Permissions and Supported Actions

This section describes fine-grained permissions management for your CodeArts resources. If your account does not need individual IAM users, you can skip over this section.

New IAM users do not have any permissions assigned by default. You need to first add them to one or more groups and attach policies or roles to these groups. The users then inherit permissions from the groups and can perform specified operations on cloud services based on the permissions they have been assigned.

You can grant users permissions by using roles and policies. Roles are provided by IAM to define service-based permissions that match users' job responsibilities. Policies define API-based permissions for operations on specific resources under certain conditions, allowing for more fine-grained, secure access control of cloud resources.

If you want to allow or deny the access to an API, use policy-based authorization.

Your account has all the permissions required to call all APIs. If you use IAM users in your account to call an API, the IAM users must be granted the required permissions. To call this API, the user must have the Tenant Administrator permission.