Assigning Permissions to O&M Personnel Using IAM

Overview

Assume that a company has purchased different resources on Huawei Cloud, and has multiple functional teams that need to use one or more types of resources. The company can use IAM identity policies to set permissions for multiple O&M personnel.

Resource Planning

Based on the different responsibilities of employees in the company, employees are grouped into the following seven teams.

Figure 1 Permissions management model

• Resource O&M team: manages all resources of the company.
• Accounting management team: manages accounting affairs of the company.
• Resource monitoring team: views and monitors the resource usage.
• Computing O&M team: is responsible for the computing domain O&M.
• Network O&M team: is responsible for the network domain O&M.
• Database O&M team: is responsible for the database domain O&M.
• Security O&M team: is responsible for the security domain O&M.

Based on the division of the functional teams, resources are planned as follows.

Table 2 Resource planning

Resource	Resource Name	Description	Quantity
Administrator account	Company-A	Used to manage resources and permissions of the company.	1
IAM user groups	Network O&M	Functional teams are divided into seven user groups. The network O&M team is used as an example to describe how to create a user group.	1
IAM users	James and Alice	James and Alice are used as an example to describe how to create IAM users.	2
Permissions	VPC FullAccess and ELB FullAccess	According to the preceding table, two types of permissions need to be configured for the network O&M team.	2

IAM is a free service, so the best practices do not involve any expenditures.

Procedure

IAM allows you to assign permissions to users in the user groups. Figure 2 shows how to grant an employee the permissions required as the network O&M owner. If you want to configure employees as other O&M owners, assign the required permissions to them based on Table 1.

Figure 2 Process

Step 1: Create a User Group and Assign Permissions

1. Log in to the Huawei Cloud management console as the administrator.
2. On the management console, hover the mouse pointer over the username in the upper right corner and then choose Identity and Access Management.
3. On the IAM console, choose User Groups in the navigation pane. Then click Create User Group.
   Figure 3 Creating a user group
   
4. On the Create User Group page, enter the user group name NetworkDomainOperations and click OK. Only letters, digits, spaces, hyphens (-), and underscores (_) are allowed.
   Figure 4 Entering a group name
   
5. Locate the user group you created and click Authorize in the Operation column.
   Figure 5 Authorizing a user group
   
6. Search for VPCFullAccessPolicy and ELBFullAccessPolicy, select the two policies, and click Next.
   Figure 6 Selecting permissions
   
7. Click OK. The created user group will be displayed in the user group list.

   You can click the name of the network O&M user group and view the assigned permissions on the Permissions tab.

Step 2: Create an IAM User and Add It to the Group

1. Log in to the IAM console as the administrator and choose Users from the left navigation pane.
2. On the Users page, click Create User in the upper right corner.
   Figure 7 Creating a user
   
3. Configure basic information about users James and Alice.
   On the Create User page, enter the username and description, configure the management console access, and set a password.

   Figure 8 Setting user details
   
4. Click Next and add the IAM users James and Alice to the created network O&M user group.
   Figure 9 Adding users to the user group
   
5. Click Create User. The IAM users are created. You can download the login password.
   Figure 10 Users created
   

Step 3: Log In as an IAM User and Verify Permissions

An IAM user can log in using different methods. The following describes how to log in through the login page. For more login methods, see Logging In to Huawei Cloud.

1. On the Huawei Cloud login page, click IAM User.
2. On the IAM User Login page, enter the company's account name, IAM username, and password.
   • Account name: the name of the account that created the IAM user
   • Username and password: the username and password specified for the IAM user
   Figure 11 Logging in as the IAM user
   
3. Log in to the Huawei Cloud management console as the IAM user.
4. Choose Virtual Private Cloud and then Elastic Load Balance from the service list to go to the homepages of these services. If you can perform management operations on the homepages, the permissions are successfully configured.
5. Choose a service other than the preceding services from the service list. If the system displays a message indicating insufficient permissions, the permissions are successfully configured.