Using IAM Roles or Policies to Grant Access to COC

Prerequisites

Before authorizing a user group, learn about the permissions supported by COC and select permissions based on your service requirements. For details, see Permissions Management. For the permissions of other services, see system-defined permissions supported by IAM.

Example Workflow

Figure 1 Process of granting COC permissions to a user

1. Create a user group and assign permissions to it.

   Create a user group on the IAM console, and assign the COC ReadOnlyAccessPolicy policy to the group.

2. Create an IAM user and add it to the user group.

   Create a user on the IAM console and add the user to the group created in 1.

3. Log in and verify permissions.

   Log in to the console as the created user, and verify the user's permissions in the authorized region by performing the following operations:

   • Log in to COC. In the navigation pane, choose Task Management > To-Do Center. In the upper right corner of the displayed page, click Create. If a to-do task fails to be created (assuming that the current permission contains only COC ReadOnlyAccessPolicy), COC ReadOnlyAccessPolicy has taken effect.
   • Log in to COC. In the navigation pane, choose Task Management > To-Do Center. In the upper right corner of the displayed page, click Create. If a to-do task can be created (assume that you have only the COC FullAccess permission), the COC FullAccess permission has been applied.

Examples of Custom Policies of COC

If the system-defined COC permissions do not meet your authorization requirements, create custom policies. For actions supported for custom policies, see Policies and Actions.

You can create custom policies in either of the following ways:

• Visual editor: Select cloud services, actions, resources, and request conditions. This does not require knowledge of policy syntax.
• JSON: Create a JSON policy or edit an existing one.

For details, see Creating a Custom Policy. The following lists examples of common COC custom policies.

• Example 1: Authorize users to create O&M tasks.

  {
    "Version": "1.1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "coc:task:create"
        ]
      }
    ]
  }

• Example 2: Grant permissions to deny document deletion.

  A policy with only the Deny permissions must be used along with other policies to take effect. If the permissions granted to an IAM user contain both Allow and Deny, the Deny permissions take precedence over the Allow permissions.

  Assume that you want to grant the permissions of the COC FullAccess policy to a user but want to prevent them from deleting documents. You can create a custom policy for denying document deletion, and attach both policies to the user. As an explicit deny in any policy overrides any allows, the user can perform all operations on COC resources except deleting documents. The following is an example of a deny policy:

  {
    "Version": "1.1",
    "Statement": [
      {
        "Effect": "Deny",
        "Action": [
          "coc:document:delete"
        ]
      }
    ]
  }

• Example 3: Create a custom policy containing multiple actions.
  A custom policy can contain the actions of multiple services that are of the project-level type. The following is an example policy containing actions of multiple services:

  {
    "Version": "1.1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "coc:document:create",
          "scm:cert:complete"
        ]
      }
    ]
  }