Permissions and Supported Actions

You can use Identity and Access Management (IAM) for fine-grained permissions management of your KooPhone. If your Huawei Cloud account does not need individual IAM users, you can skip this section.

New IAM users do not have any permissions assigned by default. You need to first add them to one or more groups and attach policies or roles to these groups. The users then inherit permissions from the groups and can perform specified operations on cloud services based on the permissions they have been assigned.

You can grant users permissions by using roles and policies. Roles are provided by IAM to define service-based permissions that match users' job responsibilities. Policies define API-based permissions for operations on specific resources under certain conditions, allowing for more fine-grained, secure access control of cloud resources.

Use policy-based authorization if you want to allow or deny the access to an API.

Each account has all the permissions required to call all APIs, but IAM users must be granted the required permissions. The required permissions are determined by the actions supported by the API. Only users with the policies allowing for those actions can call the API successfully. For example, if an IAM user wants to call an API to query ECSs, the user must be granted the permissions allowing for action ecs:servers:list.

Table 2 lists the common operations supported by system-defined permissions for KooPhone. You can choose proper permissions according to this table.

{ 
        "Version": "1.1",
        "Statement": [ { 
            "Effect": "Allow",
             "Action": [ 
                 "Koophone:*:*" 
             ] 
         }] 
      }
   }
}

{ 
        "Version": "1.1",
        "Statement": [ 
            {  
                 "Action": [ 
                     "Koophone:*get*",
                     "Koophone:*list*"
                 ], 
                 "Effect": "Allow",
             } 
          ] 
       }
    }
}