

Table 1 lists all the system-defined roles for Cost Center.

Table 1 System-defined roles

Role Name

Permissions

BSS Administrator

Full permissions for Cost Center. This role is generally granted to the administrator.

BSS ReadonlyAccess

Read-only permissions for Billing Center, Cost Center, and Message Center.

BSS FinanceAccess

Billing Center's financial administrator, who has full permissions for financial operations.

Table 2 lists the common operations supported by system-defined permissions for Cost Center.

Table 2 Common operations supported by system-defined permissions

Function

BSS Administrator

BSS ReadonlyAccess

BSS FinanceAccess

Viewing budget reports, including the budget report list and report details

Supported

Supported

Supported

Viewing cost monitors and anomalies

Supported

Supported

Supported

Viewing cost anomaly notifications

Supported

Supported

Supported

Viewing cost analyses

Supported

Supported

Supported

Exporting cost data, including analysis results, cost details, and budgets

Supported

Not supported

Supported

Analyzing utilization and coverage of savings plans

Supported

Supported

Supported

Evaluating cost optimization option of changing pay-per-use to yearly/monthly

Supported

Supported

Supported

Viewing cost tags

Supported

Supported

Supported

Viewing cost optimization subscriptions

Supported

Supported

Supported

Viewing a list of cost reports

Supported

Supported

Supported

Viewing the task list for exporting cost details to OBS

Supported

Supported

Supported

Viewing the analysis of RI utilization and coverage

Supported

Supported

Supported

Viewing cost optimization summary

Supported

Supported

Supported

Viewing the percentage of costs that are allocated

Supported

Supported

Supported

Viewing maturity scores

Supported

Supported

Supported

Viewing savings plans

Supported

Supported

Supported

Viewing bills, monthly costs, usage details, cost management, expenditures and revenues, and cost trends

Supported

Supported

Supported

Viewing budget information, including the budget list and budget details

Supported

Supported

Supported

Viewing parameter settings for Cost Center

Supported

Not supported

Not supported

Obtaining recommendations for savings plans

Supported

Not supported

Supported

Viewing cost category information, including the cost category list and the details of each cost category

Supported

Supported

Supported

Exporting bills, monthly costs, and usage details, and creating, deleting, modifying, exporting cost reports, and exporting income and revenues

Supported

Not supported

Supported

Disabling functions

Supported

Not supported

Supported

Enabling Cost Center

Supported

Not supported

Supported

Setting parameters for Cost Center

Supported

Not supported

Not supported

Deleting cost monitors

Supported

Not supported

Supported

Enabling functions

Supported

Not supported

Supported

Configuring cost categories, including creating and editing cost categories

Supported

Not supported

Supported

Managing cost reports, including creating, modifying, and deleting custom reports.

Supported

Not supported

Supported

Activating or deactivating cost tags

Supported

Not supported

Supported

Creating and modifying cost monitors

Supported

Not supported

Supported

Creating cost anomaly notifications

Supported

Not supported

Supported

Deleting cost categories

Supported

Not supported

Supported

Deleting budget reports

Supported

Not supported

Supported

Managing budgets, including creating, modifying, and deleting budgets

Supported

Not supported

Supported

Configuring cost optimization subscriptions

Supported

Not supported

Supported

Creating and modifying budget reports

Supported

Not supported

Supported

Creating, modifying, or deleting tasks for exporting cost details to OBS

Supported

Not supported

Supported

Creating a Custom Policy

You can create custom policies to supplement the system-defined roles. For details about the actions supported by custom policies, see Table 3.

Table 3 Supported actions

Fine-Grained Permissions Policy

Description

bss:costcenter:start

Enables Cost Center.

bss:costanalysis:view

Views cost analysis and overview.

bss:costanalysis:export

Exports cost details, including original and amortized cost details, with cost tags.

bss:costreport:view

Views a list of cost reports.

bss:costreport:update

Manages cost reports, including creating, modifying, and deleting custom reports.

If this permission is granted to an IAM user, you must also grant the user the bss:costreport:view permission.

bss:budget:update

Manages budgets, including creating, modifying, and deleting budgets.

If this permission is granted to an IAM user, you must also grant the user the bss:budget:view permission.

bss:budget:view

Views budget information, including the budget list and budget details.

bss:budgetreport:update

Creates and modifies budget reports.

bss:budgetreport:delete

Deletes budget reports.

bss:budgetreport:view

Views budget reports, including the budget report list and report details.

bss:riusageanalysis:view

Views the analysis of RI utilization and coverage.

bss:costtag:view

Views cost tags.

bss:costtag:update

Activates or deactivates cost tags.

If this permission is granted to an IAM user, you must also grant the user the bss:costtag:view permission.

bss:costunit:update

Configures cost categories, including creating and editing cost categories. If this permission is granted to an IAM user, you must also grant the user the bss:costunit:view and bss:costanalysis:view permissions.

bss:costunit:delete

Deletes cost categories. If this permission is granted to an IAM user, you must also grant the user bss:costunit:view permission.

bss:costunit:view

Views cost category information, including the cost category list and the details of each cost category.

bss:monitor:update

Creates and modifies cost monitors.

bss:monitor:delete

Deletes cost monitors.

bss:monitor:view

Views cost monitors and anomalies.

bss:monitoralert:update

Creates cost anomaly notifications.

If this permission is granted to an IAM user, you must also grant the user the bss:monitoralert:view permission.

bss:monitoralert:view

Views cost anomaly notifications.

bss:costoptimization:view

Evaluates cost optimization option of changing pay-per-use to yearly/monthly.

bss:costpreferences:update

Enables functions on the Preferences page.

bss:costpreferences:delete

Disables functions on the Preferences page.

bss:savingsplan:view

Views savings plans.

bss:savingsplan:analysis

Views the analysis of savings plan utilization and coverage.

bss:savingsplan:suggest

Obtains recommendations for savings plans.

bss:recommendation:view

Views cost optimization summary.

bss:recommendationsub:view

Views cost optimization subscriptions.

bss:recommendationsub:update

Configures cost optimization subscriptions.

bss:costdetailreport:view

Views tasks for exporting cost details to OBS.

bss:costdetailreport:update

Creates, modifies, or deletes tasks for exporting cost details to OBS.