Creating a User and Granting MgC Permissions

Prerequisites

Before assigning permissions to user groups, you should learn about system-defined policies supported by MgC and select the policies based on service requirements.

For details about the system-defined policies supported by MgC and the comparison between them, see System-defined Policies. For the system-defined policies of other services, see System-defined Permissions.

Process Flow

Figure 1 Granting MgC permissions to users

1. Create a user group and assign permissions to it.
   • System-defined policy: Create a user group on the IAM console, and assign the MgC system-defined policies to the user group based on the Description of MgC System-defined Policies and actual permissions requirements. Select All Resources for Scope.

     Table 1 MgC system-defined policies

     Policy Name	Description	Policy Type	Policy Content
     MgC FullAccess	Administrator permissions for MgC. Users with these permissions can perform all operations on MgC data.	System-defined policy	MgC FullAccess Policy Content
     MgC ReadOnlyAccess	Read-only permissions for MgC. Users with permissions can only view MgC data.	System-defined policy	MgC ReadOnlyAccess Policy Content
     MgC DiscoveryAccess	Permissions for resource discovery of MgC. Users with these permissions can use the resource discovery function of MgC and view MgC data.	System-defined policy	MgC DiscoveryAccess Policy Content
     MgC AssessAccesss	Permissions for application assessment of MgC. Users with these permissions can use the resource discovery and application assessment functions of MgC and view MgC data.	System-defined policy	MgC AssessAccesss Policy Content
     MgC MigrateAccess	Permissions for application migration of MgC. Users with these permissions can use the resource discovery, application assessment, and application migration functions of MgC and view MgC data.	System-defined policy	MgC MigrateAccess Policy Content
     MgC AppDiscoveryAccess	Permissions for application discovery of MgC. Users with these permissions can use the application discovery and resource discovery functions of MgC and view MgC data.	System-defined policy	MgC AppDiscoveryAccess Policy Content
     MgC MrrAccess	Permissions for service verification of MgC. Users with these permissions can use the service verification function of MgC and view MgC data.	System-defined policy	MgC MrrAccess Policy Content

   • Custom policy: If an IAM user only needs specific MgC permissions, create custom policies. For details, see MgC Custom Policies.
2. Create an IAM user and add it to the user group.

   Create a user on the IAM console and add the user to the group created in 1.

   

   When the IAM user access certain MgC functions for the first time, the IAM user needs to authorize MgC through agencies. Therefore, the IAM user must have the permissions required to create agencies. There are two methods for the IAM user to obtain the required permissions.

   • (Recommended) Ask the administrator to log in to the MgC console and access the corresponding functions to complete the authorization.
   • Ask the administrator to grant the corresponding system-defined MgC permissions and the iam:agencies:createAgency, iam:permissions:grantRoleToAgency, and iam:roles:updateRole permissions on the IAM console.
3. Sign in and verify permissions.

   Sign in to the IAM console using the created IAM user, and in the authorized region, perform the following operations:

   • Choose Service List > Migration Center. On the MgC console, perform operations based on the granted permissions. If you can, the granted permissions have taken effect.
   • Choose another service from Service List. If a message appears indicating that you have insufficient permissions to access the service, the granted permissions have taken effect.

MgC FullAccess Policy Content

{
    "Version": "1.1",
    "Statement": [
        {
            "Action": [
                "mgc:*:*",
                "iam:agencies:listAgencies",
                "iam:roles:listRoles",
                "iam:quotas:listQuotas",
                "iam:permissions:listRolesForAgency"
            ],
            "Effect": "Allow"
        }
    ]
}

MgC ReadOnlyAccess Policy Content

{
    "Version": "1.1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "mgc:*:query*"
            ]
        }
    ]
}

MgC DiscoveryAccess Policy Content

{
    "Version": "1.1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "mgc:*:query*",
                "mgc:*:discovery"
            ]
        }
    ]
}

MgC AssessAccess Policy Content

{
    "Version": "1.1",
    "Statement": [
        {
            "Action": [
                "mgc:*:query*",
                "mgc:*:discovery",
                "mgc:*:assess",
                "iam:agencies:listAgencies",
                "iam:roles:listRoles",
                "iam:quotas:listQuotas",
                "iam:permissions:listRolesForAgency"
            ],
            "Effect": "Allow"
        }
    ]
}

MgC MigrateAccess Policy Content

{
    "Version": "1.1",
    "Statement": [
        {
            "Action": [
                "mgc:*:query*",
                "mgc:*:discovery",
                "mgc:*:assess",
                "mgc:*:migrate",
                "iam:agencies:listAgencies",
                "iam:roles:listRoles",
                "iam:quotas:listQuotas",
                "iam:permissions:listRolesForAgency"
            ],
            "Effect": "Allow"
        }
    ]
}

MgC AppDiscoveryAccess Policy Content

{
    "Version": "1.1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "mgc:*:query*",
                "mgc:*:discovery",
                "mgc:*:appdiscovery"
            ]
        }
    ]
}

MgC MrrAccess Policy Content

{
            "Version": "1.1",
            "Statement": [
                {
                    "Action": [
                        "mgc:*:query*",
                        "mgc:mrr:query",
                        "mgc:mrr:update",
                        "mgc:mrr:export",
                        "mgc:mrr:import",
                        "mgc:mrr:upgrade",
                        "mgc:mrr:delete",   
                        "mgc:mrr:check"
                    ],
                    "Effect": "Allow"
                }
            ]
        }
    }
}