Allowing DWS to Manage Resources

Application Scenarios

• Log collection: DWS obtains the write permission of LTS through an agency to report run logs to LTS.
• Audit log dump: DWS obtains the OBS management permissions through an agency to store audit logs to OBS buckets.
• KMS-encrypted cluster: DWS obtains the KMS management permissions through an agency to query and rotate KMS keys.
• Automatic node fault recovery: When a node is faulty, DWS obtains VPC management permissions through an agency to migrate the EIP from the faulty node to a normal node. It also obtains the ELB management permissions through the agency to add and delete listeners.
• Elastic scaling of a storage-compute decoupled cluster: An agency provides the Tenant Administrator permissions of DWS that allows periodic scale-out or scale-in of a read-only virtual warehouse based on an automatic addition and deletion plan.

Notes and Constraints

• We are currently optimizing DWS agency permissions. Previously, agencies relied on IAM permissions. Now, they are being migrated to a new system. To switch to the new, lower-permission agency for better resource protection, contact O&M personnel.
• By default, only Huawei Cloud accounts or users with Security Administrator permissions can query and create agencies. By default, IAM users of an account do not have permissions to query or create agencies. If you lack the permissions to query agencies or perform operations on agencies, contact an authorized user to grant DWS the required permissions on the current page.
• Agency permissions are obtained from the cache, which is updated once an hour. If you update an agency, the update will take effect one hour later.

DWS Agency Permissions (New)

The following table lists the optimized agency and its permission, based on the APIs on which the agency operations depend.

You can log in to the IAM management console, choose Permissions > Policies/Roles, and click the DWS Agency Access permission to view the complete dependency information.

Figure 1 DWS Agency Access permission information

DWS Agency Permissions (Old)

The following table describes the dependency scenarios of the old agency permissions.

Creating a DWS Agency

1. Log in to the DWS console.
2. Click your account in the upper right corner of the page and choose Identity and Access Management.
3. In the navigation pane on the left, choose Agencies.
4. Click Create Agency in the upper right corner and set the following parameters:
   • Agency Name: Enter a name for the agency, for example, DWSAgencyAccess.
   • Agency Type: Select Cloud service.
   • Cloud Service: Select Data Warehouse Service (DWS).
   • Validity Period: Select a validity period for the agency. The default value is Unlimited.

5. Click OK. In the displayed dialog box, click Authorize.
6. On the displayed Authorize Agency page, select DWS Agency Access.
7. Click Next. Select All resources or specific resources for Scope, confirm the information, and click OK.
8. Check for the agency on the Agencies page. If the agency status is Normal, the agency is successfully created. The agency permissions take effect within one hour. To check whether the permissions have taken effect, perform an operation that depends on the agency (for example, collecting LTS logs).

Documentation

• Introduction to IAM: Identity and Access Management
• Creating an agency: Creating an Agency and Assigning Permissions
• Granting DWS permissions using IAM: Using IAM to Grant Access to DWS