Help Center/ Database and Application Migration UGO/ User Guide/ Using IAM to Grant Access to UGO/ Using IAM Identity Policies to Grant Access to UGO
Updated on 2025-11-15 GMT+08:00
View PDF
Share

Using IAM Identity Policies to Grant Access to UGO

This section describes how to use IAM to implement fine-grained permissions control for your UGO resources. With IAM, you can:

  • Create IAM users for employees based on your enterprise's organizational structure. Each IAM user will have their own security credentials for accessing UGO resources.
  • Grant users only the permissions required to perform a given task based on their job responsibilities.
  • Entrust a Huawei Cloud account or cloud service to perform efficient O&M on your UGO resources.

If your Huawei Cloud account meets your permission requirements, you can skip this section.

Figure 1 shows the process for granting permissions.

Prerequisites

Before assigning permissions to user groups, learn about identity policies listed in System-defined Permissions. To grant permissions for other services, see Permission Policies.

Process Flow

Figure 1 Process for granting UGO permissions
  1. Create a user group and assign permissions.

    Create a user group on the IAM console and assign UGOReadOnlyPolicy to the group.

  2. Create an IAM user.

    Create a user on the IAM console and add the user to the group created in 1.

  3. Log in as the IAM user and verify permissions.

    Log in to the console as the created user and verify permissions.

    In the service list, choose Databases > Database and Application Migration UGO. On the UGO page, choose Schema Migration > Database Evaluation, and click Create Project to create an evaluation project. If the evaluation project can be created (assume that the current permission contains only UGO Administrator), the evaluation project is UGO Administrator. The permission has taken effect.

    UGO custom policies

    You are advised to use system-defined policies. To create custom policies, see Permission Management.

    You can create a custom policy in either of the following ways:

    • Visual editor: Select cloud services, actions, resources, and request conditions. This does not require knowledge of policy syntax.
    • JSON: Create a JSON policy or edit an existing one.

    For details, see Creating a Custom Policy. This section contains examples of common UGO custom policies.

Examples of UGO Custom Policies

  • Example 1: Allowing a user to create an evaluation project 
    {	"Version": "1.1",	"Statement": [{		"Action": ["ugo:evaluationJob:createEvalProject"]                "Effect": "Allow",	}]}
  • Example 2: Denying a user to delete an evaluation project

    A policy with only "Deny" permissions must be used together with other policies. If a permission has both Allow and Deny actions, the Deny action will be applied.

    If you grant the UGO FullAccess identity policy to a user but do not want the user to delete evaluation projects, you can create a custom policy and grant both the UGO FullAccess and custom policies to the user. The user can perform all operations on evaluation projects except deleting them. The following is an example of a deny policy:

    {	"Version": "1.1",	"Statement": [{		"Action": ["ugo:evaluationJob:delete"],		"Effect": "Deny"	}]}