Creating a User and Granting VPC Endpoint Permissions

Use IAM to implement fine-grained permissions control over your VPC Endpoint resources. With IAM, you can:

Create IAM users for employees based on your enterprise's organizational structure. Each IAM user has their own security credentials for accessing VPC Endpoint resources.
Grant only the permissions required for users to perform a specific task.
Entrust an account or a cloud service to perform efficient O&M on your VPC Endpoint resources.

If your account does not need individual IAM users, skip this section.

This section describes the process flow for granting permissions (see Figure 1).

Prerequisites

You must learn about permissions (see Permissions) supported by VPC Endpoint and choose policies or roles according to your requirements. To grant permissions for other services, learn about all system permissions supported by IAM.

Process Flow

Figure 1 Process for granting VPC Endpoint permissions

Create a user group and assign it permissions.
On the IAM console, create a user group, choose Authorize in the Operation column, and attach the VPCEP Administrator policy to the group.
Create an IAM user and add it to the created user group.
Create a user on the IAM console and add it to the user group created in 1 by choosing Authorize in the Operation column.
Log in as the IAM user and verify permissions.
In the authorized region, perform the following operations:
- On the Service List page, choose VPC Endpoint. Click Create VPC Endpoint in the upper right corner. If you can create a VPC endpoint, the VPCEP Administrator policy has already taken effect.
- Choose another service from Service List. If a message appears indicating that you have insufficient permissions to access the service, the VPCEP Administrator policy has already taken effect.