Permissions Management

If you need to grant different access permissions to your CSS resources to different employees in an enterprise, Identity and Access Management (IAM) is a good choice for fine-grained permissions management. IAM provides identity authentication, permissions management, and access control, helping you securely access Huawei Cloud resources. If your Huawei Cloud account does not require IAM for permissions management, you can skip this section.

IAM is free. You pay only for the resources in your account.

With IAM, you can control access to specific Huawei Cloud resources. For example, some software developers in your enterprise need to use CSS resources but should not be allowed to delete the resources or perform any other high-risk operations. In this scenario, you can create IAM users for the software developers and grant them only the permissions required for using CSS resources.

IAM supports role/policy-based authorization and identity policy-based authorization.

The following table describes the differences between these two authorization models.

**Table 1** Differences between role/policy-based and identity policy-based authorization
Name	Core Relationship	Permissions	Authorization Method	Applicable Scenario
Role/Policy-based authorization	User-permission-authorization scope	System-defined role System-defined policy Custom policies	Assigning roles or policies to principals	To authorize a user, you need to add it to a user group first and then specify the scope of authorization. It provides a limited number of condition keys and cannot meet the requirements of fine-grained permissions control. This method is suitable for small and medium enterprises.
Identity policy-based authorization	User-policy	System-defined identity policies Custom identity policies	Assigning identity policies to principals Attaching identity policies to principals	You can authorize a user by directly attaching an identity policy to them. You can customize policies and attach them to specified users. Identity policies allow you to perform refined access control more efficiently and flexibly. However, this model is more complex and requires higher personnel expertise. It is more suitable for large and medium enterprises.

Assume that you want to grant IAM users the permissions needed to create CSS clusters in CN North-Beijing4 and OBS buckets in CN South-Guangzhou. With role/policy-based authorization, the administrator needs to create two custom policies and assign both to the IAM users. With identity policy-based authorization, the administrator only needs to create one custom identity policy and configure the condition key g:RequestedRegion for the policy, and then attach the policy to the users or grant the users the access permissions to the specified regions. Identity policy-based authorization is more flexible than role/policy-based authorization.

Policies/identity policies and actions in the two authorization models are not interoperable. You are advised to use the identity policy-based authorization model. For details about system-defined permissions, see Role/Policy-based Permissions Management and Identity Policy-based Permissions Management.

For more information about IAM, see IAM Service Overview.

Role/Policy-based Permissions Management

CSS supports role/policy-based user authorization. By default, new IAM users do not have permissions assigned. You need to add a user to one or more groups, and attach permissions policies or roles to these groups. Users inherit permissions from the groups to which they are added and can perform specified operations on cloud services based on the permissions.

CSS is a project-level service deployed and accessed in specific physical regions. When you set Scope to Region-specific projects and select the specified projects (for example, ap-southeast-2) in the specified regions (for example, AP-Bangkok), the users only have permissions for ECSs in the selected projects. If you set Scope to All resources, the users have permissions for ECSs in all region-specific projects. When accessing CSS, the users need to switch to a region where they have been authorized to use this service.

Table 2 lists all the system-defined roles and policies supported by CSS. System-defined policies in role/policy-based authorization are not interoperable with those in identity policy-based authorization.

**Table 2** CSS system permissions
Role/Policy Name	Description	Type	Dependency
CSS Administrator	Full permissions for CSS. This role depends on the Tenant Guest, Server Administrator, and IAM ReadOnlyAccess roles in the same project.	System-defined role	The VPCEndpoint Administrator system role is required for accessing a cluster through a VPC endpoint. The CES Administrator system role is required for using the Cloud Eye monitoring service. Some operations depend on the following permissions: View the agency list: iam:agencies:listAgencies iam:permissions:listRolesForAgency iam:permissions:listRolesForAgencyOnProject Automatically create an agency: iam:agencies:listAgencies iam:agencies:createAgency iam:permissions:grantRoleToAgency Display enterprise projects and predefined tags on the console: eps:enterpriseProjects:list tms:predefineTags:list Use the snapshot, word dictionary, and log management functions: obs:bucket:Get* obs:bucket:List* obs:object:List* obs:object:Get* obs:bucket:HeadBucket obs:object:PutObject obs:object:DeleteObject bss:order:update bss:order:pay
CSS FullAccess	Full CSS permissions granted through policies. Users with these permissions can perform all operations on CSS. Some functions depend on corresponding permissions. To use certain functions, you need to enable the dependent permissions in the same project.	System-defined policy
CSS ReadOnlyAccess	Read-only permissions for CSS. Users with these permissions can only view CSS data. Some functions depend on corresponding permissions. To use certain functions, you need to enable the dependent permissions in global services.	System-defined policy	Some operations depend on the following permissions: View the agency list: iam:agencies:listAgencies iam:permissions:listRolesForAgency iam:permissions:listRolesForAgencyOnProject Display enterprise projects and predefined tags on the console: eps:enterpriseProjects:list tms:predefineTags:list Use the snapshot, word dictionary, and log management functions: obs:bucket:Get* obs:bucket:List* obs:object:List* obs:object:Get* obs:bucket:HeadBucket

Table 3 lists the common operations supported by system-defined policies for CSS.

**Table 3** Common operations supported by each system-defined policy
Operation	CSS FullAccess	CSS ReadOnlyAccess	CSS Administrator	Remarks
Creating a cluster	√	x	√	-
Querying the cluster list	√	√	√	-
Querying the cluster details	√	√	√	-
Deleting a cluster	√	x	√	-
Restarting a cluster	√	x	√	-
Expanding cluster capacity	√	x	√	-
Adding instances and expanding storage	√	x	√	-
Querying tags of a specified cluster	√	√	√	-
Querying all tags	√	√	√	-
Loading a custom word dictionary	√	x	√	Depends on OBS and IAM permissions
Querying the status of a custom word dictionary	√	√	√	-
Deleting a custom word dictionary	√	x	√	-
Automatically setting basic configurations of a cluster snapshot	√	x	√	Depends on OBS and IAM permissions
Modifying basic configurations of a cluster snapshot	√	x	√	Depends on OBS and IAM permissions
Setting the automatic snapshot creation policy	√	x	√	-
Querying the automatic snapshot creation policy	√	√	√	-
Manually creating a snapshot	√	x	√	-
Querying the snapshot list	√	√	√	-
Restoring a snapshot	√	x	√	-
Deleting a snapshot	√	x	√	-
Disabling the snapshot function	√	x	√	-
Modifying specifications	√	x	√	-
Changing a security group	√	x	√	-
Scaling in clusters	√	x	√	-
Replacing a node	√	×	√	-
Configuring the security mode	√	×	√	-
Adding master or client nodes	√	×	√	-

Identity Policy-based Permissions Management

CSS supports identity policy-based authorization. Table 4 lists all the system-defined identity policies for CSS. System-defined policies in identity policy-based authorization are not interoperable with those in role/policy-based authorization.

**Table 4** System-defined policies of CSS
Policy Name	Description	Type
CSSFullAccessPolicy	Full permissions for CSS. The dependent service permissions are not included. You can configure the dependent service permissions as required.	System-defined identity policies
CSSReadOnlyAccess	Read-only permissions for CSS.	System-defined identity policies

The system-defined identity policies for CSS do not include mission-critical permissions. To grant such permissions to users, you need to create custom policies, for example, iam:agencies:createagency (automatic agency creation), obs:object:getObject (reading from OBS buckets), billing:order:pay (billing, ordering, and payment), and obs:bucket:listBucket (checking files in OBS buckets).

Table 5 lists the common operations supported by system-defined identity policies for CSS.

**Table 5** Common operations supported by system-defined identity policies
Operation	CSS FullAccess	CSS ReadOnlyAccess
Creating a cluster	√	x
Querying the cluster list	√	√
Querying the cluster details	√	√
Deleting a cluster	√	x
Restarting a cluster	√	x
Expanding cluster capacity	√	x
Adding instances and expanding storage	√	x
Querying tags of a specified cluster	√	√
Querying all tags	√	√
Loading a custom word dictionary	√	x
Querying the status of a custom word dictionary	√	√
Deleting a custom word dictionary	√	x
Automatically setting basic configurations of a cluster snapshot	√	x
Modifying basic configurations of a cluster snapshot	√	x
Setting the automatic snapshot creation policy	√	x
Querying the automatic snapshot creation policy	√	√
Manually creating a snapshot	√	x
Querying the snapshot list	√	√
Restoring a snapshot	√	x
Deleting a snapshot	√	x
Disabling the snapshot function	√	x
Modifying specifications	√	x
Scaling in clusters	√	x
Changing a security group	√	x
Replacing a node	√	x
Configuring the security mode	√	x
Adding master or client nodes	√	x

Helpful Links

IAM Service Overview
Cloud Search Service User Guide > Using IAM to Grant Access to CSS
Cloud Search Service API Reference > Permissions and Supported Actions > Identity Policy-based Authorization

Previous topic: Security Risk Monitoring

Next topic: Constraints